Function at 0x1009f48
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
cmp ebx, esi
je 0x100a1a4
push edi
call fcn.0100a36a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x100a174
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.01009db0
test eax, eax
jne 0x1009f98
push 0x1002838
push 4
call fcn.0100a40e
pop ecx
pop ecx
jmp 0x100a174
push esi
push 0x2000000
push 3
push esi
push 7
push 0x100080
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x1009fd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10027b8
push 4
call fcn.0100a40e
add esp, 0xc
jmp 0x100a174
mov eax, 0x400
push eax
push 8
mov dword [ebp + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100a16b
push 0x2f
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, esi
jge 0x100a01d
push eax
push 0x1002728
push 4
call fcn.0100a40e
add esp, 0xc
jmp 0x100a15e
mov eax, dword [ebp - 8]
push ebx
cmp dword [eax], esi
jbe 0x100a02c
push 0x10026e0
jmp 0x100a031
push 0x10026a0
push 4
call fcn.0100a40e
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], esi
xor ebx, ebx
mov dword [ebp - 0x10], esi
cmp dword [eax], esi
jbe 0x100a15e
add eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x1000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, esi
jge 0x100a09b
push eax
push 0x1002620
jmp 0x100a11d
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1b
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0x80000005
je 0x100a0cc
cmp eax, 0xc0000023
je 0x100a0cc
cmp eax, 0xc0000004
je 0x100a0cc
push eax
push 0x1002560
jmp 0x100a11d
push dword [ebp + 8]
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x100a0ea
push dword [ebp + 8]
push 0x10024f8
jmp 0x100a11d
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push 0x1b
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, esi
jge 0x100a109
push eax
push 0x1002460
jmp 0x100a11d
cmp word [ebx], si
jbe 0x100a113
push dword [ebx + 4]
jmp 0x100a118
push 0x1002450
push 0x100242c
push 4
call fcn.0100a40e
add esp, 0xc
cmp dword [ebp - 4], esi
je 0x100a138
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x100a149
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add dword [ebp - 0xc], 4
cmp ecx, dword [eax]
jb 0x100a054
push dword [ebp - 8]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x100a1a3
xor ecx, ecx
cmp dword [eax], 1
jne 0x100a185
mov ecx, dword [eax + 0xc]
test cl, 2
jne 0x100a194
push esi
push esi
call fcn.01009db0
mov eax, dword [ebp - 0x14]
cmp eax, esi
je 0x100a1a3
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 4