Function at 0x6adba630
Capabilities:
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
or edx, 0x100000
lea ebp, [eax + 0x190]
push edi
push esi
lea esi, [eax + 0x1a8]
push ebx
mov ebx, eax
sub esp, 0x8c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x47], 0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], 0x204040
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 7
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.ntdll.dll_NtCreateFile
sub esp, 0x2c
test eax, eax
js 0x6adba6c8
xor eax, eax
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, byte [esp + 0x47]
cmp eax, 0xc0000035
sete cl
xor edx, 1
and cl, dl
mov byte [esp + 0x47], cl
je 0x6adba93f
mov dword [esp + 0x4c], 2
mov edi, 0x1040
mov dword [esp + 0x48], 0x10000
mov eax, edi
mov dword [esp + 0x28], 0
or eax, 0x204000
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], 1
or eax, 0x100000
mov dword [esp + 0x18], 7
mov dword [esp + 4], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.ntdll.dll_NtCreateFile
sub esp, 0x2c
mov edx, eax
cmp eax, 0xc0000121
je 0x6adba810
test eax, eax
js 0x6adba831
mov eax, edi
mov edx, dword [esp + 0x54]
and eax, 0x1000
je 0x6adba8c0
mov dword [esp], edx
call sub.ntdll.dll_NtClose
sub esp, 4
test eax, eax
jns 0x6adba65b
mov edx, dword [ebx + 8]
mov edi, eax
mov eax, dword [ebx + 0x1b0]
xor esi, esi
mov dword [esp + 8], edx
mov edx, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.6adf6040
mov ecx, 0x5c
mov word [eax], cx
lea edx, [eax + 2]
movzx eax, word [ebx + 0x188]
mov dword [esp], edx
shr ax, 1
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18c]
mov dword [esp + 4], eax
call fcn.6adf6040
mov word [eax], si
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 4], str.Error_closing___ls__after_setting_delete_on_close_disposition
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6ae0df7d
mov eax, 0x2f
jmp 0x6adba6b8
cmp dword [esp + 0x4c], 1
je 0x6adba831
mov dword [esp + 0x4c], 1
mov edi, 0x40
mov dword [esp + 0x48], 0x10100
jmp 0x6adba6f9
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 0x40], edx
mov ebp, 0x5c
mov dword [esp + 0x3c], edi
mov dword [esp + 8], esi
mov esi, dword [ebx + 4]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.6adf6040
mov word [eax], bp
lea esi, [eax + 2]
movzx eax, word [ebx + 0x188]
mov dword [esp], esi
shr ax, 1
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18c]
mov dword [esp + 4], eax
call fcn.6adf6040
xor edx, edx
mov ecx, dword [esp + 0x3c]
mov word [eax], dx
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x1b0]
mov dword [esp + 4], str.Cant_open___ls__for_deletion__perms_x__flags_x_
mov dword [esp + 8], eax
mov dword [esp], edx
call fcn.6ae0df7d
mov eax, 0x2f
jmp 0x6adba6b8
lea edi, [esp + 0x58]
mov ecx, 0xa
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x28
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edx
mov dword [esp + 0x78], pe_nt_image_headers32
call sub.ntdll.dll_NtSetInformationFile
sub esp, 0x14
test eax, eax
js 0x6adba99a
lea eax, [esp + 0x53]
mov dword [esp + 0x10], 0xd
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 1
mov dword [esp + 4], esi
mov dword [esp], eax
mov byte [esp + 0x53], 1
call sub.ntdll.dll_NtSetInformationFile
sub esp, 0x14
test eax, eax
js 0x6adba966
mov edx, dword [esp + 0x54]
jmp 0x6adba77e
mov edi, eax
mov eax, ebx
call fcn.6adb7f70
mov dword [esp + 4], str.Cant_create___ls_
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6ae0df7d
mov eax, 0x2f
jmp 0x6adba6b8
mov edi, eax
mov eax, ebx
call fcn.6adb7f70
mov dword [esp + 4], str.Cant_set_delete_on_close_disposition_on___ls_
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6ae0df7d
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.ntdll.dll_NtClose
mov eax, 0x39
push edi
jmp 0x6adba6b8
mov edi, eax
mov eax, ebx
call fcn.6adb7f70
mov dword [esp + 4], str.Cant_reset_attributes_of___ls__to_prepare_for_deletion
mov dword [esp + 8], eax
jmp 0x6adba97b