Function at 0x40b000
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x10], esp
call fcn.0040dc60
mov eax, dword [ebp + 8]
push str..
push eax
lea ecx, [ebp - 0x1c]
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
call fcn.00405990
add esp, 0xc
mov eax, dword [eax]
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.0040dcf3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b073
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [ebp - 0x48]
call fcn.0040da2a
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x20], eax
call fcn.0040dc27
test eax, eax
jne 0x40b7ab
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040de7c
mov edx, dword [ebp - 0x48]
push 0x10
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call dword [edx + 0x38]
test eax, eax
lea ecx, [ebp - 0x48]
je 0x40b3fa
lea eax, [ebp - 0x18]
push eax
call fcn.0040df1b
mov edx, dword [ebp - 0x18]
mov eax, dword [edx - 4]
mov esi, dword [edx - 0xc]
mov ecx, 1
sub ecx, eax
mov eax, dword [edx - 8]
sub eax, esi
or eax, ecx
mov byte [ebp - 4], 3
jge 0x40b0e6
push esi
lea ecx, [ebp - 0x18]
call fcn.00402010
mov edx, dword [ebp - 0x18]
push edx
call fcn.00410444
add esp, 4
cmp esi, ebx
jl 0x40b3f0
mov eax, dword [ebp - 0x18]
cmp esi, dword [eax - 8]
jg 0x40b3f0
lea edx, [ebp - 0x18]
mov dword [eax - 0xc], esi
mov ecx, dword [ebp - 0x18]
push edx
push 0x4362e8
mov byte [esi + ecx], bl
call fcn.00405880
add esp, 8
test eax, eax
je 0x40b375
mov eax, dword [0x438878]
mov eax, dword [eax + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b151
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b151
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b179
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b172
or eax, 4
push ebx
push eax
call fcn.0040f73e
test byte [0x4367c0], 1
jne 0x40b19e
mov ecx, dword [0x4367c0]
or ecx, 1
push 0xfffffffffffffff5
mov dword [0x4367c0], ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x43679c], eax
push pe_nt_image_headers32
push 0xa
mov ecx, 0x43679c
call fcn.00405c10
push 0xa
mov ecx, 0x438878
call fcn.004053e0
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b1e8
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b1e8
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b210
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b209
or eax, 4
push ebx
push eax
call fcn.0040f73e
mov ecx, dword [ebp - 0x14]
push ecx
push str.skip
push 0x438878
call fcn.00403c30
add esp, 8
push eax
call fcn.00403c30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004053e0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov cl, byte [eax + esi + 8]
add eax, esi
xor edi, edi
test cl, 6
jne 0x40b260
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b260
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x40b281
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, edi
cmp edx, ebx
jne 0x40b27a
or eax, 4
push ebx
push eax
call fcn.0040f73e
push 0xa
mov ecx, 0x438878
call fcn.004053e0
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b2ba
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b2ba
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b2e2
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b2db
or eax, 4
push ebx
push eax
call fcn.0040f73e
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b30f
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b30f
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b337
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b330
or eax, 4
push ebx
push eax
call fcn.0040f73e
test byte [0x4367c0], 1
jne 0x40b35c
mov ecx, dword [0x4367c0]
or ecx, 1
push 0xfffffffffffffff5
mov dword [0x4367c0], ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x43679c], eax
push pe_nt_image_headers32
push 0xf
mov ecx, 0x43679c
call fcn.00405c10
mov eax, dword [ebp - 0x18]
jmp 0x40b76d
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040b000
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 2
jne 0x40b771
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b3ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b3ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.0040dc84
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401240
lea eax, [ebp - 0x1c]
push eax
call fcn.0040df1b
lea ecx, [ebp - 0x1c]
push ecx
push 0x436608
mov byte [ebp - 4], 4
call fcn.00405880
add esp, 8
test eax, eax
je 0x40b66e
mov edx, dword [0x438878]
mov eax, dword [edx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b44d
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b44d
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b475
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b46e
or eax, 4
push ebx
push eax
call fcn.0040f73e
test byte [0x4367c0], 1
jne 0x40b49a
mov ecx, dword [0x4367c0]
or ecx, 1
push 0xfffffffffffffff5
mov dword [0x4367c0], ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x43679c], eax
push pe_nt_image_headers32
push 0xa
mov ecx, 0x43679c
call fcn.00405c10
push 0xa
mov ecx, 0x438878
call fcn.004053e0
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b4e4
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b4e4
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b50c
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b505
or eax, 4
push ebx
push eax
call fcn.0040f73e
mov ecx, dword [ebp - 0x1c]
push ecx
push str.ignore_file
push 0x438878
call fcn.00403c30
add esp, 8
push eax
call fcn.00403c30
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004053e0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov cl, byte [eax + esi + 8]
add eax, esi
xor edi, edi
test cl, 6
jne 0x40b55c
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b55c
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
cmp edi, ebx
je 0x40b57d
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, edi
cmp edx, ebx
jne 0x40b576
or eax, 4
push ebx
push eax
call fcn.0040f73e
push 0xa
mov ecx, 0x438878
call fcn.004053e0
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b5b6
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b5b6
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b5de
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b5d7
or eax, 4
push ebx
push eax
call fcn.0040f73e
mov ecx, dword [0x438878]
mov eax, dword [ecx + 4]
mov cl, byte [eax + 0x438880]
xor esi, esi
test cl, 6
jne 0x40b60b
mov eax, dword [eax + 0x4388a0]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40b60b
mov esi, 4
mov eax, dword [0x438878]
mov ecx, dword [eax + 4]
add ecx, 0x438878
cmp esi, ebx
je 0x40b633
mov eax, dword [ecx + 8]
mov edx, dword [ecx + 0x28]
or eax, esi
cmp edx, ebx
jne 0x40b62c
or eax, 4
push ebx
push eax
call fcn.0040f73e
test byte [0x4367c0], 1
jne 0x40b658
mov ecx, dword [0x4367c0]
or ecx, 1
push 0xfffffffffffffff5
mov dword [0x4367c0], ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [0x43679c], eax
push pe_nt_image_headers32
push 0xf
mov ecx, 0x43679c
call fcn.00405c10
jmp 0x40b76a
push ebx
call fcn.00410a26
mov dword [ebp - 0x28], eax
add esp, 4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 5
call fcn.0040dbc3
jmp 0x40b6f7
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 4
call fcn.0040da64
mov edx, dword [ebp - 0x14]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40b736
mov ecx, dword [ebp - 0x14]
push ecx
push str.______
call fcn.004119d6
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
push esi
push ecx
call fcn.0040ab80
add esp, 0x10
test eax, eax
jne 0x40b76a
mov edx, dword [ebp - 0x14]
push edx
push 0x42b69c
call fcn.004119d6
push str.PAUSE
call fcn.00411a3c
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b78b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b7ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp dword [ebp - 0x20], ebx
jne 0x40b073
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.0040dc84
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret