Function at 0x1402d20c0
Capabilities:
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0x58], rcx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov eax, 0x42544c89
mov ebp, 0xf0821b5a
mov r14d, 0xa5092943
lea rbx, [rsp + 0x80]
lea rdi, [rsp + 0xb0]
lea r13, [rsp + 0x70]
xorps xmm6, xmm6
jmp 0x1402d2130
mov eax, 0xa5092943
nop dword [rax + rax]
cmp eax, 0xacc4508
jle 0x1402d2180
cmp eax, 0x262253e6
jg 0x1402d21e0
cmp eax, 0xacc4509
je 0x1402d2126
cmp eax, 0x170c8c68
je 0x1402d22ba
cmp eax, 0x1eb15492
jne 0x1402d2130
cmp r15d, 0xc0000034
mov eax, 0xaa930c26
mov ecx, 0xdf1c769d
cmove eax, ecx
mov r12d, r15d
jmp 0x1402d2130
cmp eax, 0xdf1c769c
jg 0x1402d2297
cmp eax, 0xa5092943
je 0x1402d22ce
cmp eax, 0xa8280a40
je 0x1402d22f4
cmp eax, 0xaa930c26
jne 0x1402d2130
mov dword [rsp + 0x3c], r12d
mov rax, qword [rsp + 0x40]
mov eax, dword [0x14035cef8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xacc4509
cmove eax, r14d
cmp dword [0x14035cefc], 0xa
cmovl eax, r14d
jmp 0x1402d2130
cmp eax, 0x262253e7
je 0x1402d2310
cmp eax, 0x455f7295
je 0x1402d2377
cmp eax, 0x42544c89
jne 0x1402d2130
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov eax, 0x5c95f05f
nop dword [rax]
cmp eax, 0x47eecdb8
je 0x1402d2391
cmp eax, 0x5c95f05f
jne 0x1402d2250
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rdi
lea rax, [rsp + 0xa0]
movups xmmword [rax], xmm6
mov qword [rsp + 0xc0], r13
mov rax, qword [rsp + 0xc0]
mov eax, 0x47eecdb8
jmp 0x1402d2250
cmp eax, 0xdf1c769d
je 0x1402d23d7
cmp eax, 0xfbd8299b
jne 0x1402d23fb
mov eax, 0xaa930c26
xor r12d, r12d
jmp 0x1402d2130
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov eax, 0x455f7295
jmp 0x1402d2130
mov eax, dword [0x14035cef8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xacc4509
cmove eax, ebp
cmp dword [0x14035cefc], 0xa
cmovl eax, ebp
jmp 0x1402d2130
cmp dword [rsp + 0x34], 0
mov eax, 0x1eb15492
mov ecx, 0x262253e7
cmovns eax, ecx
mov r15d, dword [rsp + 0x34]
jmp 0x1402d2130
mov rsi, qword [rsp + 0x68]
mov eax, 0x7117a72b
nop word [rax + rax]
cmp eax, 0xd6a6a2e9
je 0x1402d23e1
cmp eax, 0x7117a72b
jne 0x1402d2320
mov byte [rsp + 0xc0], 1
mov qword [rsp + 0xb0], rbx
mov rax, qword [rsp + 0xb0]
mov dword [rsp + 0x20], select
mov rcx, rsi
mov rdx, rbx
lea r8, [rsp + 0xc0]
mov r9d, 1
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov dword [rsp + 0x70], eax
mov eax, 0xd6a6a2e9
jmp 0x1402d2320
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, 0x1eb15492
mov r15d, dword [rsp + 0x38]
jmp 0x1402d2130
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x68]
mov edx, 0x10000000
mov r8, rbx
mov r9, r13
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov rcx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x34], eax
mov eax, 0xa8280a40
jmp 0x1402d2130
mov eax, 0xfbd8299b
jmp 0x1402d2130
mov rax, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov eax, 0x170c8c68
jmp 0x1402d2130
cmp eax, 0xf0821b5a
jne 0x1402d2130
mov esi, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1402e6030
mov eax, esi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret