Function at 0x429300
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x42d00c]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0x2c], eax
test ebx, ebx
setne al
push edi
movzx eax, al
push eax
push 0x411c34
xor eax, eax
push eax
push eax
push eax
mov ecx, 0x4122b0
mov dword [esp + 0x24], ebx
call fcn.0042ba80
and dword [esp + 0x20], 0
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
mov eax, dword [ebx]
push ebx
call dword [eax + 0x90]
cmp eax, 0xc
je 0x429377
mov eax, dword [ebx]
push ebx
call dword [eax + 0x90]
cmp eax, 0xd
je 0x429377
xor al, al
jmp 0x42937a
xor eax, eax
inc eax
push eax
push 0x41239c
xor eax, eax
push eax
push eax
push eax
mov ecx, 0x4123c8
call fcn.0042ba80
mov eax, dword [ebx]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push ebx
call dword [eax + 0xe8]
cmp dword [ebp + 0xc], 0xc
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
jne 0x4294c4
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ebx
call dword [eax + 0xc0]
mov esi, eax
test esi, esi
jns 0x429401
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x429677
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x429677
cmp byte [ecx + 0xb9], 2
jb 0x429677
push esi
push 0x412614
push 0x17
jmp 0x42950e
mov eax, dword [ebx]
and dword [esp + 0x14], 0
push ebx
call dword [eax + 0xf8]
test eax, eax
je 0x42947e
mov eax, dword [ebx]
push ebx
call dword [eax + 0xfc]
mov esi, eax
lea edi, [esp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x34]
push eax
push 4
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
test eax, eax
je 0x429476
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x42947e
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x42947e
cmp byte [ecx + 0xb9], 3
jb 0x42947e
push eax
push ebx
push 0x4010a0
push reloc.ADVAPI32.dll_EventRegister
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
call fcn.0041c5ec
jmp 0x42947e
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 8]
and dword [esp + 0xc], 0
mov ecx, dword [eax]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
push dword [esp + 0x14]
push eax
call dword [ecx + 0x10]
push esi
push edi
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x34], 0x103
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
jmp 0x4295e8
xor edx, edx
push edx
push edx
push ecx
push edx
push ebx
call dword [eax + 0xc0]
mov esi, eax
test esi, esi
jns 0x42952a
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x429677
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x429677
cmp byte [ecx + 0xb9], 2
jb 0x429677
push esi
push 0x412614
push 0x18
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
call fcn.0041722a
mov ecx, dword [0x42d05c]
jmp 0x429677
mov eax, dword [ebx]
and dword [esp + 0x14], 0
push ebx
call dword [eax + 0xf8]
test eax, eax
je 0x4295a7
mov eax, dword [ebx]
push ebx
call dword [eax + 0xfc]
mov esi, eax
lea edi, [esp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x34]
push eax
push 4
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
test eax, eax
je 0x42959f
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x4295a7
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x4295a7
cmp byte [ecx + 0xb9], 3
jb 0x4295a7
push eax
push ebx
push 0x4010a0
push reloc.ADVAPI32.dll_EventRegister
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
call fcn.0041c5ec
jmp 0x4295a7
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 8]
and dword [esp + 0xc], 0
mov ecx, dword [eax]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
push dword [esp + 0x14]
push eax
call dword [ecx + 0x10]
push esi
push edi
push ebx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x40]
mov dword [esp + 0x34], 0x103
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp dword [esp + 0xc], 0
mov esi, eax
je 0x429609
mov eax, dword [esp + 0x18]
push dword [esp + 0xc]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [esp + 0x14], 0
je 0x42965d
lea eax, [esp + 0x34]
push eax
push 2
call dword [sym.imp.ADVAPI32.dll_EventActivityIdControl]
test eax, eax
je 0x42965d
mov ecx, dword [0x42d05c]
cmp ecx, 0x42d05c
je 0x429663
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x429663
cmp byte [ecx + 0xb9], 3
jb 0x429663
push eax
push 0x4010a0
push reloc.ADVAPI32.dll_EventWrite
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
call fcn.0041722a
mov ecx, dword [0x42d05c]
mov ebx, dword [esp + 0x10]
test esi, esi
jle 0x429679
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jns 0x4296c3
cmp ecx, 0x42d05c
je 0x4296c3
test dword [ecx + 0xbc], reloc.ADVAPI32.dll_EventActivityIdControl
je 0x4296c3
cmp byte [ecx + 0xb9], 2
jb 0x4296c3
cmp dword [ebp + 0xc], 0xc
mov eax, 0x4124b8
je 0x4296a8
mov eax, 0x4124c4
push esi
push 0x412614
push 0x19
push dword [ecx + 0xb4]
push dword [ecx + 0xb0]
mov ecx, eax
call fcn.0041614d
push dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042bdaf
mov esp, ebp
pop ebp
ret 0x10