Function at 0x4fbae0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x24c
mov eax, dword [0x984164]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x250]
push ebx
push ebp
mov ebx, ecx
push esi
xor ecx, ecx
push edi
mov edi, edx
xor ebp, ebp
mov word [esp + 0x24], cx
xor edx, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
mov word [esp + 0x26], dx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x14], ebp
mov dword [edi], ebp
call fcn.004fba20
cmp eax, ebp
jl 0x4fbd03
movzx eax, word [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], eax
push ecx
lea eax, [esp + 0x1c]
call fcn.004fb500
add esp, 4
cmp eax, ebp
jl 0x4fbc2d
mov dx, word [esp + 0x24]
sub word [esp + 0x18], dx
push 0x10
push 3
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
lea eax, [esp + 0x24]
push edx
mov dword [esp + 0x4c], eax
push 0x100001
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], ebp
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
call dword [sym.imp.Ntdll.dll_NtOpenFile]
mov esi, eax
cmp esi, ebp
jl 0x4fbc12
push ebp
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
push 1
push 0x25
push 0x200
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x44]
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.Ntdll.dll_NtQueryDirectoryFile]
mov edx, dword [esp + 0x14]
mov esi, eax
cmp esi, ebp
mov dword [edi], edx
mov dword [esp + 0x14], ebp
jl 0x4fbc21
cmp dword [esp + 0x264], ebp
jne 0x4fbc02
movsx esi, byte [esp + 0x94]
mov edi, dword [esp + 0x20]
lea ebx, [esp + 0x96]
call fcn.004fb580
mov ebx, edi
jmp 0x4fbc10
lea edi, [esp + 0xb0]
mov esi, ebx
call fcn.004fb540
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4fbc21
push eax
call dword [sym.imp.Ntdll.dll_NtClose]
cmp esi, ebp
mov dword [esp + 0x14], ebp
jge 0x4fbce7
mov cx, word [esp + 0x4c]
push ebp
push 7
lea eax, [esp + 0x20]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x48], eax
lea eax, [esp + 0x40]
push eax
mov word [esp + 0x28], cx
push 0x80
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], ebp
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
call dword [sym.imp.Ntdll.dll_NtOpenFile]
mov esi, eax
cmp esi, ebp
jl 0x4fbce7
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x50]
lea eax, [esp + 0x2c]
cmp dword [esp + 0x264], ebp
jne 0x4fbcbc
push 0x15
push 0x200
push edx
push eax
push ecx
call dword [sym.imp.Ntdll.dll_NtQueryInformationFile]
mov esi, eax
cmp esi, ebp
jl 0x4fbcdc
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x20]
lea ebx, [esp + 0x54]
call fcn.004fb580
jmp 0x4fbcda
push 6
push 8
push edx
push eax
push ecx
call dword [sym.imp.Ntdll.dll_NtQueryInformationFile]
mov esi, eax
cmp esi, ebp
jl 0x4fbcdc
lea edi, [esp + 0x50]
mov esi, ebx
call fcn.004fb540
mov esi, eax
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.Ntdll.dll_NtClose]
mov eax, dword [esp + 0x1c]
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
push eax
mov eax, dword [edx + 0x18]
push ebp
push eax
call dword [sym.imp.Ntdll.dll_RtlFreeHeap]
mov eax, esi
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005078c8
add esp, 0x24c
ret