Function at 0x5c91145b
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push 5
push 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
xor edx, edx
cmp eax, edx
jl 0x5c911631
mov ecx, dword [ebp - 0x4c]
cmp ecx, edx
mov eax, dword [ebp - 0x50]
push ebx
push esi
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov ebx, 0x20000
jl 0x5c9114be
jg 0x5c9114a1
cmp eax, ebx
jbe 0x5c9114be
sub eax, ebx
push edx
sbb ecx, edx
mov esi, ecx
push ebx
mov edi, eax
push esi
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call fcn.5c913030
sub edi, eax
sbb esi, edx
jmp 0x5c9114c8
xor edi, edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
xor esi, esi
or eax, 0xffffffff
sub eax, dword [ebp - 0x14]
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0xa0
lea eax, [ebp - 0x124]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x7fffffff
sbb ecx, dword [ebp - 0x10]
push 0x940cf
push dword [ebp + 0xc]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x5c911629
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x5c911534
shr eax, 4
dec eax
shl eax, 4
mov edi, dword [ebp + eax - 0x11c]
add edi, dword [ebp + eax - 0x124]
mov esi, dword [ebp + eax - 0x118]
adc esi, dword [ebp + eax - 0x120]
push 4
push 0x28
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
xor ecx, ecx
mov edx, eax
add edx, dword [ebp - 0x50]
adc ecx, dword [ebp - 0x4c]
add edx, ebx
adc ecx, 0
mov dword [ebp - 0x28], ecx
xor ecx, ecx
push ecx
push eax
mov eax, dword [ebp - 0x28]
push eax
push edx
call fcn.5c912f80
xor ecx, ecx
push ecx
mov ecx, dword [ebp + 8]
push dword [ecx + 0x20]
push edx
push eax
call fcn.5c912f40
push 0
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x1c], eax
jne 0x5c911629
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5c911629
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
push dword [eax + 0x28]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.ntdll.dll_NtSetInformationFile]
push 0x14
push 8
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call ebx
cmp esi, dword [ebp - 0x4c]
jg 0x5c911613
jl 0x5c9115e5
cmp edi, dword [ebp - 0x50]
jae 0x5c911613
or dword [ebp - 0x38], 0xffffffff
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push 0x10
lea eax, [ebp - 0x40]
push eax
push 0x980c8
push dword [ebp + 0xc]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 0x7fffffff
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 4
push 0x28
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call ebx
jmp 0x5c91162e
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
leave
ret 8