Function at 0xc5aff7
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 0x40], eax
push esi
push edi
cmp ebx, 0xffffffff
jne 0xc5b023
mov eax, reloc.OLEAUT32.dll_SysStringLen
jmp 0xc5b2e2
test eax, eax
jne 0xc5b031
mov eax, 0xc00000ef
jmp 0xc5b2e2
test ebx, ebx
jne 0xc5b03f
mov eax, 0xc00000f1
jmp 0xc5b2e2
and dword [ebp - 0x48], 0
lea edi, [ebp - 0x60]
and dword [ebp - 0x44], 0
xor eax, eax
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
stosd dword es:[edi], eax
push 7
pop ecx
push 0x268
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x24]
mov word [ebp - 0x30], ax
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
jne 0xc5b08f
mov esi, 0xc0000017
jmp 0xc5b2b9
mov eax, dword [ebx + 0x10]
cmp eax, 1
jb 0xc5b2a0
mov edx, eax
lea ecx, [eax - 1]
xor esi, esi
cmp ecx, edx
jae 0xc5b0c4
mov eax, dword [ebx + 0xc]
mul ecx
mov ecx, eax
test edx, edx
ja 0xc5b0c2
jb 0xc5b0b8
cmp ecx, 0xffffffff
ja 0xc5b0c2
mov eax, dword [ebx + 0x1c]
lea esi, [eax + ecx]
cmp esi, eax
jae 0xc5b0c4
xor esi, esi
test esi, esi
je 0xc5b8bc
cmp dword [esi + 0xc], 0
jne 0xc5b2f3
push 0xa28308
push 0x9a7
push 0xa282f0
push 1
call fcn.00a32ac8
mov eax, dword [ebx + 0x10]
add esp, 0x10
cmp eax, 1
jae 0xc5b0fe
mov esi, 0x8000001a
jmp 0xc5b145
lea edx, [eax - 1]
xor ecx, ecx
cmp edx, eax
jae 0xc5b123
mov eax, dword [ebx + 0xc]
mul edx
mov ecx, eax
test edx, edx
ja 0xc5b121
jb 0xc5b119
cmp ecx, 0xffffffff
ja 0xc5b121
add ecx, dword [ebx + 0x1c]
cmp ecx, dword [ebx + 0x1c]
jae 0xc5b123
xor ecx, ecx
test ecx, ecx
jne 0xc5b15a
push 0x9ffa14
push 0x7ff
push 0x9ffa3c
push 1
mov esi, 0xc00000e5
call fcn.00a32ac8
add esp, 0x10
push esi
push 0x9ff9d4
push 0x81a
push 0x9ff9fc
jmp 0xc5b5e5
call fcn.00c5bd7f
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x10]
dec ecx
cmp ecx, esi
jae 0xc5b292
mov edi, dword [ebx + 0xc]
mov eax, edi
mul ecx
test edx, edx
ja 0xc5b28f
jb 0xc5b188
cmp eax, 0xffffffff
ja 0xc5b28f
add eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebx + 0x1c]
jb 0xc5b28f
sub esi, ecx
sub esi, 1
je 0xc5b1ee
mov eax, esi
mul edi
mov esi, eax
test edx, edx
ja 0xc5b28f
jb 0xc5b1b7
cmp esi, 0xffffffff
ja 0xc5b28f
mov eax, dword [ebx + 0x10]
mul edi
test edx, edx
ja 0xc5b28f
jb 0xc5b1cf
cmp eax, 0xffffffff
ja 0xc5b28f
add eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x1c]
jb 0xc5b28f
push esi
push eax
push dword [ebp - 0x2c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov edi, dword [ebx + 0xc]
add esp, 0xc
mov eax, dword [ebp - 0x2c]
push edi
add eax, esi
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
dec dword [ebx + 0x10]
cmp dword [ebx + 0x10], 0x10
jbe 0xc5b28f
mov edx, dword [ebx + 0x14]
mov eax, edx
imul eax, dword [ebx + 0xc]
cmp eax, 0x400
jb 0xc5b28f
mov ecx, edx
shr ecx, 2
cmp dword [ebx + 0x10], ecx
jae 0xc5b28f
mov ecx, edx
mov eax, edx
mul dword [ebx + 0xc]
shr ecx, 1
mov dword [ebp - 0x2c], ecx
test edx, edx
ja 0xc5b28f
jb 0xc5b23a
cmp eax, 0xffffffff
ja 0xc5b28f
mov eax, dword [ebx + 0xc]
mul ecx
mov edi, eax
test edx, edx
ja 0xc5b28f
jb 0xc5b24c
cmp edi, 0xffffffff
ja 0xc5b28f
cmp dword [ebx + 0x1c], 0
push edi
jne 0xc5b272
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0xc5b28f
push edi
push 0
push esi
call fcn.00ab4bf6
add esp, 0xc
jmp 0xc5b282
push dword [ebx + 0x1c]
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov esi, eax
test esi, esi
je 0xc5b28f
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x14], eax
mov edi, dword [ebp - 0x28]
mov eax, dword [ebx + 0x10]
mov edx, eax
cmp eax, 1
jae 0xc5b09d
mov esi, reloc.OLEAUT32.dll_SysStringLen
push dword [ebp - 0x28]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
test ecx, ecx
je 0xc5b2d7
cmp ecx, eax
je 0xc5b2d7
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0xc5b2e0
xor ecx, ecx
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 4
push dword [esi + 8]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor ecx, ecx
lea eax, [ebp - 0x38]
push ecx
push eax
push 1
push 3
push 0x268
push edi
lea eax, [ebp - 0x48]
push eax
push ecx
push ecx
push ecx
push dword [esi + 0xc]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
jns 0xc5b466
cmp eax, reloc.OLEAUT32.dll_SysStringLen
je 0xc5b370
cmp eax, 0xc000000f
je 0xc5b370
push eax
push 0xa283f0
push 0x9bf
push 0xa282f0
push 1
call fcn.00a32ac8
add esp, 0x14
push dword [ebp - 0x34]
push dword [esi + 4]
push 0xa28424
push 0x9c0
push 0xa282f0
push 2
call fcn.00a32ac8
add esp, 0x18
mov eax, dword [ebx + 0x10]
cmp eax, 1
jb 0xc5b0f7
lea edx, [eax - 1]
xor ecx, ecx
cmp edx, eax
jae 0xc5b3a1
mov eax, dword [ebx + 0xc]
mul edx
mov ecx, eax
test edx, edx
ja 0xc5b39f
jb 0xc5b397
cmp ecx, 0xffffffff
ja 0xc5b39f
add ecx, dword [ebx + 0x1c]
cmp ecx, dword [ebx + 0x1c]
jae 0xc5b3a1
xor ecx, ecx
test ecx, ecx
je 0xc5b127
call fcn.00c5bd7f
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x10]
dec ecx
cmp ecx, esi
jae 0xc5b292
mov edi, dword [ebx + 0xc]
mov eax, edi
mul ecx
test edx, edx
ja 0xc5b28f
jb 0xc5b3d7
cmp eax, 0xffffffff
ja 0xc5b28f
add eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2c], eax
cmp eax, dword [ebx + 0x1c]
jb 0xc5b28f
sub esi, ecx
sub esi, 1
je 0xc5b43d
mov eax, esi
mul edi
mov esi, eax
test edx, edx
ja 0xc5b28f
jb 0xc5b406
cmp esi, 0xffffffff
ja 0xc5b28f
mov eax, dword [ebx + 0x10]
mul edi
test edx, edx
ja 0xc5b28f
jb 0xc5b41e
cmp eax, 0xffffffff
ja 0xc5b28f
add eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x1c]
jb 0xc5b28f
push esi
push eax
push dword [ebp - 0x2c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov edi, dword [ebx + 0xc]
add esp, 0xc
mov eax, dword [ebp - 0x2c]
push edi
add eax, esi
push 0
push eax
call fcn.00ab4bf6
add esp, 0xc
dec dword [ebx + 0x10]
cmp dword [ebx + 0x10], 0x10
jbe 0xc5b28f
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x14]
imul eax, edx
jmp 0xc5b212
cmp dword [edi + 0x3c], 4
push 0x2e
pop eax
jne 0xc5b481
lea ecx, [edi + 0x5e]
cmp word [ecx], ax
jne 0xc5b493
cmp word [edi + 0x60], ax
je 0xc5b292
cmp dword [edi + 0x3c], 2
lea ecx, [edi + 0x5e]
jne 0xc5b493
cmp word [ecx], ax
je 0xc5b292
movzx eax, word [edi + 0x3c]
mov edx, esi
push eax
mov eax, dword [edi + 0x38]
push ecx
shr eax, 4
lea ecx, [ebp - 0x60]
and eax, 1
push eax
push dword [esi + 8]
call fcn.00c5bb1b
cmp eax, 0xc0000273
je 0xc5b5f4
cmp eax, 0xc0000103
je 0xc5b292
cmp eax, 0xc00000ba
je 0xc5b292
test eax, eax
js 0xc5b5d5
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x2c], edi
cmp edi, dword [ebx + 0x14]
jb 0xc5b58e
lea ecx, [edi + 1]
cmp ecx, dword [ebx + 0x14]
ja 0xc5b4fa
mov esi, 0xc000000d
jmp 0xc5b5bd
mov esi, dword [ebx + 0x18]
dec esi
lea eax, [esi + ecx]
cmp eax, ecx
jb 0xc5b5b8
not esi
and esi, eax
mov eax, dword [ebx + 0x14]
mul dword [ebx + 0xc]
mov dword [ebp - 0x3c], esi
test edx, edx
jne 0xc5b585
cmp eax, 0xffffffff
ja 0xc5b585
mov eax, dword [ebx + 0xc]
mul esi
mov edi, eax
test edx, edx
ja 0xc5b582
jb 0xc5b531
cmp edi, 0xffffffff
ja 0xc5b582
cmp dword [ebx + 0x1c], 0
push edi
jne 0xc5b557
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0xc5b56b
push edi
push 0
push esi
call fcn.00ab4bf6
add esp, 0xc
jmp 0xc5b567
push dword [ebx + 0x1c]
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov esi, eax
test esi, esi
jne 0xc5b575
mov esi, 0xc0000017
mov edi, dword [ebp - 0x2c]
jmp 0xc5b58a
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 0x1c], esi
xor esi, esi
mov dword [ebx + 0x14], eax
jmp 0xc5b570
mov edi, dword [ebp - 0x2c]
mov esi, 0xc0000095
test esi, esi
jne 0xc5b5bf
mov eax, dword [ebx + 0xc]
mul edi
mov ecx, eax
test edx, edx
ja 0xc5b5b8
jb 0xc5b5a0
cmp ecx, 0xffffffff
ja 0xc5b5b8
mov eax, dword [ebx + 0x1c]
lea edi, [eax + ecx]
cmp edi, eax
jb 0xc5b5b8
lea esi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x10]
xor esi, esi
jmp 0xc5b5bd
mov esi, 0xc0000095
test esi, esi
jns 0xc5b28f
push esi
push 0xa28374
push 0x9f1
jmp 0xc5b8e5
push eax
push 0xa2839c
push 0x9f9
push 0xa282f0
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5b292
mov dx, word [edi + 0x3c]
lea eax, [ebp - 0x30]
mov cx, word [esi]
push eax
call fcn.00c5c115
test eax, eax
js 0xc5b61c
mov cx, word [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
push 2
pop edx
call fcn.00c5c115
test eax, eax
jns 0xc5b62d
push 0xc0000095
push 0xa283c8
push 0xa25
jmp 0xc5b5e0
lea ecx, [ebp - 0xc]
mov eax, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push 2
pop edi
mov word [ebp - 0xc], ax
mov edx, edi
mov word [ebp - 0x24], ax
movzx eax, word [ebp - 0x30]
add eax, edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
mov word [ebp - 0x22], di
cmp eax, 0xfffe
jbe 0xc5b668
mov esi, 0xc0000106
jmp 0xc5b682
cmp eax, edi
jbe 0xc5b698
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
test eax, eax
jns 0xc5b692
mov esi, 0xc0000017
push esi
push 0xa285bc
push 0xa2e
jmp 0xc5b8e5
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ax, word [ebp - 0x14]
xor edi, edi
mov word [ebp - 0x22], ax
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x24], di
movzx eax, word [esi]
add eax, 2
cmp eax, 0xfffe
jbe 0xc5b6bd
mov esi, 0xc0000106
jmp 0xc5b6d7
cmp eax, edx
jbe 0xc5b6ee
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
test eax, eax
jns 0xc5b6e7
mov esi, 0xc0000017
push esi
push 0xa285f0
push 0xa38
jmp 0xc5b8e5
mov ecx, dword [ebp - 0x1c]
mov di, word [ebp - 0x24]
mov dword [ebp - 0x20], ecx
movzx eax, word [esi]
push eax
push dword [esi + 4]
movzx eax, di
shr eax, 1
lea eax, [ecx + eax*2]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov ax, word [esi]
add esp, 0xc
mov cx, word [ebp - 0x24]
xor edx, edx
add ax, cx
push 2
pop edi
add ax, di
mov word [ebp - 0x22], ax
add cx, word [esi]
mov eax, dword [ebp - 0x20]
mov word [ebp - 0x24], cx
movzx ecx, cx
shr ecx, 1
mov word [eax + ecx*2], dx
movzx ecx, word [esi]
mov eax, dword [esi + 4]
shr ecx, 1
cmp word [eax + ecx*2 - 2], 0x5c
je 0xc5b7c1
mov cx, word [ebp - 0x24]
movzx eax, cx
add eax, 4
cmp eax, 0xfffe
jbe 0xc5b75a
mov esi, 0xc0000106
jmp 0xc5b775
cmp eax, dword [ebp - 0x14]
jbe 0xc5b789
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
test eax, eax
jns 0xc5b785
mov esi, 0xc0000017
push esi
push 0xa28568
push 0xa3f
jmp 0xc5b8e5
mov cx, word [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ax, word [0x9ede5c]
movzx ecx, cx
shr ecx, 1
mov dword [ebp - 0x20], edx
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 0x24]
add eax, 4
mov word [ebp - 0x22], ax
mov ax, word [ebp - 0x24]
add ax, di
movzx ecx, ax
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x20]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x28]
mov di, word [ebp - 0x24]
lea esi, [eax + 0x5e]
mov dword [ebp - 0x34], esi
movzx edx, word [eax + 0x3c]
mov word [ebp - 0x38], dx
mov ecx, edx
mov ax, word [eax + 0x3c]
mov word [ebp - 0x36], ax
movzx eax, di
add eax, 2
add eax, ecx
cmp eax, 0xfffe
jbe 0xc5b7f6
mov esi, 0xc0000106
jmp 0xc5b811
cmp eax, dword [ebp - 0x14]
jbe 0xc5b82c
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
test eax, eax
jns 0xc5b821
mov esi, 0xc0000017
push esi
push 0xa28568
push 0xa4e
jmp 0xc5b8e5
mov esi, dword [ebp - 0x34]
mov dx, word [ebp - 0x38]
mov di, word [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
movzx eax, dx
push eax
movzx eax, di
shr eax, 1
push esi
mov dword [ebp - 0x20], ecx
lea eax, [ecx + eax*2]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x38]
add esp, 0xc
mov word [ebp - 0x24], cx
lea eax, [ecx + 2]
movzx ecx, cx
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x20]
shr ecx, 1
mov word [eax + ecx*2], dx
xor ecx, ecx
cmp dword [ebx], ecx
je 0xc5b88d
push ecx
push ecx
lea eax, [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.ntdll.dll_RtlNtPathNameToDosPathName]
mov esi, eax
test esi, esi
jns 0xc5b88d
push esi
push 0xa28594
push 0xa59
jmp 0xc5b8e5
movzx eax, word [ebp - 0x24]
mov edx, 0x208
mov ecx, dword [ebp - 0x40]
push eax
push dword [ebp - 0x20]
call fcn.00c5c085
mov esi, eax
test esi, esi
jns 0xc5b8b5
push esi
push 0xa28514
push 0xa64
jmp 0xc5b8e5
xor esi, esi
jmp 0xc5b2a5
push 0x9ffa14
push 0x7ff
push 0x9ffa3c
push 1
call fcn.00a32ac8
add esp, 0x10
mov esi, 0xc00000e5
push esi
push 0x9ff9d4
push 0x9a2
push 0xa282f0
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5b2a5