Function at 0x16e18
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea edi, [ebp - 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x44], ax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
lea edi, [ebp - 0x42]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x74], ebx
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push 0x1b51c
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x18
pop esi
push 0x60
lea eax, [ebp - 0x24]
mov dword [ebp - 0x54], eax
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0xc0000000
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], 0x240
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x16feb
push 5
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x16feb
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x68]
push 0xe
mov dword [ebp - 0x18], eax
push 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0x32333435
mov esi, 0x400
push esi
push 1
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x16feb
push ebx
push esi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x32333435
push esi
push 1
call edi
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x16feb
push ebx
push esi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
push dword [ebp + 8]
movsx eax, word [ebp - 0x3a]
push eax
movsx eax, word [ebp - 0x3c]
push eax
movsx eax, word [ebp - 0x3e]
push eax
movsx eax, word [ebp - 0x40]
push eax
movsx eax, word [ebp - 0x42]
push eax
movsx eax, word [ebp - 0x44]
push eax
push 0x1b4fe
push esi
push dword [ebp - 0xc]
call fcn.00016c6e
add esp, 0x28
test eax, eax
jl 0x16feb
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 4]
call fcn.00016c38
test eax, eax
jl 0x16feb
mov eax, dword [ebp - 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x16fcc
push ebx
push ebx
sub eax, edx
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
cmp dword [ebp - 8], ebx
je 0x16ff9
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0xc], ebx
je 0x1700a
push ebx
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 4], ebx
je 0x17015
push ebx
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret