Function at 0x100ee56f
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x10], 0xffffffff
mov eax, ecx
push ebx
push esi
push edi
push 0x60
pop ecx
mov dword [ebp - 0x4c], edx
xor edx, edx
push edx
mov dword [ebp - 0x34], ecx
mov ebx, edx
push edx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
push ecx
push eax
mov esi, edx
mov dword [ebp - 0x40], ebx
mov edi, edx
mov dword [ebp - 0x38], edx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x100ee5c4
mov esi, 0x80070057
push 0x10032730
jmp 0x100ee7e6
xor ecx, ecx
mov dword [ebp - 0x30], 0x18
push ecx
push ecx
push 0x200020
push 1
push 7
push 0x80
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], 0x40
push eax
push 0x100080
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
push eax
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x100ee634
push dword [ebp - 0x3c]
mov esi, eax
push 0x1003274c
push 1
or esi, 0x10000000
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ee7f6
push 0x60
pop ecx
test edi, edi
je 0x100ee645
push edi
call fcn.100b84f9
pop ecx
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.100b84fe
mov edi, eax
pop ecx
test edi, edi
je 0x100ee7dc
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0xc]
push 0x2e
push ecx
push edi
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ecx, dword [edi]
mov dword [ebp - 0x34], ecx
cmp eax, 0x80000005
je 0x100ee637
test eax, eax
jns 0x100ee69f
push dword [ebp - 0x3c]
mov esi, eax
push 0x10032760
push 1
or esi, 0x10000000
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100ee7c8
cmp dword [ebp - 8], ebx
jne 0x100ee6ae
mov esi, 0x80070002
jmp 0x100ee7c8
and dword [ebp - 0x3c], ebx
lea eax, [edi + 8]
mov dword [ebp - 0x34], eax
cmp dword [edi + 4], ebx
jbe 0x100ee7c8
push dword [eax + 0xc]
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x40]
push dword [eax + 8]
call fcn.100edd8d
mov esi, eax
test esi, esi
js 0x100ee7b0
mov ebx, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x38]
lea eax, [ebx + 4]
mov dword [ebp - 0x44], eax
mov ax, word [ebx]
mov word [ebp - 0x46], ax
mov word [ebp - 0x48], ax
call fcn.100f20c8
mov esi, eax
test esi, esi
js 0x100ee787
lea ecx, [ebp - 0x38]
call fcn.100b15f5
mov esi, eax
test esi, esi
js 0x100ee780
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x48]
lea eax, [ecx + 0x14]
mov dword [ebp - 0x44], eax
mov ax, word [ecx + 0x10]
lea ecx, [ebp - 0x38]
add ax, ax
mov word [ebp - 0x46], ax
mov word [ebp - 0x48], ax
call fcn.100f20c8
mov esi, eax
test esi, esi
js 0x100ee787
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x38]
push eax
call fcn.100b647d
mov esi, eax
test esi, esi
js 0x100ee779
mov eax, dword [ebp - 0x34]
push ebx
add eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.100b84f9
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
and dword [ebp - 0x38], ebx
inc eax
cmp eax, dword [edi + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
pop ecx
mov dword [ebp - 0x40], ebx
jb 0x100ee6c0
jmp 0x100ee7c8
mov eax, 0x100327e4
jmp 0x100ee78c
mov eax, 0x100327cc
jmp 0x100ee78c
mov eax, 0x100327ac
push eax
push 1
push esi
push 0x4000000
call fcn.100ab973
mov eax, dword [ebp - 0x38]
add esp, 0x10
test eax, eax
je 0x100ee7c8
add eax, 0xfffffffc
push eax
call fcn.100b84f9
pop ecx
jmp 0x100ee7c8
push 0x10032790
push 1
push esi
push 0x4000000
call fcn.100ab973
mov ebx, dword [ebp - 0x40]
add esp, 0x10
push edi
call fcn.100b84f9
pop ecx
test ebx, ebx
je 0x100ee7f6
push ebx
call fcn.100b84f9
pop ecx
jmp 0x100ee7f6
mov esi, 0x8007000e
push 0x100326d4
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
cmp word [ebp - 0x18], 0
je 0x100ee811
push dword [ebp - 0x14]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x10], 0xffffffff
je 0x100ee820
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret