Function at 0x6adbf5c0
Capabilities:
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
or edx, 0x100000
lea ebp, [eax + 0x190]
push edi
push esi
lea esi, [eax + 0x1a8]
push ebx
mov ebx, eax
sub esp, 0x8c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x47], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], 0x204040
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.ntdll.dll_NtCreateFile
sub esp, 0x2c
test eax, eax
js 0x6adbf658
xor eax, eax
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [esp + 0x47]
cmp eax, 0xc0000035
sete cl
xor edx, 1
and cl, dl
mov byte [esp + 0x47], cl
je 0x6adbf8de
mov ecx, 0x1040
mov dword [esp + 0x48], ebx
mov edi, 0x10000
mov ebx, esi
mov dword [esp + 0x4c], 2
mov esi, ecx
mov eax, esi
mov dword [esp + 0x28], 0
or eax, 0x204000
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov eax, edi
or eax, 0x100000
mov dword [esp + 0x1c], 1
mov dword [esp + 4], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.ntdll.dll_NtCreateFile
sub esp, 0x2c
cmp eax, 0xc0000121
je 0x6adbf7a0
mov ecx, esi
mov esi, ebx
mov ebx, dword [esp + 0x48]
test eax, eax
js 0x6adbf8d1
mov eax, ecx
mov edx, dword [esp + 0x54]
and eax, 0x1000
je 0x6adbf83b
mov dword [esp], edx
call sub.ntdll.dll_NtClose
sub esp, 4
test eax, eax
jns 0x6adbf5eb
mov edx, dword [ebx + 8]
mov edi, eax
mov eax, dword [ebx + 0x1b0]
xor esi, esi
mov dword [esp + 8], edx
mov edx, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6adc7880
mov ecx, 0x5c
mov word [eax], cx
lea edx, [eax + 2]
movzx eax, word [ebx + 0x188]
shr ax, 1
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18c]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.6adc7880
mov word [eax], si
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 4], str.Error_closing___ls__after_setting_delete_on_close_disposition
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6add8103
mov eax, 0x2f
jmp 0x6adbf648
cmp dword [esp + 0x4c], 1
jne 0x6adbf8ba
mov ebx, dword [esp + 0x48]
mov ecx, edi
mov edx, eax
mov edi, esi
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 0x40], edx
mov ebp, 0x5c
mov dword [esp + 0x3c], ecx
mov dword [esp + 8], esi
mov esi, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.6adc7880
mov word [eax], bp
lea esi, [eax + 2]
movzx eax, word [ebx + 0x188]
shr ax, 1
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18c]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.6adc7880
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov word [eax], dx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ecx
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 4], str.Cant_open___ls__for_deletion__perms_x__flags_x_
mov dword [esp + 8], eax
mov dword [esp], edx
call fcn.6add8103
jmp 0x6adbf795
lea edi, [esp + 0x58]
mov ecx, 0xa
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x28
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
mov dword [esp + 0x78], pe_nt_image_headers32
call sub.ntdll.dll_NtSetInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbf934
lea eax, [esp + 0x53]
mov dword [esp + 0x10], 0xd
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov byte [esp + 0x53], 1
call sub.ntdll.dll_NtSetInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbf900
mov edx, dword [esp + 0x54]
jmp 0x6adbf717
mov dword [esp + 0x4c], 1
mov esi, 0x40
mov edi, 0x10100
jmp 0x6adbf68e
mov esi, ecx
mov edx, eax
mov ecx, edi
mov edi, esi
jmp 0x6adbf7b5
mov edi, eax
mov eax, ebx
call fcn.6adbcf80
mov dword [esp + 4], str.Cant_create___ls_
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6add8103
jmp 0x6adbf795
mov edi, eax
mov eax, ebx
call fcn.6adbcf80
mov dword [esp + 4], str.Cant_set_delete_on_close_disposition_on___ls_
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6add8103
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
mov eax, 0x39
push edi
jmp 0x6adbf648
mov edi, eax
mov eax, ebx
call fcn.6adbcf80
mov dword [esp + 4], str.Cant_reset_attributes_of___ls__to_prepare_for_deletion
mov dword [esp + 8], eax
jmp 0x6adbf915