Function at 0x56c5a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a0fd5
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x606040]
xor eax, esp
mov dword [esp + 0x4c8], eax
push ebx
push esi
push edi
mov eax, dword [0x606040]
xor eax, esp
push eax
lea eax, [esp + 0x4e0]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 8
jb 0x56c5ef
mov eax, dword [ebx]
jmp 0x56c5f1
mov eax, ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.00402cd0
mov dword [esp + 0x4e8], 0
push dword [esp + 0x18]
mov byte [esp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 2
je 0x56c63f
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c625
mov edi, eax
mov edx, 0x103700
mov ecx, edi
push 0
call fcn.00574b30
mov bl, byte [esp + 0x1b]
add esp, 4
jmp 0x56c8d2
push 0
push 0x80
push 4
push 0
push 0
push SysReAllocString
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x56c686
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c66c
mov edi, eax
mov edx, 0x103701
mov ecx, edi
push 0
call fcn.00574b30
mov bl, byte [esp + 0x1b]
add esp, 4
jmp 0x56c8d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [esp + 0x20]
call fcn.00402cd0
mov byte [esp + 0x4e8], 1
push str..pdf
push dword [esp + 0x20]
call fcn.00535e6f
add esp, 8
test eax, eax
je 0x56c72c
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004039f0
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.00590390
movzx eax, ax
add esp, 4
test ax, ax
jns 0x56c708
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c6f2
mov edi, eax
mov edx, 0x103702
mov ecx, edi
push 0
call fcn.00574b30
add esp, 4
jmp 0x56c8a8
jne 0x56c72c
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c716
mov edi, eax
mov edx, 0x103500
mov ecx, edi
push 0
call fcn.00574b30
add esp, 4
jmp 0x56c8a8
push 0x2c
call fcn.0040a3f9
add esp, 4
test eax, eax
je 0x56c8a8
mov ecx, eax
call fcn.0057f2c0
mov esi, eax
test esi, esi
je 0x56c8a8
mov eax, dword [0x615800]
test eax, eax
je 0x56c76e
push str.CreateCNPEIF
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x56c76e
lea ecx, [esi + 0x28]
push ecx
call eax
push ebx
mov ecx, esi
call fcn.0057f040
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0057f190
mov ecx, esi
call fcn.0057f240
push esi
call fcn.0040a426
mov esi, dword [esp + 0x24]
add esp, 4
cmp esi, 0x26
ja case.0x56c7a1.1
movzx eax, byte [esi + 0x56c93c]
jmp dword [eax*4 + 0x56c924]
mov byte [esp + 0x17], 1
jmp 0x56c8a8
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c7be
mov edi, eax
push 0
mov edx, 0x103501
mov ecx, edi
call fcn.00574b30
add esp, 4
jmp 0x56c8a8
mov dword [ebx + 0x20], 2
jmp 0x56c82f
mov dword [ebx + 0x20], 1
jmp 0x56c82f
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c7f2
mov edi, eax
push 0
mov edx, 0x103600
mov ecx, edi
call fcn.00574b30
add esp, 4
jmp 0x56c8a8
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x56c814
mov edi, eax
push 0
mov edx, 0x104d04
mov ecx, edi
call fcn.00574b30
add esp, 4
cmp esi, 0xc
je 0x56c82f
cmp esi, 0xd
jne 0x56c8a8
push ecx
lea eax, [esp + 0x1b]
push eax
push ebx
lea ecx, [esp + 0x288]
call fcn.00575b30
lea ecx, [esp + 0x27c]
mov byte [esp + 0x4e8], 2
call fcn.00575900
cmp eax, 3
jne 0x56c894
push ecx
lea eax, [esp + 0x1b]
mov dword [ebx + 0x20], 1
push eax
push ebx
lea ecx, [esp + 0x30]
call fcn.00575b30
lea ecx, [esp + 0x24]
mov byte [esp + 0x4e8], 3
call fcn.00575900
lea ecx, [esp + 0x24]
mov byte [esp + 0x4e8], 2
call fcn.00575a50
lea ecx, [esp + 0x27c]
mov byte [esp + 0x4e8], 1
call fcn.00575a50
mov bl, byte [esp + 0x17]
or ecx, 0xffffffff
mov byte [esp + 0x4e8], 0
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56c8d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x4e8], 0xffffffff
or ecx, 0xffffffff
mov esi, dword [esp + 0x18]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x56c8fb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [esp + 0x4e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c8]
xor ecx, esp
call fcn.00535334
mov esp, ebp
pop ebp
ret 4