Function at 0x7dde50ce
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov dl, byte [ebp + 0x1c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov byte [ebp - 0xc], dl
push edi
mov edi, dword [ebp + 0x20]
mov esi, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], edx
je 0x7dde511b
cmp esi, edx
je 0x7dde5111
push dword [ebp + 8]
call fcn.7dde3ce9
push edi
call fcn.7dde4613
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
mov dword [eax], edx
cmp esi, 0xffffffff
je 0x7dde5111
cmp ecx, edx
je 0x7dde5111
cmp esi, edx
je 0x7dde51b8
mov eax, dword [esi + 0x428]
cmp dword [eax*4 + 0x7ddb2fac], edx
je 0x7dde5103
mov dword [edi], esi
cmp byte [esi + 0x45d], 0
je 0x7dde516e
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x420], eax
mov dword [esi + 0x424], eax
mov dword [esi + 0x444], eax
mov dword [esi + 0x440], eax
mov byte [esi + 0x45e], al
mov eax, dword [esi + 0x428]
mov ecx, dword [eax*4 + 0x7ddb2fac]
xor ebx, ebx
inc ebx
dec ecx
je 0x7dde525a
dec ecx
je 0x7dde524b
dec ecx
je 0x7dde523c
dec ecx
je 0x7dde522d
sub ecx, 3
je 0x7dde521e
dec ecx
je 0x7dde520f
dec ecx
dec ecx
je 0x7dde5200
inc eax
mov dword [esi + 0x428], eax
mov byte [esi + 0x45d], bl
jmp 0x7dde5269
push 0x400
call fcn.7dde4670
mov esi, eax
test esi, esi
je 0x7dde531c
push 4
push 0x28
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7dde51f3
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x460], eax
jmp 0x7dde513d
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dde5114
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4d59
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4e7e
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4c9f
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4929
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4fbc
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4bb1
jmp 0x7dde5267
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde485a
mov ebx, eax
mov edx, dword [esi + 0x424]
mov eax, dword [esi + 0x42c]
mov edi, dword [esi + 0x420]
xor ecx, ecx
cmp edx, ecx
jg 0x7dde52bf
jl 0x7dde5287
cmp edi, eax
jae 0x7dde52bf
sub eax, edi
sbb ecx, edx
xor edx, edx
cmp ecx, edx
jg 0x7dde529c
jl 0x7dde5298
cmp eax, dword [ebp - 0x10]
jae 0x7dde529c
mov edi, eax
jmp 0x7dde529f
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 0x420]
push edi
add eax, esi
push eax
push dword [ebp - 0x18]
call sub.ntdll.dll_memcpy
add esp, 0xc
push edi
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.7dde3ddc
mov edx, dword [esi + 0x424]
mov eax, dword [esi + 0x42c]
xor ecx, ecx
xor edi, edi
cmp edx, ecx
jl 0x7dde52e9
jg 0x7dde52df
mov ecx, dword [esi + 0x420]
cmp ecx, eax
jb 0x7dde52e9
push esi
call fcn.7dde3f79
test eax, eax
je 0x7dde5323
cmp ebx, edi
je 0x7dde531c
mov eax, dword [esi + 0x428]
cmp dword [eax*4 + 0x7ddb2fac], edi
je 0x7dde5305
cmp dword [ebp - 0x10], edi
jne 0x7dde513f
mov eax, dword [ebp - 0x14]
cmp dword [eax], edi
jne 0x7dde531c
push dword [ebp + 8]
call fcn.7dde3ce9
push dword [ebp + 0x20]
call fcn.7dde4613
mov eax, ebx
jmp 0x7dde5114
xor ebx, ebx
jmp 0x7dde531c