Function at 0x1003f3a7
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
push esi
mov esi, edx
mov dword [ebp - 0x3c], esi
push edi
mov edi, ecx
mov dword [ebp - 0x68], edi
test ebx, 0x1000000
jne 0x1003f3fd
mov edx, dword [ebp + 0x10]
mov ecx, 0x9000000
and edx, 0x10000000
mov eax, edx
or edx, ecx
or eax, ecx
mov ecx, edi
or ebx, eax
mov dword [ebp + 0x14], ebx
call fcn.1001538a
test bl, 8
je 0x1003f412
push 8
and ebx, 0xfffffff7
mov ecx, edi
pop edx
mov dword [ebp + 0x14], ebx
call fcn.1001534c
mov ecx, edi
call fcn.100310f1
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x1003f437
mov ebx, 0x8007000d
mov ecx, 0x10007e10
push ebx
push 0x49
call fcn.1003a254
jmp 0x1003f8ef
or dword [ebp - 0x48], 0xffffffff
xor eax, eax
mov dword [ebp - 0x34], eax
mov edx, esi
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x34]
push eax
call fcn.100351fa
mov ebx, eax
test ebx, ebx
jns 0x1003f468
push ebx
mov esi, 0x10007e10
push 0x56
mov ecx, esi
call fcn.1003a254
jmp 0x1003f81b
mov ecx, dword [ebp - 0x34]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1003f470
mov esi, 0x10007e48
lea edi, [ebp - 0x60]
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x40], ecx
movsd dword es:[edi], dword [esi]
lea eax, [ecx*2 + 0xa]
push eax
movsd dword es:[edi], dword [esi]
push 8
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov esi, 0x10007e10
mov dword [ebp - 0x64], edi
test edi, edi
je 0x1003f4d5
mov esi, dword [ebp - 0x40]
add esi, esi
push esi
push dword [ebp - 0x34]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
add edi, esi
lea esi, [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x10007e10
jmp 0x1003f515
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003f4e9
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1003f502
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1003f509
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1003f507
mov ebx, 0x80004005
test ebx, ebx
jns 0x1003f51d
push ebx
push 0x6b
mov ecx, esi
call fcn.1003a254
test ebx, ebx
js 0x1003f81b
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov edi, dword [ebp - 0x68]
mov ecx, edi
push eax
push dword [ebp - 0x34]
mov edx, dword [edx + 0xc]
call fcn.1002bbfa
mov ebx, eax
test ebx, ebx
jns 0x1003f561
push ebx
push 0x71
mov ecx, esi
call fcn.1003a254
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 0x75
push esi
push ebx
push 0x10007e54
push dword [eax + 0x14]
mov edx, edi
inc ecx
call fcn.1002fae3
jmp 0x1003f81b
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x3c]
mov ecx, edi
push dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
push dword [ebp - 0x50]
push dword [eax + 0x14]
call fcn.1002bdac
mov ebx, eax
test ebx, ebx
js 0x1003f81b
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x3c]
mov ecx, edi
push dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
push dword [ebp - 0x50]
push dword [eax + 0x14]
call fcn.1002c99c
mov ebx, eax
test ebx, ebx
js 0x1003f81b
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
mov eax, dword [ebp - 0x3c]
push dword [ebp - 0x34]
mov edx, dword [eax + 0xc]
call fcn.1002bbfa
mov ebx, eax
test ebx, ebx
jns 0x1003f5ef
push ebx
push 0x96
mov ecx, esi
call fcn.1003a254
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 0x9a
push esi
push ebx
push 0x10007e54
push dword [eax + 0x14]
mov edx, edi
inc ecx
call fcn.1002fae3
jmp 0x1003f808
xor ecx, ecx
mov dword [ebp - 0x50], 0x10000
mov dword [ebp - 0x40], ecx
mov eax, ecx
test eax, eax
je 0x1003f612
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
push eax
push ecx
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1003f657
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x4c]
push 0x1f
push dword [eax]
call dword [sym.imp.ntdll.dll_NtQuerySecurityObject]
mov ecx, eax
mov dword [ebp - 0x40], ecx
cmp ecx, 0xc0000023
jne 0x1003f66c
mov eax, dword [ebp - 0x44]
xor ecx, ecx
jmp 0x1003f5fd
mov ebx, 0x8007000e
mov ecx, esi
push ebx
push 0xb3
call fcn.1003a254
mov ecx, dword [ebp - 0x40]
test ebx, ebx
js 0x1003f68f
test ecx, ecx
jns 0x1003f68b
mov ebx, ecx
or ebx, 0x10000000
jge 0x1003f6af
push ebx
push 0xc0
mov ecx, esi
call fcn.1003a254
test ebx, ebx
jns 0x1003f6af
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 0xc5
push esi
push ebx
push 0x10007e88
push dword [eax + 0x14]
mov edx, edi
inc ecx
call fcn.1002fae3
test ebx, ebx
js 0x1003f6ee
mov edx, dword [ebp - 0x48]
xor eax, eax
push eax
push dword [ebp - 0x44]
mov ecx, edi
push dword [ebp - 0x34]
call fcn.1002ce27
mov ebx, eax
test ebx, ebx
jns 0x1003f6ee
push ebx
push 0xcc
mov ecx, esi
call fcn.1003a254
push 0xd0
push esi
push ebx
push 0x10007eb0
push dword [ebp - 0x34]
xor ecx, ecx
mov edx, edi
inc ecx
call fcn.1002fae3
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x1003f706
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x1003f808
mov ecx, dword [ebp - 0x3c]
xor edx, edx
push edx
push edx
mov eax, dword [ecx + 0xc]
push dword [eax + 8]
push dword [eax]
mov eax, dword [ebp - 0x4c]
push dword [ecx + 0x14]
mov ecx, edi
mov edx, dword [eax]
call fcn.10032571
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x1003f795
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1003f747
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1003f760
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1003f767
movzx ebx, bx
or ebx, 0x80070000
jmp 0x1003f765
mov ebx, 0x80004005
test ebx, ebx
jns 0x1003f776
push ebx
push 0xe6
mov ecx, esi
call fcn.1003a254
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
push 0xe8
push esi
push ebx
push 0x10007ed4
push dword [eax + 0x14]
mov edx, edi
inc ecx
call fcn.1002fae3
mov eax, dword [ebp - 0x40]
test ebx, ebx
js 0x1003f7bd
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x48]
push 0xffffffffffffffdf
push ecx
push eax
mov ecx, edi
call fcn.1002b151
mov ebx, eax
test ebx, ebx
jns 0x1003f7bd
push ebx
push 0xef
mov ecx, esi
call fcn.1003a254
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x1003f7c9
call fcn.10031fd4
test ebx, ebx
js 0x1003f808
mov eax, dword [ebp - 0x64]
mov ecx, edi
mov edx, dword [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x34]
call fcn.10034565
mov ebx, eax
test ebx, ebx
jns 0x1003f7f7
push ebx
push 0xfa
mov ecx, esi
call fcn.1003a254
jmp 0x1003f808
xor eax, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x3c]
fld qword [ebp - 0x60]
fstp qword [eax + 0x40]
mov eax, dword [ebp - 0x48]
cmp eax, 0xffffffff
je 0x1003f81b
test eax, eax
je 0x1003f81b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [ebp - 0x34], edi
je 0x1003f833
push dword [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x1003f849
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
js 0x1003f8ef
mov edx, dword [ebp - 0x4c]
cmp dword [edx], 0
je 0x1003f8ef
cmp dword [edx], 0xffffffff
je 0x1003f8ef
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
push 4
rep stosd dword es:[edi], eax
mov byte [ebp - 0x35], al
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x30]
push 0x28
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x10], 0x80
push eax
push dword [edx]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov edi, eax
test edi, edi
js 0x1003f8bb
push 0xd
push 1
lea eax, [ebp - 0x35]
mov byte [ebp - 0x35], 1
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x4c]
push dword [eax]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov edi, eax
test edi, edi
jns 0x1003f8ef
mov ebx, edi
or ebx, 0x10000000
jge 0x1003f8d2
push ebx
push 0x147
mov ecx, esi
call fcn.1003a254
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 0x68]
inc ecx
push 0x148
push esi
push edi
push 0x10007f08
push dword [eax + 0x14]
call fcn.1002fae3
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0x10