Function at 0x1002fbdc
Capabilities:
Get file attributes

Disassembly:
push 0x658
push 0x10084f00
call fcn.10083d38
mov eax, ecx
mov dword [ebp - 0x650], eax
or dword [ebp - 0x65c], 0xffffffff
xor esi, esi
mov edi, esi
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x644], 8
mov dword [ebp - 0x64c], esi
cmp edx, 0x20
jne 0x1002fefa
mov dword [ebp - 4], esi
push esi
push 0x2000000
push 3
push esi
push 7
push 0x100080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x65c], ebx
test ebx, ebx
je 0x1002fec8
cmp ebx, 0xffffffff
je 0x1002fec8
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x660], esi
test edi, edi
je 0x1002fc89
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, edi
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x644]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x648], edi
test edi, edi
jne 0x1002fcb4
mov dword [ebp - 0x640], 0xc0000017
jmp 0x1002feee
push 0x2f
push dword [ebp - 0x644]
push edi
lea eax, [ebp - 0x664]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x640], eax
test eax, eax
js 0x1002fe94
mov eax, dword [edi]
lea eax, [eax*4 + 4]
cmp eax, dword [ebp - 0x644]
jbe 0x1002fcf9
mov dword [ebp - 0x640], 0x80000005
jmp 0x1002feee
mov eax, esi
mov dword [ebp - 0x658], esi
cmp eax, dword [edi]
jae 0x1002feee
mov eax, dword [edi + eax*4 + 4]
mov dword [ebp - 0x654], eax
push eax
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x660], eax
test eax, eax
je 0x1002fe40
cmp eax, 0xffffffff
je 0x1002fe40
lea ecx, [ebp - 0x64c]
push ecx
push esi
push esi
push 0x1b
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x640], eax
cmp eax, 0xc0000004
jne 0x1002fe10
push dword [ebp - 0x64c]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x644], eax
test eax, eax
jne 0x1002fd86
mov eax, 0xc0000023
mov dword [ebp - 0x640], eax
jmp 0x1002fdf1
push esi
push dword [ebp - 0x64c]
push eax
push 0x1b
push dword [ebp - 0x660]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x640], eax
test eax, eax
js 0x1002fdf1
push dword [ebp - 0x650]
mov eax, dword [ebp - 0x644]
push dword [eax + 4]
push 0x10006728
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.1001fec9
add esp, 0x14
push 0x7cb
push 0x10006770
push esi
lea eax, [ebp - 0x63c]
push eax
push esi
xor edx, edx
push 2
pop ecx
call fcn.1002fae3
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 0x644]
test ecx, ecx
je 0x1002fe10
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x640]
test eax, eax
je 0x1002fe82
push dword [ebp - 0x650]
push dword [ebp - 0x654]
push 0x100067b0
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.1001fec9
add esp, 0x14
push 0x7da
jmp 0x1002fe6a
push dword [ebp - 0x650]
push dword [ebp - 0x654]
push 0x100067b0
push 0x30c
lea eax, [ebp - 0x63c]
push eax
call fcn.1001fec9
add esp, 0x14
push 0x7e1
push 0x10006770
push esi
lea eax, [ebp - 0x63c]
push eax
push esi
push 2
xor edx, edx
pop ecx
call fcn.1002fae3
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
jmp 0x1002fd01
cmp eax, 0x80000005
je 0x1002fea9
cmp eax, 0xc0000023
je 0x1002fea9
cmp eax, 0xc0000004
jne 0x1002feee
mov eax, dword [ebp - 0x644]
add eax, eax
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x640], esi
jmp 0x1002fc56
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1002feda
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002fee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0xc0070000
mov dword [ebp - 0x640], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.1002ff10
xor eax, eax
call fcn.10083d80
ret