Function at 0x7c82666b
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push 0x3b4
push 0x7c826b38
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x394], eax
or dword [ebp - 0x240], 0xffffffff
or dword [ebp - 0x248], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x334], ebx
test dword [ebp + 0x1c], 0xfffffff0
jne 0x7c83f92a
mov eax, dword [ebp + 0x20]
test eax, 0xfffff80f
jne 0x7c83f92a
or dword [ebp + 0x1c], eax
mov dword [ebp - 4], ebx
test word [ebp + 0x1c], 0x180
jne 0x7c8370fa
mov dword [ebp - 0x324], 0x80000000
mov esi, dword [ebp + 0x1c]
and esi, 0xfffffffc
or esi, 0xfffffff8
shl esi, 0x1c
mov dword [ebp - 0x324], esi
mov eax, dword [ebp + 0x1c]
and eax, 0x20
shl eax, 0x13
or esi, eax
mov dword [ebp - 0x324], esi
mov eax, dword [ebp - 0x29c]
or eax, 0x8200000
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x24c], esi
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x288], eax
push ebx
push dword [ebp - 0x268]
push 3
push ebx
push dword [ebp - 0x288]
push dword [ebp - 0x24c]
push dword [ebp - 0x294]
call sym.KERNEL32.dll_CreateFileW
mov edi, eax
mov dword [ebp - 0x240], edi
cmp edi, 0xffffffff
je 0x7c82be94
cmp dword [ebp - 0x320], ebx
jne 0x7c82681a
mov dword [ebp - 0x320], 1
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x338]
push eax
push edi
call fcn.7c827515
mov dword [ebp - 0x238], eax
cmp eax, ebx
jl 0x7c83f972
cmp dword [ebp - 0x338], ebx
jne 0x7c83f98f
cmp dword [ebp - 0x31c], ebx
je 0x7c83f9f8
push 5
push 0x18
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x238], eax
cmp eax, ebx
jl 0x7c83fa11
push 4
push 0x28
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x238], eax
cmp eax, ebx
jl 0x7c83fa11
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x2a8]
cmp eax, ebx
je 0x7c826c0e
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x358], ecx
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x354], ecx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0x34c], ebx
mov dword [ebp - 0x348], ebx
mov ecx, dword [ebp - 0x298]
mov dword [ebp - 0x344], ecx
mov ecx, dword [ebp - 0x328]
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x358]
mov dword [ebp - 0x27c], eax
mov edi, 0x1000
mov dword [ebp - 0x384], edi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x3c0], eax
push edi
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x250], eax
cmp eax, ebx
je 0x7c83fa17
push 0x16
lea eax, [edi - 2]
push eax
push dword [ebp - 0x250]
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov dword [ebp - 0x238], eax
cmp eax, ebx
jl 0x7c83fa21
cmp dword [ebp - 0x254], ebx
je 0x7c837198
cmp dword [ebp - 0x238], 0x80000005
je 0x7c8268e1
cmp dword [ebp - 0x238], 0xc0000023
je 0x7c8268e1
cmp dword [ebp - 0x2a8], ebx
je 0x7c826c1f
test byte [ebp + 0x1c], 2
jne 0x7c83fa53
mov eax, dword [ebp - 0x250]
cmp eax, ebx
je 0x7c8269dd
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x28c], eax
mov ecx, dword [eax + 8]
add dword [ebp - 0x2a4], ecx
mov ecx, dword [eax + 0xc]
adc dword [ebp - 0x2a0], ecx
inc dword [ebp - 0x314]
mov ecx, dword [eax]
cmp ecx, ebx
jne 0x7c82bf0e
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x358], eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x354], ecx
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], ecx
dec dword [ebp - 0x314]
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x360], ebx
test byte [ebp + 0x1c], 2
jne 0x7c83fad6
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x2c0]
push eax
push ebx
push dword [ebp - 0x280]
push dword [ebp - 0x24c]
push dword [ebp - 0x240]
push dword [ebp - 0x294]
call fcn.7c826c33
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x26c], ebx
jne 0x7c83fb02
cmp dword [ebp - 0x23c], ebx
je 0x7c826ad8
cmp dword [ebp - 0x250], ebx
je 0x7c826ac6
mov dword [ebp - 0x284], ebx
mov byte [ebp - 0x259], bl
mov byte [ebp - 0x25a], bl
mov edi, dword [ebp - 0x250]
mov dword [ebp - 0x28c], edi
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x238], ebx
push 2
pop esi
cmp dword [edi + 4], esi
jbe 0x7c826abc
cmp word [edi + 0x1a], 0x3a
jne 0x7c83fbce
mov eax, dword [edi]
cmp eax, ebx
jne 0x7c84008b
cmp dword [ebp - 0x23c], ebx
je 0x7c826ad8
test byte [ebp + 0x1c], 2
jne 0x7c83ff6f
mov esi, dword [ebp - 0x248]
cmp dword [ebp - 0x23c], ebx
je 0x7c826b12
push 4
push 0x28
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x258]
push eax
push esi
mov edi, dword [sym.imp.ntdll.dll_NtSetInformationFile]
call edi
mov dword [ebp - 0x238], eax
cmp eax, 0xc0000043
je 0x7c840098
or dword [ebp - 4], 0xffffffff
call fcn.7c826b49
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 0x24
cmp dword [ebp - 0x298], ebx
jne 0x7c826882
jmp 0x7c8268d6
test byte [ebp + 0x1c], 2
je 0x7c8269dd
jmp 0x7c82696b
call fcn.7c8307de
cmp eax, 0x522
je 0x7c83f93b
call fcn.7c8307de
cmp eax, 5
je 0x7c83f93b
mov edi, 0x1000000
call fcn.7c8307de
cmp eax, 5
je 0x7c82beff
call fcn.7c8307de
cmp eax, 0x20
je 0x7c82beff
test byte [ebp - 0x288], 2
jne 0x7c82bee6
or dword [ebp - 0x288], 2
mov dword [ebp - 0x24c], esi
jmp 0x7c82678e
test byte [ebp - 0x266], 0x20
je 0x7c826b12
and byte [ebp - 0x266], 0xdf
jmp 0x7c82677c
test byte [ebp - 0x249], 0x40
jne 0x7c83f958
jmp 0x7c82becb
add eax, ecx
jmp 0x7c82698b
jge 0x7c83715c
and byte [edi - 0x1c009ed0], bl
popfd
mov ah, 0x3e
std
imul ebx, dword [edi + 0x40], 0x8fcc5dbf
sal byte [esi - 0x57d66134], 0x81
out 0x99, eax
iretd
pop esi
aaa
or byte [esi + 0x29], dl
lahf
inc ebp
push ecx
mov al, 0xd5
mov ah, 0x96
out dx, eax
invalid
aas
xchg edx, eax
mov bl, 0x48
pushfd
iretd
imul ebp, dword [esi], 0x27f37246
enter 0x7269, 0x64
lodsb al, byte [esi]
sal bl, 1
and al, 0xe
sbb ebp, edi
xor al, 0xbd
aam 0xc0
adc al, 0xd4
jmp 0x9444630f
leave
dec esp
std
jecxz 0x7c83f956
jno 0x7c83f948
and esp, dword [eax + 0x272dc6a0]
xchg ecx, eax
test byte [ebp + 0x4f], bl
invalid
jb 0x7c83f975
fdivr st(6)
and al, 0x87
and dword [edx + 0x78], 0xffffffde
stosb byte es:[edi], al
cmp al, 0x57
rcr byte [edx + edi*2 - 0x70], 1
pop esp
jp 0x7c83f8dc
sbb eax, dword [esi + 0x7b12b9ae]
adc dword [eax - 0x3640f888], ebp
mov edi, 0x6752c9
and edx, esi
push edx
add byte [bp + di], ah
salc
add dword [ebx + 0x76], edi
cmc
pop edx
ljmp 0xa6a4
nop
adc dword ds:[ebp + edi*4 - 0x2a], esi
je 0x7c83f934
salc
inc ecx
sbb byte [esp + 0x4e], 0x78
jg 0x7c83f949
ret 0xfed1
or dword [edx - 0x7b], ebx
push ecx
sub al, 0x80
dec edx
xchg ecx, eax
int3
mov dword gs:[0x383d3ab5], eax
test edx, 0xd24e542b
dec esi
out dx, al
sub esi, dword [eax - 0x355c73ed]
lcall 0xd793, 0x9fe15008
push ecx
mov ebx, 0xc3682902
jle 0x7c83f9b7
cmp bh, dh
ret 0x542b
add eax, 0x806e18ba
lcall 0x4f8c, 0x262eaac3
rcr bh, 8
sub edx, eax
add bh, byte [edx + eax*4 + 0xa]
inc ebp
js 0x7c83f9bf
mov edx, 0x9a806e18
ret
or byte [ecx], ch
ret 0x7c02
sub cl, bh
mov al, 0x13
add al, 0x8f
pop esp
or bh, cl
test edx, ecx
jae 0x7c83f9d8
cmp al, 0x3b
xchg ebp, eax
out 0x5a, eax
js 0x7c83f994
cmp edx, dword [ebp - 0x4987a519]
sub ecx, edi
add byte [ecx - 0x7e], ah
inc ecx
jns 0x7c83f984
or ecx, edi
cmp eax, 0xc067f04f
mov edx, eax
inc ecx
in eax, 0x19
push dx
fsubr dword [ebx + 0x102b173c]
sub edx, dword [eax]
sub eax, ebx
lcall 0x4b2, 0x201a3f50
and dl, dh
imul edi, esi, 0xbfa65288
invalid
pop ds
mov ebp, 0x7f2b78f0
lodsb al, byte [esi]
xchg bh, al
jne 0x7c83fa18
mov cl, 6
push ds
outsd dx, dword [esi]
loop 0x7c83f9b1
invalid
push ds
js 0x7c83fa81
invalid
int1
sub dl, byte [ebx - 0x2930f3ee]
hlt
enter 0x27c5, 0xffffffffffffffca
aas
out 0xfa, al
inc ebx
sbb al, 0x34
mov ecx, 0xff0287f6
push ss
pop esp
mov al, 0x5d
dec edi
sar byte [esi - 0x3b], 1
add eax, 0xb1614643
invalid
or byte [ebx], cl
test dword [eax + ebp*4], eax
or dword [ecx], eax
mov ch, 0xa1
scasd eax, dword es:[edi]
adc bl, bh
mov ebx, dword [esi + 3]
cmpsd dword [esi], dword es:[edi]
push edi
js 0x7c83fa29
ja 0x7c83fae6
xchg ebp, eax
insd dword es:[edi], dx
pop eax
in eax, 0x16
sub al, byte [ebx + 0x60]
ror byte [ebx + 0x7c859979], 0x85
fisub dword [ecx - 0xa55cbc6]
sub dword [ebx + 0x37163325], ebx
add ch, byte [ebp - 0x4a]
or dword [edi + 0x2d6ceb40], 0x72
ljmp 0xfb94
hlt
invalid
cwde
rcr byte [edx], cl
xlatb
xor bl, byte [edi]
out 0xaf, al
xchg ah, bh
outsb dx, byte [esi]
add eax, 0x890933fe
inc ecx
invalid
add ebx, edi
out dx, eax
or al, 0xcb
std
stc
sar dword [edi - 0x78977cbb], cl
cmp al, 0x90
aas
popfd
loope 0x7c83fc34
salc
daa
jmp 0xbbc23406
invalid
jns 0x7c83fc21
pop ebp
jmp 0x83b39e76
pop es
xor ecx, ebx
cmp byte [ebp - 0x16], bh
out dx, eax
rcl byte [ebx + 0x4e2e48d4], cl
xchg ebx, eax
aam 0x48
dec esi
int 0
jns 0x7c83fc69
int 0xe9
sahf
add al, 0x53
mov ah, 0x87
mov ebp, 0x3ddf9308
mov dh, 0x57
xchg ebp, eax
sbb byte [ecx + 0x6b01dff9], dh
jge 0x7c83fcae
xchg esi, eax
leave
sar ch, 1
mov es, ebp
fadd st(3)
dec esp
xor al, cl
push ss
jp 0x7c83fce3
retf
and bh, byte [esi]
mov esi, 0x9d578f8e
test byte [edi - 0x1e1c1f51], cl
sbb al, 0x7c
jl 0x7c83fc80
pop ds
das
sbb cl, byte [ebx - 0x5c1d7071]
loop 0x7c83fc25
ret
int1
jl 0x7c83fc3b
pop ds
lea ecx, [edi - 0x1a0707d3]
dec eax
jl 0x7c83fd15
sbb dword [edi], ebx
jecxz 0x7c83fc2c
call 0x50aced77
pushfd
cmp cl, bh
and byte [eax], bl
sbb esi, eax
jo 0x7c83fc33
mov ecx, 0x98de1760
sar byte [edi - 0x6220ed45], 1
jns 0x7c83fcdd
pushal
pop ss
ficomp word [eax + 0x12bbbfd0]
fistp word [ebp + 0x44ca2379]
cmp al, 0xcc
aas
mov ecx, 0xc6ad4a0f
push edx
mov esp, dword [edi]
stosb byte es:[edi], al
cmp dword [edx + 0x31], ebp
xchg dword [0x357f394b], eax
pop edi
jns 0x7c83fc8b
retf 0x3c44
sbb al, 0xbc
sbb al, 0xbc
sti
jno 0x7c83fd2f
and al, cl
dec esi
mov eax, dword [0x22c62f36]
inc edi
invalid
push esp
fsubrp st(1)
push esp
das
and eax, 0x6d565312
sbb ebx, dword [edi + ecx*4]
sbb eax, 0xad8427ef
push eax
jge 0x7c83fcd5
xlatb
and bl, byte [ecx - 4]
call 0xeb4bd72a
cmp ecx, dword [eax - 0x70]
retf
neg ecx
invalid
inc edi
mov al, 0x22
ljmp 0x1bb4
or bl, byte [ecx - 0x3d]
invalid
xor edi, ebp
std
pushf
scasb al, byte es:[edi]
mov edi, 0xf36fec76
mov cl, 0xc1
std
invalid
je 0x7c83ffe0
jo 0x7c83ffdb
loop 0x7c83ff90
nop
cld
adc al, 6
ret
pushal
xchg edx, eax
cmp esi, ecx
mov byte [0x95f1009], al
push edx
dec eax
jle 0x7c83ffa2
in al, 8
in eax, dx
je 0x7c83ffdf
js 0x7c83ffea
pop ss
retf 0xa597
sbb ebx, edx
push edx
jg 0x7c83ffd1
sar dh, 1
invalid
or al, 0xa9
inc ebp
insd dword es:[edi], dx
and dword [0xfb52e41f], eax
movsb byte es:[edi], byte [esi]
dec edi
das
xchg ebp, eax
das
out dx, al
dec eax
out dx, al
iretd
dec edx
pop ebx
les esi, [esi + edx*8 - 0x14b9c4b6]
push 0x61
jl 0x7c8400d5
loopne 0x7c840034
loop 0x7c8400b4
lodsd eax, dword [esi]
clc
or byte [ecx + 0x4a7f3361], bh
xchg ebx, eax
or eax, 0x5193ba1d
fnstsw word [edi - 0x24]
jg 0x7c840069
lodsd eax, dword [esi]
out 0x8f, al
cmpsd dword [esi], dword es:[edi]
jno 0x7c84007e
jle 0x7c840015
movsd dword es:[edi], dword [esi]
mov ebx, 0x652c40cf
inc eax
sub al, 0x65
inc ecx
pop ecx
pushal
xchg ebp, eax
inc ebp
int3
push ss
nop
out dx, eax
ret
lodsd eax, dword [esi]
ret