Function at 0x402f6e
Capabilities:
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x144
push ebx
push esi
push edi
lea eax, [ebp + 0x60]
push eax
xor ebx, ebx
lea eax, [ebp + 0x2c]
push eax
mov dword [ebp + 0x58], ebx
mov byte [ebp + 0x6f], bl
mov word [ebp + 0x2e], 0x16
mov word [ebp + 0x2c], 0x16
mov dword [ebp + 0x30], str.SystemRoot_
mov dword [ebp + 0x64], ebx
call fcn.004029ff
test eax, eax
jl 0x403230
movzx eax, word [ebp + 0x60]
mov edi, dword [ebp + 0x64]
shr eax, 1
cmp word [edi + eax*2 - 2], 0x5c
jne 0x402fd0
add word [ebp + 0x60], 0xfffe
movzx eax, word [ebp + 0x60]
shr eax, 1
mov word [edi + eax*2], bx
push edi
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x18
pop esi
push 0x400
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push 7
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0x3c], eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x34]
push eax
push 1
lea eax, [ebp + 0x68]
push eax
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x40], 0x240
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
jl 0x40322b
push ebx
lea eax, [ebp + 0x54]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x403212
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.ntoskrnl.exe_ZwQueryVolumeInformationFile]
test eax, eax
jl 0x403230
mov eax, dword [ebp + 4]
mov edi, dword [ebp + 8]
add esi, 0x78
push esi
mov dword [ebp + 0x5c], eax
lea eax, [ebp - 0xd4]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
lea eax, [ebp - 0xd4]
push eax
mov eax, dword [ebp + 0x54]
push ebx
push ebx
push dword [eax + 4]
push 0x70048
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
cmp eax, ebx
je 0x403230
mov edx, eax
mov eax, dword [ebp + 0x54]
mov ecx, dword [eax + 4]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x4030e0
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x4030e8
cmp eax, ebx
jne 0x403230
push dword [ebp + 0x7c]
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x18
pop esi
push ebx
push ebx
push 0x20
push 1
push 1
push 0x80
lea eax, [ebp + 0x14]
mov dword [ebp + 0x3c], eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x34]
push eax
push 0x100001
lea eax, [ebp + 0x58]
push eax
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x40], 0x40
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x48], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x403230
push 5
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x58]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x403230
push ebx
push edi
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
call sub.ntoskrnl.exe__alldiv
imul edi, dword [ebp + 0x5c]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp + 0x28], edx
xor edx, edx
div edi
mov esi, eax
shl esi, 4
add esi, 0x3ec
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov edi, eax
cmp edi, ebx
je 0x403230
push esi
push ebx
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
push edi
push 8
lea eax, [ebp + 0x1c]
push eax
push 0x90073
lea eax, [ebp + 0x4c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x58]
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
call dword [sym.imp.ntoskrnl.exe_ZwFsControlFile]
test eax, eax
jl 0x403206
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 8]
mov ecx, dword [edi + 0x14]
sbb ecx, dword [edi + 0xc]
push ebx
push dword [ebp + 0x5c]
push ecx
push eax
call sub.ntoskrnl.exe__allmul
mov ecx, dword [ebp + 0x78]
mov dword [ebp - 0x28], edx
mov edx, dword [edi + 0x18]
imul edx, dword [ebp + 0x5c]
add edx, dword [ebp + 0x24]
push ebx
push edi
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x28], eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov byte [ebp + 0x6f], 1
mov ecx, dword [ebp + 0x54]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edi, dword [ebp + 0x64]
cmp edi, ebx
jbe 0x403222
push 0x73737373
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp + 0x68]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, byte [ebp + 0x6f]
jmp 0x403232
xor al, al
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8