Function at 0x7dde4f8e
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov dl, byte [ebp + 0x1c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov byte [ebp - 0xc], dl
push edi
mov edi, dword [ebp + 0x20]
mov esi, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], edx
je 0x7dde4fdb
cmp esi, edx
je 0x7dde4fd1
push dword [ebp + 8]
call fcn.7dde3ba9
push edi
call fcn.7dde44d3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x1c
mov dword [eax], edx
cmp esi, 0xffffffff
je 0x7dde4fd1
cmp ecx, edx
je 0x7dde4fd1
cmp esi, edx
je 0x7dde5078
mov eax, dword [esi + 0x428]
cmp dword [eax*4 + 0x7ddb2f7c], edx
je 0x7dde4fc3
mov dword [edi], esi
cmp byte [esi + 0x45d], 0
je 0x7dde502e
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x420], eax
mov dword [esi + 0x424], eax
mov dword [esi + 0x444], eax
mov dword [esi + 0x440], eax
mov byte [esi + 0x45e], al
mov eax, dword [esi + 0x428]
mov ecx, dword [eax*4 + 0x7ddb2f7c]
xor ebx, ebx
inc ebx
dec ecx
je 0x7dde511a
dec ecx
je 0x7dde510b
dec ecx
je 0x7dde50fc
dec ecx
je 0x7dde50ed
sub ecx, 3
je 0x7dde50de
dec ecx
je 0x7dde50cf
dec ecx
dec ecx
je 0x7dde50c0
inc eax
mov dword [esi + 0x428], eax
mov byte [esi + 0x45d], bl
jmp 0x7dde5129
push 0x400
call fcn.7dde4530
mov esi, eax
test esi, esi
je 0x7dde51dc
push 4
push 0x28
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jl 0x7dde50b3
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x460], eax
jmp 0x7dde4ffd
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7dde4fd4
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4c19
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4d3e
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4b5f
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde47e9
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4e7c
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde4a71
jmp 0x7dde5127
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.7dde471a
mov ebx, eax
mov edx, dword [esi + 0x424]
mov eax, dword [esi + 0x42c]
mov edi, dword [esi + 0x420]
xor ecx, ecx
cmp edx, ecx
jg 0x7dde517f
jl 0x7dde5147
cmp edi, eax
jae 0x7dde517f
sub eax, edi
sbb ecx, edx
xor edx, edx
cmp ecx, edx
jg 0x7dde515c
jl 0x7dde5158
cmp eax, dword [ebp - 0x10]
jae 0x7dde515c
mov edi, eax
jmp 0x7dde515f
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 0x420]
push edi
add eax, esi
push eax
push dword [ebp - 0x18]
call sub.ntdll.dll_memcpy
add esp, 0xc
push edi
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.7dde3c9c
mov edx, dword [esi + 0x424]
mov eax, dword [esi + 0x42c]
xor ecx, ecx
xor edi, edi
cmp edx, ecx
jl 0x7dde51a9
jg 0x7dde519f
mov ecx, dword [esi + 0x420]
cmp ecx, eax
jb 0x7dde51a9
push esi
call fcn.7dde3e39
test eax, eax
je 0x7dde51e3
cmp ebx, edi
je 0x7dde51dc
mov eax, dword [esi + 0x428]
cmp dword [eax*4 + 0x7ddb2f7c], edi
je 0x7dde51c5
cmp dword [ebp - 0x10], edi
jne 0x7dde4fff
mov eax, dword [ebp - 0x14]
cmp dword [eax], edi
jne 0x7dde51dc
push dword [ebp + 8]
call fcn.7dde3ba9
push dword [ebp + 0x20]
call fcn.7dde44d3
mov eax, ebx
jmp 0x7dde4fd4
xor ebx, ebx
jmp 0x7dde51dc