Function at 0x401d60
Capabilities:
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
push edi
push 0xff
lea eax, [ebp - 0x157]
push 0
push eax
mov byte [ebp - 0x158], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x158]
call fcn.00401cb0
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov edi, eax
mov ecx, dword [edi + 0x3c]
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov edx, dword [ecx + edi + 0x34]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
lea esi, [ecx*4]
push esi
push 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], eax
call ebx
mov dword [0x404024], eax
test eax, eax
jne 0x401dda
mov eax, 0xc000009a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0
call ebx
mov dword [0x404020], eax
test eax, eax
je 0x401dce
mov ecx, dword [ebp - 0xc]
push esi
push 1
mov dword [0x404028], ecx
call ebx
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x401dce
mov eax, dword [ebp - 4]
mov edx, edi
call fcn.00401bb0
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x401e24
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x401e5e
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
push 7
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x48], ecx
push 1
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x50], 0x18
mov dword [ebp - 0x44], 0x240
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
mov eax, dword [ebp - 8]
js 0x401f35
test eax, eax
je 0x401f35
mov edx, dword [ebp - 0x10]
push 0xe
push 8
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edx
push ecx
lea edx, [ebp - 0x24]
push edx
push eax
mov dword [ebp - 0x34], 0
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
test edi, edi
js 0x401f3a
mov ecx, dword [ebp - 8]
push 0
push 0
push esi
push ebx
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
js 0x401f35
cmp dword [ebp - 0xc], 0
jbe 0x401f3a
mov edx, dword [ebp - 4]
mov esi, dword [0x404024]
mov edi, dword [0x404020]
mov ecx, dword [ebp - 0xc]
sub edx, ebx
sub esi, ebx
mov eax, ebx
sub edi, ebx
mov dword [ebp - 4], ecx
mov ebx, dword [ebp - 0x1c]
sub ebx, dword [ebp - 0x18]
mov ecx, dword [edx + eax]
add ebx, dword [eax]
add eax, 4
dec dword [ebp - 4]
mov dword [esi + eax - 4], ebx
mov dword [edi + eax - 4], ecx
jne 0x401f12
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
jmp 0x401f3a
mov edi, 0xc0000001
mov eax, dword [ebp - 8]
test eax, eax
je 0x401f48
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret