Function at 0x1000b5e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor edi, edi
mov eax, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b600
sub eax, edx
mov esi, eax
cmp esi, 1
jae 0x1000b61a
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
lea eax, [esi + 0xa]
push ebp
push eax
call fcn.1000bbc2
mov ebp, eax
add esp, 4
cmp ebp, edi
mov dword [esp + 0x10], ebp
je 0x1000b64f
add esi, 0xc8
push esi
call fcn.1000bbc2
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x1000b65a
push ebp
call fcn.1000b9ec
add esp, 4
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
call fcn.100058c0
mov edi, eax
test edi, edi
jne 0x1000b67f
push ebp
call fcn.1000b9ec
push esi
call fcn.1000b9ec
add esp, 8
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x30]
push ebp
push edi
call fcn.100058e0
add esp, 8
test eax, eax
jne 0x1000b6b5
push edi
call fcn.10005860
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1000b9ec
push esi
call fcn.1000b9ec
add esp, 0xc
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
or eax, 4
or edx, 1
mov dword [edi], eax
mov dword [edi + 4], edx
mov eax, dword [ebp + 4]
test eax, 0x100000
je 0x1000b777
test al, 0x40
jne 0x1000b777
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000b704
push ebx
push str.Error_retrieving_NTFS_compression_attribute_for_file__s.
push esi
call fcn.1000ba5d
mov edx, dword [esp + 0x38]
push edi
push esi
push edx
call sym.logtext.dll_LogTextEx
add esp, 0x18
jmp 0x1000b70d
test ah, 8
jne 0x1000b91c
test dword [ebp], 0x10000
jne 0x1000b731
push ebx
push str.Initializing_NTFS_compression_for_file__s...
push esi
call fcn.1000ba5d
mov eax, dword [esp + 0x38]
push edi
push esi
push eax
call sym.logtext.dll_LogTextEx
add esp, 0x18
push ebx
call fcn.10001250
mov ecx, dword [ebp]
add esp, 4
test ecx, 0x10000
jne 0x1000b91c
test eax, eax
push ebx
je 0x1000b755
push str.NTFS_compression_for_file__s_initialized.
jmp 0x1000b75a
push str.Error_initializing_NTFS_compression_for_file__s.
push esi
call fcn.1000ba5d
mov ecx, dword [esp + 0x38]
add esp, 0xc
push edi
push esi
push ecx
call sym.logtext.dll_LogTextEx
add esp, 0xc
jmp 0x1000b91c
mov eax, dword [edi + 0x3c]
test eax, eax
jne 0x1000b98b
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x1000b98b
test dword [ebp], 0x10000
mov ebp, dword [esp + 0x2c]
jne 0x1000b7b1
push ebx
push str.Compressing_file__s...
push esi
call fcn.1000ba5d
push edi
push esi
push ebp
call sym.logtext.dll_LogTextEx
add esp, 0x18
push 0x10018354
push ebx
call fcn.1000d851
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1000b96e
push ebx
call fcn.100096d0
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x1000b8e7
inc eax
push eax
call fcn.1000bbc2
mov ecx, dword [esp + 0x18]
add esp, 4
test eax, eax
mov dword [esp + 0x18], eax
mov byte [eax + ecx], 0
je 0x1000b83c
push ebx
push ecx
push 1
push eax
call fcn.1000cfc5
mov ecx, dword [esp + 0x24]
add esp, 0x10
cmp eax, ecx
je 0x1000b83c
mov edx, dword [esp + 0x30]
test dword [edx], 0x10000
jne 0x1000b83c
push ebx
call fcn.10004ca0
mov eax, dword [esp + 0x14]
push eax
push 0x5501a5e8
push ebp
rol dword [ebx + ebx*8 + 0x3741988], cl
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1000b919
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000b92a
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000b934
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000b90f
xor eax, eax
pop edi
pop esi
ret
invalid
call fcn.1000b8f7
pop ecx
test eax, eax
pop ecx
je fcn.1000ba4a
push edi
push esi
push ebx
call fcn.1000b937
add esp, 0xc
call fcn.1000b8b7
add dword [ecx + 0x1e], 0x78768b7e
test esi, esi
je fcn.1000ba4a
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.1000b8b7
enter 0xffffffffffffc670, 0x7f
mov eax, dword [esi + 0x20]
add eax, edi
mov edi, dword [esi + 0x1c]
add edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, ax
je 0x1000ba59
and dword [ebp - 4], 0
xor ebx, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
cmp dword [ebp + 0xc], eax
jne 0x1000ba79
call fcn.1000b8b7
int1
xchg ebx, eax
loop 0x1000bae3
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x1000ba88
mov eax, dword [esi + 0x14]
add dword [ebp - 0x10], 4
inc ebx
dec eax
cmp ebx, eax
jbe 0x1000ba5e
jmp fcn.1000ba4a
mov eax, dword [edi + ebx*4]
shl eax, 6
add eax, dword [ebp + 8]
jmp fcn.1000ba4c
clc
call fcn.1000b8b7
jg 0x1000bb20
adc dl, byte [esi - 0x75]
inc edi
push es
cmp ax, bx
jbe 0x1000bb11
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1000bb0b
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1000bafc
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1000b8b7
push edi
mov al, 0xf1
xchg edi, eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000b8c7
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1000b87c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000bba5
lodsb al, byte [esi]
loopne 0x1000bae9
inc ebp
lodsd eax, dword [esi]
ret 0x45c6
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
lds edi, [edx - 0x3a]
inc ebp
invalid
popal
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f