Function at 0x412000
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x44
push ebx
mov ebx, dword [esp + 0x60]
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0xc
push dword [esp + 0x74]
mov dword [esp + 0x28], 0
push ebx
push eax
push 0
push 0
push 0
push dword [esp + 0x74]
mov dword [esp + 0x44], 0
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
test eax, eax
je 0x412048
or eax, 0xffffffff
pop ebx
add esp, 0x44
ret 0x1c
xor edx, edx
mov dword [esp + 0x64], edx
test ebx, ebx
je 0x412334
push ebp
push esi
push edi
lea esp, [esp]
mov eax, dword [ebx + 8]
cmp eax, 2
jne 0x41206f
cmp word [ebx + 0xc], 0x2e
jmp 0x41207b
cmp eax, 4
jne 0x412081
cmp dword [ebx + 0xc], 0x2e002e
je 0x41231f
mov cl, byte [ebx + 0xc]
add ebx, 0xc
shr eax, 1
or esi, 0xffffffff
mov dword [esp + 0x14], eax
mov edx, eax
xor eax, eax
test cl, cl
je 0x4120b1
test edx, edx
je 0x4120ad
cmp cl, 0x2e
jne 0x4120a3
mov esi, eax
mov cl, byte [ebx + eax*2 + 2]
inc eax
dec edx
test cl, cl
jne 0x412098
test esi, esi
jns 0x4120b4
lea esi, [eax - 1]
lea eax, [esi + 1]
xor ecx, ecx
lea eax, [ebx + eax*2]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x10], eax
mov ebp, 0x446aa2
lea esp, [esp]
mov ebx, dword [ebp - 6]
mov edi, 0
sub ebx, 1
je 0x41214c
mov esi, ebp
nop
movzx edx, word [esi]
movzx eax, word [eax + edi*2]
mov ecx, edx
or ecx, eax
test cx, cx
je 0x41214c
test ax, ax
je 0x412133
lea ecx, [eax - 0x41]
cmp cx, 0x19
ja 0x412106
add eax, 0x20
movzx ecx, ax
jmp 0x412108
mov ecx, eax
lea eax, [edx - 0x41]
cmp ax, 0x19
ja 0x412119
lea eax, [edx + 0x20]
movzx eax, ax
jmp 0x41211b
mov eax, edx
inc edi
cmp cx, ax
jne 0x41212f
add esi, 2
sub ebx, 1
je 0x41214c
mov eax, dword [esp + 0x10]
jmp 0x4120e0
test edi, edi
je 0x41214c
inc dword [esp + 0x58]
add ebp, 0x48
cmp ebp, 0x446bc2
jge 0x412317
mov eax, dword [esp + 0x10]
jmp 0x4120d0
mov ecx, dword [esp + 0x58]
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x38], 0
lea eax, [ecx + ecx*8]
mov dword [esp + 0x34], 0
movzx eax, word [eax*8 + 0x446a98]
lea esi, [ebp + 1]
or eax, dword [esp + 0x5c]
lea ecx, [esp + 0x38]
add esi, edi
mov dword [esp + 0x30], eax
push esi
call fcn.004135d0
lea eax, [esi + esi]
mov esi, dword [esp + 0x38]
push eax
push 0
push esi
call fcn.00401670
add esp, 0xc
push dword [esp + 0x60]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [esp + 0x6c]
lea eax, [edi + 1]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp + 1]
lea eax, [esi + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, 0x5c
mov word [esi + ebp*2], ax
test esi, esi
je 0x4121d3
mov eax, dword [esi - 8]
jmp 0x4121d5
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x58], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
test eax, eax
jne 0x412212
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [esp + 0x1c], esi
mov word [esp + 0x18], ax
add eax, 2
mov word [esp + 0x1a], ax
lea eax, [esp + 0x18]
push 0x60
mov dword [esp + 0x48], eax
lea eax, [esp + 0x2c]
push 1
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x18
push eax
push 0x120001
lea eax, [esp + 0x6c]
mov dword [esp + 0x5c], 0x40
push eax
mov dword [esp + 0x58], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov edx, dword [esp + 0x70]
test eax, eax
jne 0x4122f6
mov ebp, dword [esp + 0x68]
inc edx
mov edi, dword [esp + 0x58]
mov dword [esp + 0x34], edi
mov dword [esp + 0x70], edx
test ebp, ebp
je 0x4122f6
cmp byte [0x430f39], al
je 0x4122b6
test esi, esi
je 0x4122a1
mov eax, dword [esi - 8]
jmp 0x4122a3
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x38]
call fcn.00413800
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov eax, dword [ebp]
test eax, eax
je 0x4122c2
mov ebx, dword [eax - 8]
jmp 0x4122c4
xor ebx, ebx
lea eax, [ebx + 1]
mov ecx, ebp
push eax
call fcn.00413540
mov eax, dword [ebp]
lea ecx, [ebx + ebx*2]
mov ebx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
lea ecx, [eax + ecx*4]
mov eax, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
xor esi, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
test esi, esi
je 0x41231f
lea eax, [esi - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x38], 0
jmp 0x41231b
mov ebx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov ecx, dword [ebx]
test ecx, ecx
je 0x412331
add ebx, ecx
mov dword [esp + 0x6c], ebx
jne 0x412060
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x44
ret 0x1c