Function at 0x17062a0
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor ebx, ebx
xor esi, esi
push ebx
inc esi
push 0x4004
mov dword [ebp - 0xc], esi
call sub.zenwinx.dll_winx_heap_alloc_ex
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
jne 0x17062e0
push 0x1701e98
call sub.zenwinx.dll_winx_dbg_print
add dword [0x170c128], esi
pop ecx
adc dword [0x170c12c], ebx
jmp 0x170630f
push ebx
push 0x212
call sub.zenwinx.dll_winx_heap_alloc_ex
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1706317
push 0x1701e98
call sub.zenwinx.dll_winx_dbg_print
add dword [0x170c128], esi
pop ecx
push edi
adc dword [0x170c12c], ebx
call sub.zenwinx.dll_winx_heap_free
push 0xfffffffffffffffc
pop eax
jmp 0x1706542
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push ebx
push ebx
push 0x4021
push esi
push 3
push ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], eax
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call sub.ntdll.dll_NtCreateFile
cmp eax, ebx
je 0x170637e
push eax
push dword [ebp + 8]
push 0x1701e74
call sub.zenwinx.dll_winx_dbg_print
add esp, 0xc
mov dword [ebp - 8], ebx
or ebx, 0xffffffff
jmp 0x1706532
mov esi, edi
mov dword [edi + 4], ebx
mov dword [edi], ebx
call fcn.01704502
test al, al
jne 0x1706527
jmp 0x1706397
mov edi, dword [ebp - 0x10]
mov eax, dword [esi]
cmp eax, ebx
je 0x17063a1
add esi, eax
jmp 0x17063d4
push ebx
push ebx
push ebx
push 3
lea esi, [edi + 4]
push 0x4000
xor eax, eax
push esi
mov dword [esi + 4], ebx
mov ecx, 0x1000
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call sub.ntdll.dll_NtQueryDirectoryFile
test eax, eax
jne 0x1706527
mov eax, dword [esi + 0x3c]
shr eax, 1
cmp ax, 0x103
ja 0x1706506
movzx eax, ax
push eax
mov dword [ebp - 0x14], eax
lea eax, [esi + 0x5e]
push eax
mov edi, 0x170c160
push edi
call dword [sym.imp.ntdll.dll_wcsncpy]
mov eax, dword [ebp - 0x14]
push 0x1701e70
push edi
mov word [eax*2 + 0x170c160], bx
call dword [sym.imp.ntdll.dll_wcscmp]
add esp, 0x14
test eax, eax
je 0x1706506
push 0x1701e68
push edi
call dword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x1706506
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_wcslen]
pop ecx
mov ecx, eax
mov eax, dword [ebp + 8]
cmp word [eax + ecx*2 - 2], 0x5c
push edi
push eax
jne 0x1706461
mov edi, dword [ebp - 4]
push 0x1701e5c
push 0x109
push edi
call dword [sym.imp.ntdll.dll__snwprintf]
jmp 0x1706477
push 0x1701e50
push 0x109
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll__snwprintf]
mov edi, dword [ebp - 4]
mov word [edi + 0x210], bx
mov eax, dword [esi + 0x38]
add esp, 0x14
test ah, 4
je 0x1706498
push edi
push 0x1701e34
call sub.zenwinx.dll_winx_dbg_print
pop ecx
pop ecx
jmp 0x1706506
test ah, 2
je 0x17064aa
push edi
push 0x1701e1c
call sub.zenwinx.dll_winx_dbg_print
pop ecx
pop ecx
test byte [esi + 0x39], 0x40
je 0x17064c6
cmp dword [0x170c090], 2
jb 0x17064c6
push edi
push 0x1701e00
call sub.zenwinx.dll_winx_dbg_print
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.01705f9d
test al, al
jne 0x1706506
test byte [esi + 0x38], 0x10
je 0x17064e4
push dword [ebp - 4]
call fcn.017062a0
jmp 0x17064ec
mov eax, dword [esi + 0x28]
or eax, dword [esi + 0x2c]
je 0x1706506
cmp byte [0x170c094], bl
je 0x17064f9
cmp dword [ebp - 0xc], ebx
je 0x1706506
push esi
push dword [ebp - 4]
call fcn.017060c3
test al, al
je 0x1706515
call fcn.01704502
test al, al
je 0x1706394
jmp 0x1706527
push dword [ebp - 4]
push 0x1701de8
call sub.zenwinx.dll_winx_dbg_print
pop ecx
pop ecx
push 0xfffffffffffffffc
pop ebx
push dword [ebp - 8]
call sub.ntdll.dll_NtClose
mov edi, dword [ebp - 0x10]
push edi
call sub.zenwinx.dll_winx_heap_free
push dword [ebp - 4]
call sub.zenwinx.dll_winx_heap_free
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4