Function at 0x40b6dc
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
test esi, esi
je 0x40b948
cmp dword [0x4226f0], ebx
je 0x40b948
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.0040b9e0
test eax, eax
jne 0x40b724
push 0x402af0
push 4
call fcn.0040d3c6
pop ecx
pop ecx
jmp 0x40b91d
push ebx
push 0x2000000
push 3
push ebx
push 7
push 0x100080
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xffffffff
jne 0x40b760
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x402b68
push 4
call fcn.0040d3c6
add esp, 0xc
jmp 0x40b91b
mov eax, 0x400
push eax
push 8
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x40b914
push 0x2f
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push edi
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x40b7ae
push eax
push 0x402be8
push 4
call fcn.0040d3c6
add esp, 0xc
xor edx, edx
jmp 0x40b905
xor eax, eax
push esi
cmp dword [edi], eax
jbe 0x40b7bc
push 0x402c78
jmp 0x40b7c1
push 0x402cc0
push 4
pop esi
push esi
call fcn.0040d3c6
xor edx, edx
add esp, 0xc
mov dword [ebp - 8], edx
mov ebx, edx
mov dword [ebp - 0xc], edx
cmp dword [edi], edx
jbe 0x40b902
lea ecx, [edi + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x1000
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
call dword [sym.imp.ntdll.dll_NtOpenProcess]
test eax, eax
jns 0x40b829
push eax
push 0x402d00
jmp 0x40b8b3
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x1b
push dword [ebp - 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x40b85c
cmp eax, 0xc0000023
je 0x40b85c
cmp eax, 0xc0000004
je 0x40b85c
push eax
push 0x402d80
jmp 0x40b8b3
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40b87e
push dword [ebp - 4]
push 0x402e40
jmp 0x40b8b3
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 0x1b
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x40b89d
push eax
push 0x402ea8
jmp 0x40b8b3
xor eax, eax
cmp word [ebx], ax
jbe 0x40b8a9
push dword [ebx + 4]
jmp 0x40b8ae
push 0x402f60
push 0x402f3c
push esi
call fcn.0040d3c6
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x40b8d2
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40b8d4
xor edx, edx
test ebx, ebx
je 0x40b8eb
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
mov ebx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
inc eax
add ecx, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
cmp eax, dword [edi]
jb 0x40b7e5
mov ebx, dword [ebp - 0x14]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x40b948
cmp dword [esi], 1
mov eax, ebx
jne 0x40b92e
mov eax, dword [esi + 0xc]
test al, 2
jne 0x40b939
push ebx
push ebx
call fcn.0040b9e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret