Function at 0x409eb0
Capabilities:
Get file attributes
Print debug messages
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff88
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
mov eax, dword [esp]
push eax
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x20]
lea eax, [esp + 0x40]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 0xc], eax
push 1
push 7
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push 0x80000000
lea eax, [esp + 0x20]
push eax
call sub.ntdll.dll_NtOpenFile
mov edi, eax
cmp dword [esp + 0xc], 0
je 0x40a2d5
push 4
push 0x28
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.ntdll.dll_NtQueryInformationFile
mov edi, eax
test edi, edi
jne 0x40a2c9
mov eax, dword [esp + 4]
push eax
lea eax, [esp + 0x24]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x28]
lea eax, [esp + 0x40]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 0x10], eax
push 0
push 0
push 1
push 3
push 3
mov eax, dword [esp + 0x84]
push eax
push 0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x58]
push eax
push 0x121
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_NtCreateFile
mov edi, eax
cmp dword [esp + 0x10], 0
je 0x40a2c9
push 0x9000
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov esi, eax
mov dword [esp + 0x34], esi
push 0
push 0
push 0
push 1
push 0x9000
push esi
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x34]
push eax
call sub.ntdll.dll_NtQueryDirectoryFile
mov edi, eax
cmp edi, 0x103
jne 0x409ffc
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov edi, eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov ebp, eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov dword [esp + 0x14], eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov ebx, eax
test edi, edi
jne 0x40a24b
mov eax, dword [esi + 0x3c]
shr eax, 1
push eax
lea eax, [esi + 0x40]
push eax
push ebx
call sub.ntdll.dll_wcsncpy
add esp, 0xc
mov eax, dword [esi + 0x3c]
shr eax, 1
mov word [ebx + eax*2], 0
mov edx, 0x40a310
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a314
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a31c
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a350
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a364
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a37c
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a394
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov edx, 0x40a3b0
mov eax, ebx
call fcn.00408248
test eax, eax
je 0x40a1b3
mov eax, dword [esp]
push eax
push ebp
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
push ebp
call sub.ntdll.dll_wcscat
add esp, 8
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_wcscat
add esp, 8
test byte [esi + 0x38], 0x10
je 0x40a191
push 0x40a3cc
push ebp
call sub.ntdll.dll_wcscat
add esp, 8
push 0x40a3cc
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_wcscat
add esp, 8
cmp byte [esp + 8], 0
je 0x40a1b3
mov eax, ebp
call fcn.00408d60
test al, al
je 0x40a17e
mov edx, dword [esp + 0x14]
mov eax, ebp
call fcn.00409a30
xor edi, edi
jmp 0x40a1b3
mov cl, byte [esp + 8]
mov edx, dword [esp + 0x14]
mov eax, ebp
call fcn.00409eb0
mov edi, eax
jmp 0x40a1b3
mov edx, dword [esp + 0x14]
mov eax, ebp
call fcn.00409b84
mov edi, eax
cmp byte [esp + 0x30], 0
jne 0x40a1ad
test edi, edi
je 0x40a1ad
xor eax, eax
jmp 0x40a1af
mov al, 1
mov byte [esp + 0x30], al
cmp edi, 0xc000007f
jne 0x40a1c2
mov byte [esp + 0x31], 1
jmp 0x40a1e6
cmp dword [esi], 0
je 0x40a1e6
mov word [ebp], 0
mov eax, dword [esp + 0x14]
mov word [eax], 0
mov word [ebx], 0
mov eax, esi
add eax, dword [esi]
mov esi, eax
jmp 0x40a042
mov esi, dword [esp + 0x34]
push 0x9000
mov eax, dword [esp + 0x38]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0
push 0
push 0
push 1
push 0x9000
push esi
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x34]
push eax
call sub.ntdll.dll_NtQueryDirectoryFile
mov edi, eax
cmp edi, 0x103
jne 0x40a236
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov edi, eax
cmp dword [esp + 0x2c], 0
je 0x40a24b
cmp dword [esi + 0x3c], 0
je 0x40a24b
test edi, edi
je 0x40a042
push ebp
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [esp + 0x14]
push eax
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
push ebx
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
cmp byte [esp + 0x31], 0
jne 0x40a2ad
push 4
push 0x28
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0x103
jne 0x40a2ad
push 0
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov eax, dword [esp + 0x34]
push eax
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
mov eax, dword [esp + 0xc]
push eax
call sub.ntdll.dll_NtClose
jmp 0x40a2e7
mov eax, dword [esp]
push eax
push edi
push 0x40a3d0
call sub.ntdll.dll_DbgPrint
add esp, 0xc
cmp byte [esp + 0x30], 0
je 0x40a2fa
mov eax, 0x40a310
xor edx, edx
call fcn.004081ec
cmp byte [esp + 0x31], 0
je 0x40a306
mov edi, 0xc000007f
mov eax, edi
add esp, 0x78
pop ebp
pop edi
pop esi
pop ebx
ret