Function at 0x18902
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
call fcn.00016f26
test eax, eax
jne 0x18928
xor al, al
jmp 0x19114
call fcn.0001889e
test al, al
je 0x18938
mov al, 1
jmp 0x19114
push ebx
push esi
push 0x18
pop esi
xor ebx, ebx
push ebx
push ebx
push 0x20
push 1
push 1
push pe_nt_image_headers32
push ebx
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x34c]
push eax
push 0x80000000
lea eax, [ebp - 0x314]
push eax
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x348], ebx
mov dword [ebp - 0x340], 0x240
mov dword [ebp - 0x344], 0x186d3c8
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x338], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jge 0x189a4
xor al, al
jmp 0x19112
push 5
push esi
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 0x314]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x19104
mov ecx, dword [ebp - 0x358]
cmp ecx, ebx
jl 0x19104
mov eax, dword [ebp - 0x35c]
jg 0x189e8
cmp eax, 8
jb 0x19104
mov dword [ebp - 0x324], eax
mov esi, 0x5246
push esi
add eax, 0x208
push eax
mov dword [ebp - 0x320], ecx
call fcn.0001457a
push eax
call fcn.000123d2
mov edi, eax
mov dword [ebp - 0x310], edi
cmp edi, ebx
je 0x19104
mov eax, dword [ebp - 0x324]
add eax, 0x208
push eax
push ebx
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push ebx
push dword [ebp - 0x35c]
lea eax, [ebp - 0x334]
push edi
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x314]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
push dword [ebp - 0x314]
test eax, eax
jge 0x18a6c
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push edi
call fcn.000124d0
jmp 0x19110
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push ebx
push eax
mov byte [ebp - 0x305], bl
call sub.ntoskrnl.exe_memset
push 0x3f
pop esi
push esi
lea eax, [ebp - 0x43]
push ebx
push eax
mov byte [ebp - 0x44], bl
call sub.ntoskrnl.exe_memset
xor eax, eax
push edi
mov word [ebp - 0x184], ax
lea eax, [ebp - 0x182]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push esi
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call sub.ntoskrnl.exe_memset
xor eax, eax
push edi
mov word [ebp - 0x284], ax
lea eax, [ebp - 0x282]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push esi
lea eax, [ebp - 0x1c3]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x48
xor eax, eax
push edi
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push esi
lea eax, [ebp - 0x203]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x18
push 2
xor eax, eax
pop edx
movzx ecx, word [eax + 0x2466e]
mov word [ebp + eax - 0x284], cx
add eax, edx
cmp cx, bx
jne 0x18b23
mov esi, 0x24662
lea edi, [ebp - 0x1c4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
movzx ecx, word [eax + 0x2464c]
mov word [ebp + eax - 0x304], cx
add eax, edx
cmp cx, bx
jne 0x18b4b
mov eax, dword [ebp + 8]
mov esi, 0x24640
lea edi, [ebp - 0x204]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
dec eax
movsb byte es:[edi], byte [esi]
cmp eax, 9
ja case.0x18b7e.7
jmp dword [eax*4 + 0x19126]
xor eax, eax
movzx ecx, word [eax + 0x2461e]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18b87
mov esi, 0x2460c
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
movzx ecx, word [eax + 0x245ec]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18bac
mov esi, 0x245dc
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x18e33
xor eax, eax
movzx ecx, word [eax + 0x245c4]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18bd8
mov esi, 0x245b8
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [eax + 0x245a2]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18bfb
mov esi, 0x24596
lea edi, [ebp - 0x84]
jmp 0x18e2e
xor eax, eax
movzx ecx, word [eax + 0x24576]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18c23
mov esi, 0x24566
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [eax + 0x24548]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18c47
mov esi, 0x24538
lea edi, [ebp - 0x84]
jmp 0x18e2d
xor eax, eax
movzx ecx, word [eax + 0x24518]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18c6f
mov esi, 0x24508
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [eax + 0x244ea]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18c93
mov esi, 0x244da
jmp 0x18c62
xor eax, eax
movzx ecx, word [eax + 0x244ca]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18cb2
mov eax, dword [0x244c2]
mov dword [ebp - 0x44], eax
mov eax, dword [0x244c6]
mov dword [ebp - 0x40], eax
xor eax, eax
movzx ecx, word [eax + 0x244b4]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18cda
mov esi, 0x244ac
lea edi, [ebp - 0x84]
jmp 0x18e2f
xor eax, eax
movzx ecx, word [eax + 0x24498]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18d02
mov esi, 0x2448e
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
movzx ecx, word [eax + 0x2447c]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18d26
mov esi, 0x24472
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x18e32
xor eax, eax
movzx ecx, word [eax + 0x24452]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18d50
mov esi, 0x24442
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [eax + 0x24424]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18d74
mov esi, 0x24414
jmp 0x18c62
xor eax, eax
movzx ecx, word [eax + 0x243f0]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18d96
mov esi, 0x243de
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
movzx ecx, word [eax + 0x243bc]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18dbc
mov esi, 0x243aa
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x18d47
xor eax, eax
movzx ecx, word [eax + 0x24382]
mov word [ebp + eax - 0x104], cx
add eax, edx
cmp cx, bx
jne 0x18de6
push 5
pop ecx
mov esi, 0x2436e
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [eax + 0x24348]
mov word [ebp + eax - 0x184], cx
add eax, edx
cmp cx, bx
jne 0x18e0b
mov esi, 0x24334
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x104]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, edx
cmp cx, bx
jne 0x18e3c
sub eax, esi
sar eax, 1
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x184]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x18e59
sub eax, edx
sar eax, 1
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x284]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x18e76
sub eax, edx
sar eax, 1
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x304]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x18e93
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x310]
xor edi, edi
cmp byte [eax + 5], bl
mov eax, dword [ebp - 0x324]
sete byte [ebp - 0x307]
xor ecx, ecx
cmp byte [ebp - 0x307], cl
mov byte [ebp - 0x306], bl
setne cl
xor edx, edx
mov byte [ebp - 0x308], bl
inc ecx
div ecx
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x30c], eax
jle 0x18ef5
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x31c]
sub ecx, eax
cmp edi, ecx
jae 0x19066
mov eax, dword [ebp - 0x310]
mov esi, edi
lea ebx, [edi + eax]
lea edi, [eax + edi*2]
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x30c], eax
jle 0x18f27
mov eax, dword [ebp - 0x30c]
mov ecx, dword [ebp - 0x31c]
sub ecx, eax
cmp esi, ecx
jae 0x18fb7
cmp byte [ebp - 0x307], 0
push dword [ebp - 0x318]
je 0x18f79
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x18f76
push dword [ebp - 0x30c]
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x18fa6
inc esi
jmp 0x18fc4
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe__strnicmp]
add esp, 0xc
test eax, eax
je 0x18f76
push dword [ebp - 0x30c]
lea eax, [ebp - 0x44]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe__strnicmp]
add esp, 0xc
test eax, eax
je 0x18faf
inc esi
inc edi
inc edi
inc ebx
jmp 0x18f13
mov byte [ebp - 0x306], 1
inc esi
cmp byte [ebp - 0x306], 0
je 0x19066
mov eax, dword [ebp - 0x31c]
dec eax
mov byte [ebp - 0x306], 0
mov edi, esi
cmp esi, eax
jae 0x18ffd
mov ecx, dword [ebp - 0x310]
cmp byte [ebp - 0x307], 0
je 0x18fee
cmp word [ecx + edi*2], 0x5b
jmp 0x18ff2
cmp byte [edi + ecx], 0x5b
je 0x19081
inc edi
cmp edi, eax
jb 0x18fde
mov byte [ebp - 0x308], 1
mov edi, eax
cmp esi, edi
mov dword [ebp - 0x320], esi
jge 0x190e2
mov eax, dword [ebp - 0x310]
lea ebx, [esi + eax]
lea esi, [eax + esi*2]
cmp byte [ebp - 0x307], 0
push dword [ebp - 0x32c]
je 0x1908d
lea eax, [ebp - 0x284]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x1905f
push dword [ebp - 0x328]
lea eax, [ebp - 0x304]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x190bd
mov byte [ebp - 0x305], 1
push 0x5246
push dword [ebp - 0x310]
call fcn.000124d0
mov al, byte [ebp - 0x305]
jmp 0x19112
mov byte [ebp - 0x306], 1
jmp 0x19006
lea eax, [ebp - 0x1c4]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe__strnicmp]
add esp, 0xc
test eax, eax
je 0x1905f
push dword [ebp - 0x328]
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe__strnicmp]
add esp, 0xc
test eax, eax
je 0x190d4
inc dword [ebp - 0x320]
inc esi
inc esi
inc ebx
cmp dword [ebp - 0x320], edi
jl 0x19020
jmp 0x190e2
mov byte [ebp - 0x305], 1
mov byte [ebp - 0x308], 1
cmp byte [ebp - 0x308], 0
je 0x18ee1
jmp 0x19066
push 0x5246
push dword [ebp - 0x310]
jmp 0x18a62
push dword [ebp - 0x314]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.000223b6
leave
ret 4