Function at 0x102fdbc
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10619c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov eax, dword [ecx]
push edi
mov edi, dword [ebp + 8]
call dword [eax + 8]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x102fe23
mov eax, dword [section..data]
cmp eax, section..data
je 0x10300e1
test byte [eax + 0x1c], 4
je 0x10300e1
push ebx
push 0x1008b3c
push 0x10043d8
push 0xea
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104e22f
jmp 0x10300e1
cmp dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
jne 0x103008a
cmp dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
jne 0x103008a
cmp dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
je 0x102fedc
add edi, 0x844
push edi
mov ecx, esi
call fcn.01029d37
mov ebx, eax
test ebx, ebx
jge 0x102fe87
mov eax, dword [section..data]
cmp eax, section..data
je 0x10300e1
test byte [eax + 0x1c], 4
je 0x10300e1
push ebx
push 0x1008af8
push 0x10043d8
push 0xec
jmp 0x102fe13
push edi
push 0x104
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.0101b116
mov ebx, eax
test ebx, ebx
jge 0x102fece
mov eax, dword [section..data]
cmp eax, section..data
je 0x10300e1
test byte [eax + 0x1c], 4
je 0x10300e1
push ebx
push 0x10060d0
push 0x10043d8
push 0xed
jmp 0x102fe13
xor edi, edi
inc edi
mov dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
jmp 0x10300de
add edi, 0xc5c
cmp word [edi], ax
je 0x102ff34
push eax
push edi
mov ecx, esi
call fcn.0102bad4
mov ebx, eax
test ebx, ebx
jge 0x102ff25
mov eax, dword [section..data]
cmp eax, section..data
je 0x10300e1
test byte [eax + 0x1c], 4
je 0x10300e1
push ebx
push 0x1008a88
push 0x10043d8
push 0xee
jmp 0x102fe13
and dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
xor edi, edi
inc edi
jmp 0x10300d8
xor edi, edi
push 0x104
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
inc edi
push eax
mov dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
call fcn.01027806
test eax, eax
jne 0x102ff91
mov eax, dword [section..data]
cmp eax, section..data
je 0x102ff79
test byte [eax + 0x1c], 4
je 0x102ff79
push 0x10043d8
push 0xef
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01017c98
push 0
push 0x40a
push 0
call fcn.0105746e
mov ebx, 0x80004005
jmp 0x10300e1
push edi
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
mov ecx, esi
call fcn.0102bad4
mov ebx, eax
test ebx, ebx
jl 0x102ffbf
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
not eax
and eax, edi
mov dword [esi + 0x18], eax
jmp 0x10300e1
and dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x102ffef
test byte [eax + 0x1c], 4
je 0x102ffef
push 0x10043d8
push pe_nt_image_headers32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01017c98
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
call fcn.010501cf
mov ebx, eax
test ebx, ebx
jge 0x1030044
mov eax, dword [section..data]
cmp eax, edi
je 0x103002b
test byte [eax + 0x1c], 4
je 0x103002b
push ebx
push 0x1004830
push 0x10043d8
push 0xf1
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104e22f
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
test eax, eax
je 0x10300e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10300e1
mov ecx, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ebx, eax
test ebx, ebx
jge 0x1030076
mov eax, dword [section..data]
cmp eax, edi
je 0x103002b
test byte [eax + 0x1c], 4
je 0x103002b
push ebx
push 0x1008a54
push 0x10043d8
push 0xf2
jmp 0x1030020
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
call fcn.01029584
jmp 0x103002b
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
mov ecx, esi
call fcn.0102bad4
mov ebx, eax
test ebx, ebx
jge 0x10300c6
mov eax, dword [section..data]
cmp eax, section..data
je 0x10300e1
test byte [eax + 0x1c], 4
je 0x10300e1
push ebx
push 0x1008a88
push 0x10043d8
push 0xeb
jmp 0x102fe13
mov eax, dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
mov edi, dword [edi + reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
mov dword [esi + 0x20], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01041ea8
leave
ret 4