Function at 0x40a5f8
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc8
mov byte [esp], dl
mov ebp, eax
mov eax, dword [0x41233c]
cmp byte [eax], 0
je 0x40a628
mov eax, 0x40a878
xor edx, edx
call fcn.004081ec
mov eax, ebp
add eax, 8
mov dl, 1
call fcn.004081ec
jmp 0x40a634
mov eax, 0x40a8a4
xor edx, edx
call fcn.004081ec
push ebp
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 4], eax
push 1
push 7
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x80000000
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_NtOpenFile
mov dword [esp + 0x1c], eax
cmp dword [esp + 4], 0
je 0x40a85d
push 0x9000
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov ebx, eax
mov dword [esp + 0x18], ebx
push 0
push 0
push 0
push 1
push 0x9000
push ebx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtQueryDirectoryFile
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x103
jne 0x40a6e2
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov dword [esp + 0x1c], eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov edi, eax
push 0x200
push 8
call fcn.00408180
push eax
call sub.ntdll.dll_RtlAllocateHeap
mov esi, eax
cmp dword [esp + 0x1c], 0
jne 0x40a81c
mov eax, dword [ebx + 0x3c]
shr eax, 1
push eax
lea eax, [ebx + 0x40]
push eax
push esi
call sub.ntdll.dll_wcsncpy
add esp, 0xc
mov eax, dword [ebx + 0x3c]
shr eax, 1
mov word [esi + eax*2], 0
mov edx, 0x40a8a4
mov eax, esi
call fcn.00408248
test eax, eax
je 0x40a794
mov edx, 0x40a8a8
mov eax, esi
call fcn.00408248
test eax, eax
je 0x40a794
push ebp
push edi
call sub.ntdll.dll_wcscat
add esp, 8
push esi
push edi
call sub.ntdll.dll_wcscat
add esp, 8
test byte [ebx + 0x38], 0x10
je 0x40a78d
cmp byte [esp], 0
je 0x40a794
push 0x40a8b0
push edi
call sub.ntdll.dll_wcscat
add esp, 8
mov dl, byte [esp]
mov eax, edi
call fcn.0040a5f8
jmp 0x40a794
mov eax, edi
call fcn.0040a3f4
cmp dword [ebx], 0
je 0x40a7ae
mov word [edi], 0
mov word [esi], 0
mov eax, ebx
add eax, dword [ebx]
mov ebx, eax
jmp 0x40a715
mov ebx, dword [esp + 0x18]
push 0x9000
mov eax, dword [esp + 0x1c]
push eax
call sub.ntdll.dll_RtlZeroMemory
push 0
push 0
push 0
push 1
push 0x9000
push ebx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtQueryDirectoryFile
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x103
jne 0x40a804
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x14], 0
je 0x40a81c
cmp dword [ebx + 0x3c], 0
je 0x40a81c
cmp dword [esp + 0x1c], 0
je 0x40a715
mov eax, dword [esp + 0x18]
push eax
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebp
call fcn.0040a3f4
push edi
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
push esi
push 1
call fcn.00408180
push eax
call sub.ntdll.dll_RtlFreeHeap
jmp 0x40a870
push ebp
mov eax, dword [esp + 0x20]
push eax
push 0x40a8b4
call sub.ntdll.dll_DbgPrint
add esp, 0xc
add esp, 0x38
pop ebp
pop edi
pop esi
pop ebx
ret