Function at 0x409b84
Capabilities:
Get file attributes
Print debug messages
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff78
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00408b88
push edx
push eax
mov eax, esi
call fcn.00408b88
cmp edx, dword [esp + 4]
jne 0x409bab
cmp eax, dword [esp]
pop edx
pop eax
jne 0x409bb9
mov esi, 1
jmp 0x409e33
mov eax, dword [0x41233c]
cmp byte [eax], 0
je 0x409bdb
mov eax, 0x409e40
xor edx, edx
call fcn.004081ec
mov eax, ebx
add eax, 8
mov dl, 1
call fcn.004081ec
push ebx
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x34]
mov ecx, 0x40
call fcn.00407d20
push esi
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x4c]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 0x20], eax
push 0x20
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push 0x120089
lea eax, [esp + 0x34]
push eax
call sub.ntdll.dll_NtOpenFile
mov esi, eax
mov byte [esp + 0x28], 0
xor ebx, ebx
cmp dword [esp + 0x20], 0
je 0x409e25
push 4
push 0x28
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
push eax
call sub.ntdll.dll_NtQueryInformationFile
mov esi, eax
test esi, esi
jne 0x409e0b
xor eax, eax
mov dword [esp + 0x24], eax
push 0
push 0
push 0x20
push 5
push 7
mov eax, dword [esp + 0x94]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x64]
push eax
push 0x1f01ff
lea eax, [esp + 0x4c]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
cmp dword [esp + 0x24], 0
je 0x409e19
push 0x20000
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov edi, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
push 0
lea eax, [esp + 0x1c]
push eax
push 0x20000
push edi
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x40]
push eax
call sub.ntdll.dll_NtReadFile
mov esi, eax
cmp esi, 0x103
jne 0x409d16
push 0
push 0
mov eax, dword [esp + 0x28]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov esi, eax
test esi, esi
jne 0x409d92
mov eax, dword [esp + 0x14]
mov ebp, eax
test ebp, ebp
je 0x409d9c
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x44]
push eax
call sub.ntdll.dll_NtWriteFile
mov esi, eax
cmp esi, 0x103
jne 0x409d5c
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov esi, eax
cmp esi, 0xc000007f
jne 0x409d68
mov bl, 1
jmp 0x409d9c
test esi, esi
jne 0x409d72
cmp ebp, dword [esp + 0x14]
je 0x409d79
mov byte [esp + 0x28], 1
jmp 0x409d9c
mov eax, ebp
xor edx, edx
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jmp 0x409cda
cmp esi, 0xc0000011
jne 0x409d9c
xor esi, esi
mov al, byte [esp + 0x28]
or al, bl
jne 0x409dd1
push 4
push 0x28
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x34]
push eax
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0x103
jne 0x409dd1
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
test bl, bl
je 0x409ddc
mov esi, 0xc000007f
jmp 0x409de8
cmp byte [esp + 0x28], 0
je 0x409de8
mov esi, 0xc000003e
push edi
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [esp + 0x24]
call fcn.00408c28
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtClose
jmp 0x409e19
push esi
push 0x409e6c
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtClose
jmp 0x409e33
push esi
push 0x409e98
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, esi
add esp, 0x88
pop ebp
pop edi
pop esi
pop ebx
ret