Function at 0x10033f00
Capabilities:
Get file attributes
Query environment variable
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
mov dword [ebp - 0x54], ecx
xor ecx, ecx
mov dword [ebp - 0x74], eax
mov esi, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x6c], edi
cmp eax, 0xffffffff
je 0x1003427e
test edi, edi
je 0x1003427e
mov edx, 0x10006a2c
mov ecx, edi
call fcn.1007fe9e
test eax, eax
jne 0x10034141
mov edx, 0x10006a50
mov ecx, edi
call fcn.1007fe9e
test eax, eax
jne 0x10034141
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x1003404e
call fcn.100310f1
mov edx, 0x40000000
mov edi, eax
call fcn.1001a46f
test eax, eax
jne 0x1003404e
test edi, edi
je 0x1003404e
mov eax, dword [edi]
mov dword [ebp - 0x58], eax
test eax, eax
je 0x1003404e
mov eax, dword [0x10086120]
cmp eax, 0xffffffff
jne 0x10034015
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x10006a88
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1003400a
cmp eax, 0x10
ja 0x1003400a
lea ecx, [ebp - 0x24]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10033fd8
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push 0x1000597c
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x1003400a
mov dword [0x10086120], 1
jmp 0x10034025
xor ecx, ecx
mov eax, ecx
mov dword [0x10086120], eax
jmp 0x10034017
xor ecx, ecx
cmp eax, 1
je 0x10034025
test ebx, ebx
je 0x1003404e
cmp word [ebx], cx
je 0x1003404e
mov edx, dword [ebp - 0x58]
call fcn.10033d0b
test eax, eax
jns 0x10034041
push eax
push 0x296
mov ecx, 0x10006ac8
call fcn.1003a254
mov ecx, dword [ebp - 0x54]
mov edx, 0x40000000
call fcn.1001538a
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0xa
pop ecx
lea edi, [ebp - 0x50]
xor edx, edx
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x5c], edx
push edi
push edi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x58], edx
push eax
push dword [ebp - 0x6c]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x100341ac
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x1c], 0x18
push edi
push edi
push 0x4020
push 1
push 7
push 0x80
lea eax, [ebp - 0x64]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x5c]
push edi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x58], edi
push eax
push 0x100080
lea eax, [ebp - 0x54]
mov dword [ebp - 0x18], edi
push eax
mov dword [ebp - 0x10], 0x40
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x100341ac
push 0x28
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [0x10086120], 1
mov edi, eax
jne 0x10034148
push 4
push 0x28
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x10034148
test byte [ebp - 0x30], 0x10
je 0x10034148
test edi, edi
je 0x10034138
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
jmp 0x10034283
test ebx, ebx
je 0x1003418a
push 0x15
push 0x28
push edi
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1003418a
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x70]
jne 0x10034167
sub ecx, edx
lea eax, [edi + 4]
sar ecx, 1
push ecx
push eax
push ebx
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x10034123
test edi, edi
je 0x100341a1
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100341a3
xor edi, edi
push dword [ebp - 0x54]
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x100341ba
push 8
mov ebx, 0x10004474
pop eax
jmp 0x100341d6
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x100341bf
sub ecx, edx
sar ecx, 1
add ecx, ecx
mov dword [ebp - 0x68], ecx
lea eax, [ecx + 0xa]
push eax
push 8
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10034225
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10034203
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1003421c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10034223
movzx esi, si
or esi, 0x80070000
jmp 0x10034221
mov esi, 0x80004005
test esi, esi
js 0x1003427a
mov eax, dword [ebp - 0x68]
mov dword [edi], eax
test eax, eax
je 0x1003423e
shr eax, 1
lea ecx, [edi + 4]
push ebx
lea edx, [eax + 1]
call fcn.10015ac7
mov esi, eax
test esi, esi
js 0x10034269
push 0x28
push dword [ebp - 0x54]
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push edi
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x10034269
mov esi, eax
or esi, 0x10000000
push edi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x10034283
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 8