Function at 0x41b25b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc88
mov eax, dword [ebp + 8]
jmp 0x41b275
mov eax, dword [eax + 4]
test eax, eax
je 0x41b2be
mov edi, dword [edx + 4]
mov ebx, ecx
mov dword [esp + 0xc], eax
lea eax, [edx + 4]
mov esi, edx
mov ecx, edx
mov dword [esp + 4], eax
jmp 0x41b293
mov edx, ebx
push 0
call fcn.0041b212
pop ecx
test ax, ax
je 0x41b2c7
jmp 0x41b2a4
jmp 0x41b2a9
mov ecx, dword [esp + 4]
mov edx, eax
mov dword [ecx], edi
jmp 0x41b2b9
jmp 0x41b3a7
mov dx, 8
jmp 0x41b3ba
mov dword [esp + 0x18], ebx
mov dword [esp + 8], edi
jmp 0x41b2d9
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea ebx, [esp + 0xa70]
jmp 0x41b2ed
mov ecx, ebx
dec eax
push eax
call fcn.0041bf8f
pop eax
movzx edx, word [ebx + 0x210]
test dx, dx
je 0x41b321
jmp 0x41b305
jmp 0x41b30f
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41b31c
jmp 0x41b3a7
mov dword [esp + 0x14], esi
jmp 0x41b329
lea eax, [esp + 0x60]
push 0x210
push ebx
push eax
call fcn.004052fe
add esp, 0xc
jmp 0x41b340
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0x40]
lea edx, [esp + 0x3c]
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [edx], eax
lea eax, [esp + 0x64]
jmp 0x41b365
push 1
push 0x406259
push eax
call fcn.0041c387
add esp, 0xc
cmp word [esi + 4], 0
je 0x41b3cb
jmp 0x41b386
jmp 0x41b38f
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, 8
mov dword [eax], ecx
jmp 0x41b3a7
mov ebx, dword [ebp + 8]
jmp 0x41b3b3
mov eax, dword [esp + 0xc]
mov dword [ebx + 4], eax
jmp 0x41b3c1
mov eax, edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x41b3d3
mov edi, dword [esp + 0x40]
jmp 0x41b3dd
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov ebx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x41b3ee
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, esi
push 0x2a
call fcn.0041b212
pop ecx
test ax, ax
je 0x41b431
jmp 0x41b40b
push edi
mov esi, eax
call sub.ntdll.dll_NtClose
jmp 0x41b417
jmp 0x41b41c
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, esi
mov dword [eax], ecx
jmp 0x41b42c
jmp 0x41b3aa
jmp 0x41b437
mov ecx, ebx
mov edx, esi
push 0
call fcn.0041b212
pop ecx
test ax, ax
je 0x41b478
jmp 0x41b44c
push edi
mov esi, eax
call sub.ntdll.dll_NtClose
jmp 0x41b459
jmp 0x41b45e
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, esi
mov dword [eax], ecx
jmp 0x41b473
jmp 0x41b3aa
jmp 0x41b47c
mov eax, dword [ebx]
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 4]
and dword [esp + 0x30], 0
lea eax, [eax + eax - 2]
cmp eax, 0xffff
mov dword [esp + 0x24], eax
jbe 0x41b4c3
jmp 0x41b49e
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b4a9
jmp 0x41b4ac
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, 0xb
mov dword [eax], ecx
jmp 0x41b4be
jmp 0x41b3aa
mov ebx, 0x800
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0
jmp 0x41b4e2
mov eax, dword [esp + 0x24]
mov word [esp + 0x34], ax
mov word [esp + 0x36], ax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
jmp 0x41b4fc
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 1
push 0x800
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0x60]
push eax
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x41b5dc
jmp 0x41b536
jmp 0x41b53c
mov edx, dword [esp + 0xc]
xor esi, esi
jmp 0x41b547
jmp 0x41b549
mov eax, esi
cmp eax, 0x7ff
jmp 0x41b552
ja 0x41b4d8
jmp 0x41b558
mov ecx, dword [esp + eax + 0x270]
lea esi, [ecx + eax]
test ecx, ecx
cmove esi, ebx
test byte [esp + eax + 0x2a8], 0x10
jne 0x41b5ab
lea ecx, [esp + eax + 0x270]
jmp 0x41b57b
mov eax, dword [ecx + 0x3c]
shr eax, 1
sub eax, edx
je 0x41b5b5
jmp 0x41b586
mov edx, dword [esp + 0xc]
jmp 0x41b58f
lea edx, [ecx + edx*2 + 0x40]
lea ecx, [esp + 0x1c]
push eax
call fcn.0041c4d4
mov edx, dword [esp + 0x10]
add esp, 4
cmp byte [esp + 0x1d], 0
jne 0x41b5bd
jmp 0x41b5b1
mov eax, esi
jmp 0x41b54b
mov al, 1
mov dword [esp + 0x10], eax
jmp 0x41b547
jmp 0x41b5c7
movzx eax, byte [esp + 0x1c]
mov byte [esp + eax + 0x30], 1
mov al, 1
mov dword [esp + 0x2c], eax
jmp 0x41b542
cmp eax, 0x80000006
je 0x41b632
mov ebx, dword [ebp + 8]
cmp eax, 0xc000000f
je 0x41b6ca
mov ecx, edi
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
cmp eax, 0xc0000022
jne 0x41b702
jmp 0x41b60b
push ecx
call sub.ntdll.dll_NtClose
jmp 0x41b61a
jmp 0x41b624
mov dword [esi], edi
jmp 0x41b629
mov dx, 9
jmp 0x41b3aa
jmp 0x41b638
test byte [esp + 0x10], 1
mov ebx, dword [ebp + 8]
mov si, 8
je 0x41b84a
jmp 0x41b64d
cmp dword [esp + 8], 0
je 0x41b728
jmp 0x41b660
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
movzx eax, word [eax + ecx*2 - 2]
cmp eax, 0x2f
je 0x41b728
cmp eax, 0x5c
je 0x41b728
jmp 0x41b68a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0x5c
call fcn.0041b212
pop ecx
test ax, ax
je 0x41b728
mov esi, eax
jmp 0x41b6a7
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b6b1
jmp 0x41b6b6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, esi
mov dword [eax], ecx
jmp 0x41b6c5
jmp 0x41b3aa
jmp 0x41b6ce
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b6dc
jmp 0x41b6e6
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, 8
mov dword [eax], ecx
jmp 0x41b6fd
jmp 0x41b3aa
jmp 0x41b70b
push ecx
call sub.ntdll.dll_NtClose
jmp 0x41b713
jmp 0x41b719
mov dword [esi], edi
jmp 0x41b71f
mov dx, 0xe
jmp 0x41b3aa
jmp 0x41b72d
mov eax, dword [ebx]
jmp 0x41b735
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, esi
push dword [esp + 0xc]
push eax
call fcn.0041b18a
pop ecx
pop edx
test ax, ax
mov dword [esp + 0x10], eax
je 0x41b780
jmp 0x41b75c
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b766
jmp 0x41b76c
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov ebx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x41b77b
jmp 0x41ba56
jmp 0x41b788
mov ecx, ebx
mov edx, esi
push 0
call fcn.0041b212
pop ecx
test ax, ax
je 0x41b7cb
mov esi, eax
jmp 0x41b7a1
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b7ac
jmp 0x41b7b3
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41b7c1
mov ebx, dword [ebp + 8]
mov edx, esi
jmp 0x41b3aa
jmp 0x41b7d1
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x14]
jmp 0x41b7e0
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0041c668
add esp, 0x10
mov esi, eax
movzx eax, ax
lea ecx, [eax - 8]
cmp ecx, 2
jb 0x41b847
cmp eax, 0x6d
je 0x41bb24
test eax, eax
jne 0x41bbaa
jmp 0x41b81c
push edi
call sub.ntdll.dll_NtClose
jmp 0x41b82b
jmp 0x41b833
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
xor edx, edx
mov dword [eax], ecx
jmp 0x41b842
jmp 0x41b3a7
mov ebx, dword [ebp + 8]
jmp 0x41b854
test byte [esp + 0x2c], 1
mov edx, dword [esp + 8]
je 0x41ba02
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
lea ecx, [esp + 0x50]
mov dword [esp + 0x10], esi
jmp 0x41b876
mov dword [ecx], eax
mov dword [ecx + 4], edx
and dword [ecx + 8], 0
mov word [ecx + 0xc], 0x3b
lea ecx, [esp + 0x50]
jmp 0x41b88f
call fcn.0041beb8
test eax, eax
je 0x41ba30
mov esi, edx
jmp 0x41b8a1
jmp 0x41b8a6
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], eax
mov edx, eax
mov dword [esp + 0x24], esi
push esi
call fcn.0041c4d4
pop eax
cmp byte [esp + 0x21], 0
je 0x41b9f7
jmp 0x41b8cb
movzx eax, byte [esp + 0x20]
cmp byte [esp + eax + 0x30], 1
jne 0x41b9f7
mov esi, dword [esp + 8]
jmp 0x41b8e4
jmp 0x41b8ed
mov eax, dword [esp + 4]
test esi, esi
mov dword [eax], esi
je 0x41b932
jmp 0x41b8fc
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
movzx eax, word [eax + esi*2 - 2]
cmp eax, 0x2f
je 0x41b932
cmp eax, 0x5c
je 0x41b932
jmp 0x41b919
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push 0x5c
call fcn.0041b212
pop ecx
test ax, ax
jne 0x41bc29
jmp 0x41b936
mov eax, dword [ebx]
jmp 0x41b93c
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, esi
push dword [esp + 0xc]
push eax
call fcn.0041b18a
pop ecx
pop edx
test ax, ax
jne 0x41ba5f
jmp 0x41b962
mov ecx, ebx
mov edx, esi
push dword [esp + 0x24]
push dword [esp + 0x2c]
call fcn.0041b18a
pop ecx
pop edx
test ax, ax
jne 0x41ba8c
jmp 0x41b983
mov ecx, ebx
mov edx, esi
push 0
call fcn.0041b212
pop ecx
test ax, ax
jne 0x41bab3
jmp 0x41b99f
mov ecx, dword [ebx]
mov edx, dword [ebp + 0x14]
jmp 0x41b9aa
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0041c668
add esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, eax
movzx eax, ax
lea ecx, [eax - 8]
cmp ecx, 2
jb 0x41b9f7
cmp eax, 0x6d
jne 0x41bae5
jmp 0x41b9d9
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 4
push 0x4062ce
call fcn.0041c726
pop ecx
pop edx
test al, 1
jne 0x41bbf5
jmp 0x41b9fd
jmp 0x41b885
jmp 0x41ba07
push edi
mov edi, edx
call sub.ntdll.dll_NtClose
jmp 0x41ba13
jmp 0x41ba1d
mov eax, dword [esp + 4]
mov edx, esi
mov dword [eax], edi
jmp 0x41ba2b
jmp 0x41b3aa
jmp 0x41ba34
push edi
call sub.ntdll.dll_NtClose
jmp 0x41ba40
jmp 0x41ba47
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41ba56
mov edx, dword [esp + 0x10]
jmp 0x41b3aa
jmp 0x41ba64
push edi
mov esi, eax
call sub.ntdll.dll_NtClose
jmp 0x41ba6e
jmp 0x41ba78
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41ba8a
jmp 0x41bade
jmp 0x41ba8f
push edi
mov esi, eax
call sub.ntdll.dll_NtClose
jmp 0x41ba99
jmp 0x41ba9f
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41bab1
jmp 0x41bade
mov esi, eax
jmp 0x41babb
push edi
call sub.ntdll.dll_NtClose
jmp 0x41baca
jmp 0x41bace
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41bade
mov edx, esi
jmp 0x41b3a7
test eax, eax
jne 0x41bbd0
jmp 0x41baf4
push edi
call sub.ntdll.dll_NtClose
jmp 0x41bb04
jmp 0x41bb09
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
xor edx, edx
mov dword [eax], ecx
jmp 0x41bb1f
jmp 0x41b3aa
jmp 0x41bb2a
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
add eax, eax
add eax, dword [ecx]
jmp 0x41bb3a
cmp dword [esp + 0xc], edx
je 0x41bc60
jmp 0x41bb4e
inc edx
cmp word [eax - 2], 0x2e
lea ecx, [eax - 2]
mov eax, ecx
jne 0x41bb37
jmp 0x41bb5f
jmp 0x41bb61
push 4
push 0x4062ce
call fcn.0041c726
pop ecx
pop edx
mov ebx, dword [ebp + 8]
test al, 1
mov si, 0x6d
je 0x41b84a
jmp 0x41bb83
push edi
call sub.ntdll.dll_NtClose
jmp 0x41bb8b
jmp 0x41bb94
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, 0x76
mov dword [eax], ecx
jmp 0x41bba5
jmp 0x41b3aa
jmp 0x41bbac
push edi
call sub.ntdll.dll_NtClose
jmp 0x41bbb5
jmp 0x41bbbe
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
jmp 0x41bbcb
jmp 0x41b7c1
jmp 0x41bbd2
push edi
call sub.ntdll.dll_NtClose
jmp 0x41bbdf
jmp 0x41bbe2
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, esi
mov dword [eax], ecx
jmp 0x41bbf0
jmp 0x41b3aa
jmp 0x41bbfc
push edi
call sub.ntdll.dll_NtClose
jmp 0x41bc09
jmp 0x41bc11
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dx, 0x76
mov dword [eax], ecx
jmp 0x41bc24
jmp 0x41b3aa
jmp 0x41bc33
push edi
mov edi, eax
call sub.ntdll.dll_NtClose
jmp 0x41bc44
jmp 0x41bc4b
mov eax, dword [esp + 4]
mov edx, edi
mov dword [eax], esi
jmp 0x41bc5b
jmp 0x41b3aa
mov ebx, dword [ebp + 8]
mov si, 0x6d
jmp 0x41b84a