Function at 0x1016fcd
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x10], ebx
cmp ecx, ebx
jne 0x1017002
push ebx
push ebx
call fcn.01014fba
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1017002
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0101957a
mov edi, dword [ebp - 0x10]
push 0x80
push dword [ebp - 4]
and edi, 0x1000000
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
or dword [ebp + 0x10], 1
push ebx
push 0x2200000
push 3
push ebx
push 7
push 0xc10d0000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x10171a8
mov edi, dword [ebp + 0xc]
xor esi, esi
test byte [ebp + 0x10], 7
je 0x10170c2
test byte [ebp + 0x10], 1
je 0x1017068
mov edx, dword [edi + 0x10]
jmp 0x101706a
xor edx, edx
mov esi, dword [ebp + 0x10]
and esi, 4
mov ecx, esi
neg ecx
sbb ecx, ecx
lea ebx, [edi + 0x40]
and ecx, ebx
mov ebx, esi
push ecx
neg ebx
sbb ebx, ebx
lea ecx, [edi + 0x38]
and ebx, ecx
neg esi
lea ecx, [edi + 0x30]
sbb esi, esi
and esi, ecx
push eax
call fcn.0101622a
mov esi, eax
test esi, esi
jge 0x10170c0
push 0x997
push 0x1002ba0
push esi
push 0x1002b48
push dword [ebp - 4]
push dword [ebp + 8]
push 1
call fcn.01015457
xor ebx, ebx
jmp 0x101719a
xor ebx, ebx
test byte [ebp + 0x10], 2
je 0x10170df
test dword [edi + 0x10], 0x4000
jne 0x10170df
push dword [edi + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.01015a8d
cmp esi, ebx
jl 0x101719a
test byte [ebp + 0x10], 1
je 0x1017106
test byte [ebp + 0x10], 0x40
je 0x1017106
push dword [ebp - 4]
mov eax, dword [edi + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.01016179
mov esi, eax
cmp esi, ebx
jl 0x101719a
test byte [ebp + 0x10], 0x10
je 0x1017176
cmp dword [edi + 0x50], ebx
je 0x1017176
push dword [ebp - 8]
mov eax, edi
push dword [ebp + 8]
call fcn.01016949
mov esi, eax
cmp esi, ebx
jge 0x101717a
test esi, 0x10000000
je 0x101714f
mov ebx, dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push esi
call ebx
cmp eax, 0x13d
jne 0x1017148
xor ebx, ebx
jmp 0x1017160
push esi
call ebx
xor ebx, ebx
jmp 0x1017162
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
movzx eax, si
je 0x1017162
mov eax, esi
push ebx
push eax
push dword [ebp - 4]
push 0x9487
push dword [ebp + 8]
call fcn.01014c32
xor esi, esi
cmp esi, ebx
jl 0x101719a
test byte [ebp + 0x10], 0x20
je 0x101719a
xor eax, eax
cmp dword [edi + 0x60], ebx
jne 0x1017188
inc eax
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.010162b8
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x14]
jmp 0x10171be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10171bc
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jge 0x10171df
push 0x9fc
push 0x1002ba0
push esi
push 0x1002b00
push dword [ebp - 4]
push dword [ebp + 8]
push 2
call fcn.01015457
cmp edi, ebx
je 0x1017229
mov eax, 0x80070020
cmp esi, eax
jne 0x101727a
cmp dword [ebp - 0x20], ebx
jne 0x101720a
mov dword [ebp - 0x1c], 4
mov esi, 0x3e8
mov dword [ebp - 0x20], 1
jmp 0x101720d
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
test ecx, ecx
je 0x1017233
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esi + esi]
mov dword [ebp - 0x18], eax
jmp 0x101702d
cmp esi, 0x80070020
jne 0x101727a
mov eax, esi
cmp edi, ebx
jne 0x1017258
push 0xa0f
push 0x1002ba0
push eax
push 0x1002a90
push dword [ebp - 4]
push dword [ebp + 8]
push 2
call fcn.01015457
xor esi, esi
jmp 0x101727a
push 0xa14
push 0x1002ba0
push eax
push 0x1002b00
push dword [ebp - 4]
push dword [ebp + 8]
push 1
call fcn.01015457
mov esi, 0xc1420135
cmp dword [ebp - 0xc], ebx
je 0x1017290
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc