Function at 0x7dd90e49
Capabilities:
Get file attributes

Disassembly:
cmp ecx, edi
je 0x7dd90eba
jmp 0x7dd90ec2
cmp dword [ebp - 0x50], edi
je 0x7dd90ecb
jmp 0x7dd90ed4
push 0x4c
push 0x7dd90ef8
call fcn.7dd725e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
or dword [ebp - 0x3c], 0xffffffff
xor edi, edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x38], edi
cmp dword [ebp + 0x1c], 0xffffffff
je 0x7dd9fbfe
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x18]
mov ecx, eax
mov esi, 0x4000
and ecx, esi
mov edx, 0x800
and eax, edx
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x38], edi
jne 0x7dd9fc0a
mov eax, dword [ebp + 0x1c]
and eax, esi
mov dword [ebp - 0x44], eax
mov esi, dword [ebp + 0x1c]
and esi, edx
mov dword [ebp - 0x40], esi
cmp ecx, edi
jne 0x7dd9fc27
cmp eax, edi
jne 0x7dd9fce3
cmp dword [ebp - 0x50], edi
jne 0x7dd9fd36
cmp dword [ebp - 0x40], edi
jne 0x7dd9fdab
mov dword [ebp - 0x58], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.7dd90e1e
mov eax, dword [ebp - 0x58]
call fcn.7dd72630
ret 0x1c
mov dword [ebp - 0x38], 1
jmp 0x7dd90e80
xor eax, eax
cmp ecx, edi
sete al
mov dword [ebp - 0x44], eax
xor eax, eax
cmp dword [ebp - 0x50], edi
sete al
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
jmp 0x7dd90eb2
cmp eax, edi
jne 0x7dd90e29
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebx], 0xffffffff
push 0x7dd905cc
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x3c], eax
cmp eax, edi
je 0x7dd9fc68
push 0x7ddb33cc
push eax
call fcn.7dd7122f
cmp eax, edi
je 0x7dd9fc68
push dword [ebp - 0x5c]
call eax
test eax, eax
je 0x7dd9fc68
mov dword [ebp - 0x40], edi
jmp 0x7dd9fc72
test byte [ebp + 0x20], 1
je 0x7dd90edb
push 0x60
push edi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x34]
push 0xc0150000
push ebx
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
call esi
mov edi, 0xc0000022
cmp eax, edi
mov dword [ebp - 0x30], eax
jne 0x7dd9fcd2
test byte [ebp + 0x20], 1
je 0x7dd9fcb2
push 0x60
push 0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x34]
push 0x80150000
push ebx
call esi
mov dword [ebp - 0x30], eax
cmp eax, edi
jne 0x7dd9fcd2
test byte [ebp + 0x20], 1
je 0x7dd9fcd2
push 0x60
push 0
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x34]
push 0x80110000
push ebx
call esi
mov dword [ebp - 0x30], eax
test eax, eax
jge 0x7dd9fd2c
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor edi, edi
jmp 0x7dd90edb
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtClose]
or dword [ebx], 0xffffffff
push 0x7dd905cc
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x3c], eax
cmp eax, edi
je 0x7dd9fc68
push 0x7ddb33bc
push eax
call fcn.7dd7122f
cmp eax, edi
je 0x7dd9fc68
push edi
push dword [ebp - 0x5c]
call eax
test eax, eax
je 0x7dd9fc68
mov dword [ebp - 0x44], edi
jmp 0x7dd9fc72
xor edi, edi
mov eax, dword [ebp - 0x44]
jmp 0x7dd90ec2
cmp dword [ebp - 0x40], edi
jne 0x7dd90e36
push 0x1c
push 0x10
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x30], eax
cmp eax, edi
jge 0x7dd9fd79
cmp dword [ebp - 0x38], edi
jne 0x7dd90ed4
test byte [ebp + 0x20], 1
jne 0x7dd90ed4
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7dd90edb
lea eax, [ebp - 0x24]
push edi
push edi
push 2
push eax
push 0x9c040
lea eax, [ebp - 0x4c]
push eax
push edi
push edi
push edi
push dword [ebx]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x38], edi
jne 0x7dd90ed4
cmp eax, edi
jge 0x7dd90ed4
jmp 0x7dd9fd64
cmp eax, edi
jne 0x7dd90ed4
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x54]
jmp 0x7dd9fd7c