Function at 0xa2d810
Capabilities:
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0xa8c478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov al, byte [esp + 0x2c]
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x10], al
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 8], 0xa91734
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
movsx eax, byte [esp + 0x34]
push esi
push edx
push eax
lea ecx, [esp + 0x14]
push str._c_lpFileName_ls_dwDesiredAccess0x_x__
push ecx
mov dword [esp + 0x40], edi
call fcn.00a48080
add esp, 0x14
test esi, 0x20000000
je 0xa2d894
lea edx, [esp + 8]
push str._GENERIC_EXECUTE
push edx
call fcn.00a48080
add esp, 8
test esi, 0x80000000
je 0xa2d8ae
lea eax, [esp + 8]
push str._GENERIC_READ
push eax
call fcn.00a48080
add esp, 8
test esi, 0x40000000
je 0xa2d8c8
lea ecx, [esp + 8]
push str._GENERIC_WRITE
push ecx
call fcn.00a48080
add esp, 8
push ebx
mov ebx, dword [esp + 0x44]
push ebx
lea edx, [esp + 0x10]
push str.__dwShareMode0x_x__
push edx
call fcn.00a48080
add esp, 0xc
test bl, 4
je 0xa2d8f7
lea eax, [esp + 0xc]
push str._FILE_SHARE_DELETE
push eax
call fcn.00a48080
add esp, 8
test bl, 1
je 0xa2d90e
lea ecx, [esp + 0xc]
push str._FILE_SHARE_READ
push ecx
call fcn.00a48080
add esp, 8
test bl, 2
je 0xa2d925
lea edx, [esp + 0xc]
push str._FILE_SHARE_WRITE
push edx
call fcn.00a48080
add esp, 8
mov edx, dword [esp + 0x4c]
mov eax, str.UNKNOWN_DISPOSITION
lea ecx, [edx - 1]
cmp ecx, 4
ja case.default.0xa2d936
jmp dword [ecx*4 + 0xa2daec]
mov eax, str.CREATE_ALWAYS
jmp case.default.0xa2d936
mov eax, str.CREATE_NEW
jmp case.default.0xa2d936
mov eax, str.OPEN_ALWAYS
jmp case.default.0xa2d936
mov eax, str.OPEN_EXISTING
jmp case.default.0xa2d936
mov eax, str.TRUNCATE_EXISTING
mov ebx, dword [esp + 0x50]
lea ecx, [esp + 0xc]
push ebx
push eax
mov eax, dword [esp + 0x50]
push edx
push eax
push str.__lpSecurityAttributes0x_x_dwCreationDisposition0x_x___s__dwFlagsAndAttributes0x_x__
push ecx
call fcn.00a48080
add esp, 0x18
test bl, 0x80
je 0xa2d993
lea edx, [esp + 0xc]
push str._FILE_ATTRIBUTE_NORMAL
push edx
call fcn.00a48080
add esp, 8
mov esi, ebx
and esi, 0x20
je 0xa2d9ac
lea eax, [esp + 0xc]
push str._FILE_ATTRIBUTE_ARCHIVE
push eax
call fcn.00a48080
add esp, 8
cmp esi, edi
je 0xa2d9c2
lea ecx, [esp + 0xc]
push str._FILE_ATTRIBUTE_ARCHIVE
push ecx
call fcn.00a48080
add esp, 8
test bl, 2
je 0xa2d9d9
lea edx, [esp + 0xc]
push str._FILE_ATTRIBUTE_HIDDEN
push edx
call fcn.00a48080
add esp, 8
test bh, 0x20
je 0xa2d9f0
lea eax, [esp + 0xc]
push str._FILE_ATTRIBUTE_NOT_CONTENT_INDEXED
push eax
call fcn.00a48080
add esp, 8
test bl, 1
je 0xa2da07
lea ecx, [esp + 0xc]
push str._FILE_ATTRIBUTE_READONLY
push ecx
call fcn.00a48080
add esp, 8
test bl, 4
je 0xa2da1e
lea edx, [esp + 0xc]
push str._FILE_ATTRIBUTE_SYSTEM
push edx
call fcn.00a48080
add esp, 8
test bh, 1
je 0xa2da35
lea eax, [esp + 0xc]
push str._FILE_ATTRIBUTE_TEMPORARY
push eax
call fcn.00a48080
add esp, 8
test ebx, 0x4000000
pop ebx
je 0xa2da50
lea ecx, [esp + 8]
push str._FILE_FLAG_DELETE_ON_CLOSE
push ecx
call fcn.00a48080
add esp, 8
mov esi, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
push esi
push edx
lea eax, [esp + 0x10]
push str.hTemplateFile0x_x____0x_x
push eax
call fcn.00a48080
add esp, 0x10
cmp esi, 0xffffffff
pop edi
pop esi
jne 0xa2da8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 4]
push str._failed__GetLastError0x_x
push ecx
call fcn.00a48080
add esp, 0xc
jmp 0xa2daa0
lea edx, [esp]
push str.__success_
push edx
call fcn.00a48080
add esp, 8
mov ecx, dword [esp + 4]
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0
push eax
mov edx, dword [ecx + 8]
push 1
push edx
call fcn.009fd6a0
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 4]
mov ecx, dword [eax + 8]
mov eax, dword [edx + 4]
push ecx
push eax
push str.CreateFile_s__ls_n
call fcn.009fe320
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00a7d8f0
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret