Function at 0x406451
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx], 0xc0000043
push ebx
push esi
push edi
je 0x40647d
cmp dword [ecx], 0xc0190001
jne case.0x406491.9
mov eax, dword [ecx + 4]
dec eax
cmp eax, 0x10
ja case.0x406491.9
movzx eax, byte [eax + 0x4069b1]
jmp dword [eax*4 + 0x4069a1]
add ecx, 0x10
jmp 0x40650f
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x2c
push ecx
push ecx
lea edx, [ecx + 0x10]
xor ecx, ecx
inc ecx
call fcn.00418745
mov esi, eax
test esi, esi
js 0x40690b
lea ecx, [ebp - 0x18]
jmp 0x406517
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x2c
push ecx
push ecx
lea edx, [ecx + 0x10]
xor ecx, ecx
inc ecx
call fcn.00418745
mov esi, eax
test esi, esi
js 0x40690b
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x40650c
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
cmp word [ecx], 0x20
jne 0x406503
sub edx, 2
add ecx, 2
dec eax
sub eax, 1
jne 0x4064f1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edx
lea ecx, [ebp - 0x50]
test ecx, ecx
je case.0x406491.9
xor edi, edi
lea edx, [ebp - 0x24]
mov dword [ebp - 8], edi
call fcn.004185d7
mov esi, eax
test esi, esi
jns 0x40654d
mov eax, dword [ebp - 8]
test eax, eax
je 0x40690b
cmp eax, 0xffffffff
je 0x40690b
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x40690b
push 0x4020
lea eax, [ebp - 0x24]
mov dword [ebp - 0x80], 0x18
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x2c]
push 7
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x7c], edi
push eax
push 0x100080
lea eax, [ebp - 8]
mov dword [ebp - 0x74], 0x40
push eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jns 0x4065c9
mov eax, 0x401878
mov dword [ebp - 0x8c], esi
mov edi, 0x452
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40696c
cmp eax, 0xffffffff
je 0x40696c
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x40696c
mov ebx, 0x400
mov dword [ebp - 0x14], edi
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov ecx, ebx
mov dword [ebp - 0x10], edi
call fcn.0041a303
mov esi, eax
mov dword [ebp - 0x84], esi
test esi, esi
jns 0x406614
cmp dword [ebp - 0x10], edi
je 0x40652a
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov esi, dword [ebp - 0x84]
xor edi, edi
jmp 0x40652a
push 0x2f
push ebx
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
mov dword [ebp - 0x84], esi
test esi, esi
jns 0x406673
mov dword [ebp - 0x8c], esi
mov eax, 0x401908
mov dword [ebp - 0x88], eax
mov edi, 0x469
test ebx, ebx
je 0x4065a4
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov esi, dword [ebp - 0x84]
mov edi, 0x469
jmp 0x4065a4
mov dword [ebp - 0x8c], edi
cmp dword [ebx], edi
jbe 0x4067a5
lea ecx, [ebx + 4]
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 0x44], 0x18
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ecx]
xor edi, edi
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x64], edi
push eax
push 0x1000
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_NtOpenProcess]
mov dword [ebp - 0x84], eax
test eax, eax
js 0x406912
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x4c], edi
push eax
push edi
push edi
push 0x1b
push dword [ebp - 0xc]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], edi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x84], eax
cmp eax, 0x80000005
je 0x406706
cmp eax, 0xc0000023
je 0x406706
cmp eax, 0xc0000004
jne 0x4067e1
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x50]
call fcn.0041a303
mov dword [ebp - 0x84], eax
test eax, eax
js 0x4068ae
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push esi
push 0x1b
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x84], eax
test eax, eax
js 0x40683e
cmp word [esi], di
jbe 0x40674f
mov ecx, esi
call fcn.00405839
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], edi
call fcn.0041a38f
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x406781
cmp eax, 0xffffffff
je 0x406781
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
inc esi
add ecx, 4
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], ecx
cmp esi, dword [ebx]
jb 0x40668a
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov eax, dword [ebp - 8]
test eax, eax
je case.0x406491.9
cmp eax, 0xffffffff
je case.0x406491.9
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ba49
mov esp, ebp
pop ebp
ret
test eax, eax
jns 0x40699a
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x88], edi
test eax, eax
je 0x40680b
cmp eax, 0xffffffff
je 0x40680b
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtClose]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov eax, dword [ebp - 8]
test eax, eax
je 0x406834
cmp eax, 0xffffffff
je 0x406834
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, 0x491
jmp 0x406966
mov dword [ebp - 0x88], 0x4019b8
mov dword [ebp - 0x8c], eax
test esi, esi
je 0x406865
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
xor edi, edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40687b
cmp eax, 0xffffffff
je 0x40687b
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtClose]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov eax, dword [ebp - 8]
test eax, eax
je 0x4068a4
cmp eax, 0xffffffff
je 0x4068a4
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, 0x49c
jmp 0x406966
cmp dword [ebp - 0x48], edi
je 0x4068c6
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
xor edi, edi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4068dc
cmp eax, 0xffffffff
je 0x4068dc
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtClose]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov eax, dword [ebp - 8]
test eax, eax
je 0x406905
cmp eax, 0xffffffff
je 0x406905
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x84]
mov eax, esi
jmp 0x4067d0
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x88], 0x401974
test eax, eax
je 0x406938
cmp eax, 0xffffffff
je 0x406938
push eax
mov dword [ebp - 0xc], edi
call dword [sym.imp.ntdll.dll_NtClose]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041a38f
mov eax, dword [ebp - 8]
test eax, eax
je 0x406961
cmp eax, 0xffffffff
je 0x406961
xor ecx, ecx
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_NtClose]
mov edi, 0x47e
mov esi, dword [ebp - 0x84]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x58], edi
mov edi, dword [ebp - 0x88]
lea ecx, [ebp - 0x8c]
push eax
mov dword [ebp - 0x60], 0x401670
mov dword [ebp - 0x5c], 0x401868
mov dword [ebp - 0x54], edi
call fcn.00408a15
jmp 0x40690b
call fcn.00408a2d
mov edi, edi
ret