Function at 0x4289c0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
xor edx, edx
mov dword [ebp - 0x6c4], eax
push edi
push 5
mov dword [eax], edx
mov edi, ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x18
push eax
lea eax, [ebp - 0x698]
mov dword [ebp - 0x690], ebx
push eax
push ebx
mov dword [ebp - 0x6c8], ecx
mov dword [ebp - 0x68c], 1
mov dword [ebp - 0x6c0], edx
mov dword [ebp - 0x6bc], edx
mov dword [ebp - 0x6b8], edx
mov dword [ebp - 0x6b4], edx
mov dword [ebp - 0x6b0], edx
mov dword [ebp - 0x6ac], edx
mov dword [ebp - 0x6a8], edx
mov dword [ebp - 0x6a4], edx
mov dword [ebp - 0x6a0], edx
mov dword [ebp - 0x69c], edx
mov dword [ecx], edx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x428d4a
mov eax, dword [edi + 8]
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0x680], 0
cmp eax, 0xffffffff
je 0x428a9a
test eax, eax
mov ecx, 0x2000000
cmovne ecx, eax
cmp dword [ebp - 0x18], 0
jg 0x428d4a
jl 0x428a9a
cmp dword [ebp - 0x1c], ecx
ja 0x428d4a
lea eax, [ebp - 0x694]
mov edx, esi
push eax
lea eax, [ebp - 0x684]
mov ecx, ebx
push eax
lea eax, [ebp - 0x678]
push eax
call fcn.00428850
test al, al
je 0x428d15
mov esi, dword [ebp - 0x684]
mov edx, esi
mov ebx, dword [ebp - 0x678]
push ecx
mov ecx, ebx
call fcn.004141e0
push 0
push 0
push esi
mov esi, dword [0x458b88]
mov ecx, esi
push ebx
mov ebx, dword [ebp - 0x694]
push ebx
mov dword [ebp - 0x688], eax
call dword [0x4484cc]
call esi
mov esi, eax
mov dword [ebp - 0x694], esi
test esi, esi
je 0x428c24
push 0x20c
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.0042e280
add esp, 0xc
lea eax, [ebp - 0x674]
push 0x440
push 0
push eax
call fcn.0042e280
add esp, 0xc
lea eax, [ebp - 0x234]
push 0
push eax
push esi
mov esi, dword [0x458b78]
mov ecx, esi
call dword [0x4484cc]
call esi
test eax, eax
je 0x428c06
lea eax, [ebp - 0x230]
mov dword [ebp - 0x6c0], 0x28
mov dword [ebp - 0x6b8], eax
mov edx, 2
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x674], 0x440
mov eax, dword [eax + 4]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x6a4], eax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x69c], ebx
push eax
lea eax, [ebp - 0x674]
push eax
push 0x457af4
lea eax, [ebp - 0x6c0]
push eax
call fcn.004285f0
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x428c06
mov esi, dword [0x458b90]
mov ecx, esi
push eax
call dword [0x4484cc]
call esi
mov esi, dword [0x458b6c]
mov ecx, esi
push 0
push dword [ebp - 0x694]
push ebx
call dword [0x4484cc]
call esi
jmp 0x428cd5
xor esi, esi
cmp dword [edi + 0xc], esi
jbe 0x428cd5
nop
mov edx, dword [ebp - 0x680]
mov ecx, dword [ebp - 0x67c]
call fcn.00428fa0
mov eax, dword [edi + 0x10]
mov edx, 2
mov dword [ebp - 0x6c0], 0x28
mov ecx, edi
mov eax, dword [eax + esi*4]
mov dword [ebp - 0x6b8], eax
mov eax, dword [edi]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x688]
mov eax, dword [eax + 4]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x6a4], eax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x69c], ebx
push eax
push 0
push 0x457b04
lea eax, [ebp - 0x6c0]
push eax
call fcn.004285f0
mov dword [ebp - 0x68c], eax
cmp eax, 2
je 0x428cd5
inc esi
cmp esi, dword [edi + 0xc]
jb 0x428c30
mov ecx, dword [ebp - 0x688]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x428cee
call fcn.00412410
push dword [ebp - 0x678]
push 0
push dword [0x458d0c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [0x458b70]
mov ecx, esi
push 0
push ebx
call dword [0x4484cc]
call esi
mov ecx, dword [ebp - 0x6c4]
mov eax, dword [ebp - 0x67c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x6c8]
mov eax, dword [ebp - 0x680]
mov dword [ecx], eax
mov eax, dword [ebp - 0x68c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d1c6
mov esp, ebp
pop ebp
ret 0xc