Function at 0x1018ceb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x500
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [ebp - 0x424], eax
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x420], ecx
test edi, edi
je 0x1018cfe3
test byte [esi + 0x218], 2
je 0x1018cfa2
cmp edi, 1
jne 0x1018cf7a
mov esi, dword [ebx + 0xf8]
push ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], ecx
mov ecx, esp
push 0x10202940
mov dword [ebp - 0x46c], VariantCopy
mov dword [ebp - 0x468], str.SHCmdFile
mov dword [ebp - 0x464], 0x10202940
mov dword [ebp - 0x460], 0x10202940
mov dword [ebp - 0x45c], edi
call fcn.10002490
push esi
lea eax, [ebp - 0x46c]
mov ecx, 0x1025ac18
push eax
push str.SHCmdFile
push str.FILETYPE
call fcn.101ad040
mov esi, dword [ebp - 0x434]
push 0x102104d0
push 0
push 0
push str.HKCRSHCmdFile
push dword [esi + 0xc4]
call fcn.10026170
mov ecx, eax
call fcn.1002b410
mov eax, dword [ebp - 0x424]
xor ecx, ecx
test byte [esi + 0x218], 1
je 0x1018cfce
cmp edi, 1
jne 0x1018cfce
push ebx
push eax
mov ecx, esi
call fcn.1018c5d0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
mov eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esi + 0x220]
push 0
push 0x10202940
mov ecx, eax
mov dword [ebp - 0x418], eax
call fcn.10003740
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x448], 0
push 0
push eax
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x41c]
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0x43c]
push 0x27b0
push eax
call fcn.100053d0
mov edx, dword [ebp - 0x41c]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d076
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10202940
lea ecx, [ebp - 0x41c]
call fcn.10002490
push eax
lea eax, [ebp - 0x438]
push 0x2801
push eax
call fcn.100053d0
mov edx, dword [ebp - 0x41c]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d0b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x1025ad50]
xor edi, edi
mov esi, dword [0x1025ad4c]
sub eax, esi
sar eax, 2
mov dword [ebp - 0x41c], edi
test eax, eax
je 0x1018d3ca
mov ebx, dword [ebp - 0x424]
lea eax, [ebp - 0x20c]
sub ebx, eax
mov dword [ebp - 0x424], ebx
lea esp, [esp]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
jmp 0x1018d100
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1018d120
movzx eax, word [ebx + ecx]
test ax, ax
je 0x1018d120
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1018d100
jmp 0x1018d124
test edx, edx
jne 0x1018d127
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x20c]
push dword [esi + edi*4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1018d152
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x1018d16b
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x1018d178
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x1018d185
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x1018d3a2
test bl, 0x10
jne 0x1018d3a2
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
lea esi, [eax + 0x10]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x428], esi
test eax, 0xffff0000
jne 0x1018d2b9
push 0
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
mov ebx, 1
test edi, edi
je 0x1018d2ea
lea ecx, [ebp - 0x20c]
movzx eax, cx
shr eax, 4
inc eax
mov dword [ebp - 0x42c], eax
jmp 0x1018d1f0
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1018d218
lea edx, [ebp - 0x20c]
movzx ecx, dx
push ecx
push eax
push edi
call fcn.10003980
add esp, 0xc
test eax, eax
jne 0x1018d236
push ebx
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
inc ebx
test edi, edi
je 0x1018d2ea
mov eax, dword [ebp - 0x42c]
jmp 0x1018d1f0
test edi, edi
je 0x1018d2ea
push 6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
test ecx, ecx
je 0x1018d2ea
lea edx, [ebp - 0x20c]
movzx eax, dx
push eax
push ecx
push edi
call fcn.10003980
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1018d2ea
movzx edx, word [ebx]
mov ecx, 1
mov eax, dword [esi - 8]
mov edi, edx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x1018d29c
push edi
lea ecx, [ebp - 0x428]
call fcn.10003310
movzx edx, word [ebx]
mov esi, dword [ebp - 0x428]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.101eb860
add esp, 0x10
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x1018d2ea
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1018d2c2
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.10003740
mov esi, dword [ebp - 0x428]
mov edi, dword [ebp - 0x444]
cmp dword [ebp - 0x440], edi
je 0x1018d312
lea eax, [esi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [edi], eax
add dword [ebp - 0x444], 4
jmp 0x1018d325
lea eax, [ebp - 0x428]
push eax
push edi
lea ecx, [ebp - 0x448]
call fcn.1001ddd0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1018d33d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x1025ad4c]
lea ecx, [ebp - 0x43c]
mov edi, dword [ebp - 0x41c]
mov eax, dword [eax + edi*4]
push dword [eax - 0xc]
push eax
call fcn.10002970
lea eax, [ebp - 0x20c]
mov ecx, 0x1025ac18
push eax
call fcn.100dff10
test eax, eax
jne 0x1018d3a2
or dword [ebp - 0x420], 1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1018d380
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x418]
push eax
call fcn.10003740
mov eax, dword [0x1025ad50]
inc edi
mov esi, dword [0x1025ad4c]
sub eax, esi
mov ebx, dword [ebp - 0x424]
sar eax, 2
mov dword [ebp - 0x41c], edi
cmp edi, eax
jb 0x1018d0f0
or ebx, 0xffffffff
push str.SHCmdFile
push str.FILETYPE
mov ecx, 0x1025ac18
call fcn.100615f0
mov edi, eax
test edi, edi
je 0x1018d49a
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x1018d49a
push str.Windows_Explorer_Command
push dword [esi + 0xc]
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1018d48e
push str.InfoTip
push dword [esi + 8]
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1018d48e
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x10]
push 0x104
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
call fcn.10176b60
add esp, 0x24
test eax, eax
je 0x1018d4c3
lea eax, [ebp - 0x414]
push eax
push dword [esi + 0xc]
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1018d48e
lea eax, [ebp - 0x414]
push eax
push dword [esi + 0xc]
call fcn.100dcaf0
add esp, 8
test eax, eax
je 0x1018d4c3
add esi, 0x28
cmp esi, dword [edi + 4]
jne 0x1018d3f3
mov eax, dword [ebp - 0x420]
test al, 3
je 0x1018d7fe
mov ecx, dword [ebp - 0x434]
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x1018d542
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x1018d547
push 0x10202940
lea ecx, [ebp - 0x41c]
call fcn.10002490
push eax
lea eax, [ebp - 0x418]
push 0x2834
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0x438]
push eax
call fcn.10002790
mov edx, dword [ebp - 0x418]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d511
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x41c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d52e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x420]
or eax, 2
mov dword [ebp - 0x420], eax
jmp 0x1018d4a0
mov eax, 0x10202940
push eax
lea ecx, [ebp - 0x340]
call fcn.10183f20
push 0x10202940
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x218], 0x1d
call fcn.10002490
mov eax, dword [ebp - 0x418]
push 1
push 0
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x424], eax
call fcn.10002a60
add esp, 4
lea ecx, [ebp - 0x42c]
add eax, 0x10
mov dword [esi], eax
push 0x27d4
call fcn.10002490
push 0x2807
lea ecx, [ebp - 0x41c]
mov eax, dword [eax]
mov dword [ebp - 0x418], eax
call fcn.10002490
mov edi, dword [ebp - 0x438]
mov ebx, dword [ebp - 0x43c]
push 1
mov esi, dword [eax]
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 0
push 0xffffffffffffffff
push 4
push 0
lea eax, [ebp - 0x448]
push eax
push 0
push dword [ebp - 0x418]
push esi
mov esi, dword [ebp - 0x434]
mov ecx, esi
push edi
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x41c]
lea edi, [esi + 0x21c]
or ebx, 0xffffffff
mov dword [edi], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d643
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x42c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d660
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 2
push 0x10202940
lea ecx, [ebp - 0x500]
call fcn.10184120
lea eax, [ebp - 0x500]
push eax
lea ecx, [ebp - 0x47c]
call fcn.10188e80
mov eax, dword [edi]
lea ecx, [ebp - 0x4c8]
push 0x10202940
mov dword [ebp - 0x4cc], eax
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x4c4]
call fcn.10002490
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x4c0], eax
lea eax, [ebp - 0x47c]
push eax
call fcn.10188e80
lea ecx, [ebp - 0x47c]
mov dword [ebp - 0x488], 1
mov dword [ebp - 0x480], 0
call fcn.100e54a0
lea ebx, [esi + 0xd8]
mov esi, dword [ebx]
mov edx, esi
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1018d71b
mov ecx, dword [edi]
cmp dword [eax + 0x10], ecx
jae 0x1018d711
mov eax, dword [eax + 8]
jmp 0x1018d715
mov esi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1018d707
cmp esi, edx
je 0x1018d726
mov eax, dword [edi]
cmp eax, dword [esi + 0x10]
jae 0x1018d760
lea eax, [ebp - 0x42d]
mov dword [ebp - 0x418], edi
push eax
lea eax, [ebp - 0x418]
mov ecx, ebx
push eax
push 0x1021bfa8
call fcn.10188890
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x418]
push eax
call fcn.10188b50
mov esi, dword [ebp - 0x418]
mov eax, dword [ebp - 0x4cc]
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.10002790
lea eax, [ebp - 0x4c4]
push eax
lea ecx, [esi + 0x1c]
call fcn.10002790
lea eax, [ebp - 0x4c0]
push eax
lea ecx, [esi + 0x20]
call fcn.10002790
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [esi + 0x24]
call fcn.10188f80
mov eax, dword [ebp - 0x488]
lea ecx, [ebp - 0x4cc]
mov dword [esi + 0x58], eax
mov eax, dword [ebp - 0x484]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0x480]
mov dword [esi + 0x60], eax
call fcn.10188f20
lea ecx, [ebp - 0x500]
call fcn.100e54a0
mov edx, dword [ebp - 0x424]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d7f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x340]
call fcn.101841c0
mov edx, dword [ebp - 0x438]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1018d81b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x43c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1018d836
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x448]
call fcn.1002a3c0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc