Function at 0x140001840
Capabilities:
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe40
lea rax, [0x140002e90]
mov qword [rsp + 0xe28], rax
lea rax, [0x140002eb0]
mov qword [rsp + 0xe30], rax
call fcn.140002f70
lea rax, [0x140002ec0]
mov qword [rsp + 0xe18], rax
lea rax, [0x140002ee0]
mov qword [rsp + 0xe20], rax
lea rcx, [rsp + 0xe00]
call fcn.140003460
xor edx, edx
lea rcx, [rsp + 0xdb8]
call fcn.140003880
mov qword [rsp + 0xdf0], 0
mov qword [rsp + 0xe38], 0
mov rdx, qword [0x140022140]
lea rcx, [rsp + 0xe10]
call fcn.140003180
test eax, eax
jne 0x140001915
mov rax, qword [0x140022120]
test rax, rax
je 0x1400018f5
mov eax, dword [rax]
mov qword [rsp + 0xe38], rax
xor r8d, r8d
lea rdx, [rsp + 0xe38]
lea rcx, [rsp + 0xe10]
call fcn.140003300
test eax, eax
jne 0x140001915
xor ebx, ebx
jmp 0x14000191a
mov ebx, 0xb
test ebx, ebx
jne 0x140001980
mov edx, 0x40000
lea rcx, [rsp + 0xe28]
call qword [rsp + 0xe28]
mov qword [rsp + 0xdf0], rax
cmp qword [rsp + 0xdf0], 0
je 0x14000197b
mov qword [rsp + 0xdf8], 0x40000
lea rax, [rsp + 0xe00]
mov qword [rsp + 0xdd8], rax
mov qword [rsp + 0xde8], 0
mov qword [rsp + 0xde0], 0
jmp 0x140001980
mov ebx, 2
lea rcx, [rsp + 0xce0]
call fcn.140003ac0
test ebx, ebx
je 0x1400019aa
cmp byte [0x140020be0], 0
jne 0x140001fcb
mov ecx, ebx
call fcn.140001700
jmp 0x140001fcb
lea r9, [rsp + 0xe18]
lea r8, [rsp + 0xe28]
lea rdx, [rsp + 0xdb8]
lea rcx, [rsp + 0xce0]
call fcn.140006c30
mov ebx, eax
test ebx, ebx
jne 0x140001991
mov dword [rsp + 0xa4], 0xffffffff
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov qword [0x140022160], 0
mov qword [0x140022150], 0
cmp dword [rsp + 0xd40], 0
jbe 0x140001ce0
xor esi, esi
mov qword [0x140022160], 0
xor eax, eax
mov edx, esi
shr edx, 3
mov edx, edx
mov rcx, qword [rsp + 0xd50]
movzx edx, byte [rdx + rcx]
mov r8d, pe_nt_image_headers64
mov ecx, esi
and ecx, 7
sar r8d, cl
test edx, r8d
je 0x140001a5b
add qword [0x140022160], 1
jmp 0x140001a88
mov rdx, rax
add rdx, qword [rsp + 0xd48]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0xd48]
sub rdx, qword [rax + rcx]
add rdx, qword [0x140022160]
add rdx, 1
mov qword [0x140022160], rdx
add rax, 8
add esi, 1
cmp esi, dword [rsp + 0xd40]
jb 0x140001a2b
mov dword [rsp + 0xa0], 0
mov dword [rsp + 0x9c], 0
cmp dword [rsp + 0xd40], 0
ja 0x140001cf0
mov qword [0x140022150], 0
jmp 0x140001fac
mov ebx, 0xb
jmp 0x140001fac
cmp byte [0x140020be0], 0
jne 0x140001e36
mov rax, qword [rsp + 0x60]
lea rdi, [rsp + rax*2 + 0x6c4]
mov eax, esi
mov rdx, rax
mov r8, rdi
lea rcx, [rsp + 0xce0]
call fcn.140006ec0
cmp byte [0x140022170], 0
jne 0x140001b16
mov rcx, rdi
call fcn.140001780
lea rax, [rsp + 0xe18]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
mov r8d, esi
lea rdx, [rsp + 0xdb8]
lea rcx, [rsp + 0xce0]
call fcn.140006c60
mov ebx, eax
test ebx, ebx
jne 0x140001fac
mov eax, esi
shr eax, 3
mov eax, eax
mov qword [rsp + 0x50], rax
mov eax, pe_nt_image_headers64
mov ecx, esi
and ecx, 7
mov r13d, eax
sar r13d, cl
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xd50]
movzx eax, byte [rax + rdx]
test eax, r13d
setne r10b
movzx r14d, r10b
xor r15, r15
jmp 0x140001bf8
cmp word [rdi + r15*2], 0x2f
jne 0x140001bf4
mov word [rdi + r15*2], 0
cmp dword [0x140020e80], 0
je 0x140001bed
lea rcx, [rsp + 0x6c4]
call fcn.1400152b0
mov word [rdi + r15*2], 0x5c
add r15, 1
cmp word [rdi + r15*2], 0
jne 0x140001bc8
test r14d, r14d
je 0x140001d9a
cmp dword [0x140020e80], 0
je 0x140001c3b
lea rcx, [rsp + 0x6c4]
call fcn.1400152b0
cmp byte [0x140020e70], 0
je 0x140001c3b
lea rdx, [rsp + 0x6c4]
mov ecx, 1
call qword [sym.imp.pbcore64.dll_AddUninstLog]
add qword [0x140022150], 1
call fcn.1400017e0
jmp 0x140001cc5
mov rax, qword [0x140022150]
add rax, qword [rsp + 0x78]
add rax, 1
mov qword [0x140022150], rax
call fcn.1400017e0
jmp 0x140001cc5
mov rax, qword [0x140022150]
add rax, qword [rsp + 0x78]
add rax, 1
mov qword [0x140022150], rax
call fcn.1400017e0
jmp 0x140001cc5
cmp qword [rsp + 0xd68], 0
je 0x140001cc5
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xd68]
movzx eax, byte [rax + rdx]
test eax, r13d
je 0x140001cc5
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0xd70]
mov edx, dword [rax + rdx]
lea rcx, [rsp + 0x6c4]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add r12, 8
add qword [rsp + 0x58], 4
add esi, 1
cmp esi, dword [rsp + 0xd40]
jb 0x140001d09
jmp 0x140001fac
mov qword [0x140022160], 0
jmp 0x140001a98
xor esi, esi
mov qword [0x140022150], 0
xor r12, r12
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
mov eax, esi
mov rdx, rax
xor r8, r8
lea rcx, [rsp + 0xce0]
call fcn.140006ec0
mov r14, rax
lea rcx, [rsp + 0x6c4]
mov rdx, qword [0x140022130]
mov r10, rcx
sub rcx, rdx
mov ax, word [rdx]
mov word [rcx + rdx], ax
add rdx, 2
test ax, ax
jne 0x140001d4b
mov rax, r10
lea rcx, [rsp + 0x6c4]
call fcn.140015190
lea rdi, [rsp + 0x6c4]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x60], rcx
cmp r14, 0x104
jb 0x140001ad6
jmp 0x140001acc
cmp qword [rsp + 0xd78], 0
je 0x140001de3
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xd78]
movzx eax, byte [rax + rdx]
test eax, r13d
je 0x140001de3
mov rax, r12
add rax, qword [rsp + 0xd80]
mov eax, dword [rax + 4]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0xd80]
mov eax, dword [r12 + rax]
mov dword [rsp + 0x9c], eax
lea r9, [rsp + 0x9c]
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x6c4]
call qword [0x140022110]
cmp eax, 1
je 0x140001e14
cmp eax, 2
je 0x140001e1b
xor eax, eax
jmp 0x140001e24
mov eax, 1
jmp 0x140001e24
mov byte [0x140020be0], 1
xor eax, eax
cmp byte [0x140020be0], 0
jne 0x140001e36
test eax, eax
je 0x140001e40
jmp 0x140001c4a
mov ebx, 2
jmp 0x140001fac
lea rdx, [rsp + 0x6c4]
lea rcx, [rsp + 0x70]
call fcn.140003190
test eax, eax
je 0x140001ebf
mov r8d, 0x61c
lea rdx, [rsp + 0xa8]
lea rcx, str.errorcreatefile
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
lea rdx, [rsp + 0x6c4]
lea rcx, [rsp + 0xa8]
call fcn.14000e350
mov r9d, 0x116
lea r8, [0x140020bf0]
lea rdx, [rsp + 0xa8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x140001eba
jl 0x140001ebf
cmp eax, 0xa
je 0x140001e40
cmp eax, 0xb
je 0x140001c68
jmp 0x140001ebf
mov ebx, 0xb
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov rdx, rax
add rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140003270
test eax, eax
jne 0x140001efb
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x68], rax
je 0x140001f3d
mov r8d, 0x61c
lea rdx, [rsp + 0xa8]
lea rcx, str.errorwritefile
call qword [sym.imp.pbcore64.dll_EvalVarBuf]
lea rdx, [rsp + 0x6c4]
lea rcx, [rsp + 0xa8]
call fcn.14000e350
lea rcx, [rsp + 0xa8]
call fcn.140015160
mov ebx, 0xb
mov rax, qword [0x140022150]
add rax, qword [rsp + 0x78]
add rax, 1
mov qword [0x140022150], rax
call fcn.1400017e0
cmp qword [rsp + 0xd78], 0
je 0x140001f94
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xd78]
movzx eax, byte [rax + rdx]
test eax, r13d
je 0x140001f94
lea r8, [rsp + 0x9c]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.1400034d0
lea rcx, [rsp + 0x70]
call fcn.1400031a0
test ebx, ebx
jne 0x140001fac
test eax, eax
je 0x140001c86
mov ebx, eax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xe28]
call qword [rsp + 0xe30]
test ebx, ebx
jne 0x140001991
lea rdx, [rsp + 0xe28]
lea rcx, [rsp + 0xce0]
call fcn.140003b80
mov rdx, qword [rsp + 0xdf0]
lea rcx, [rsp + 0xe28]
call qword [rsp + 0xe30]
lea rcx, [rsp + 0xe10]
call fcn.1400031a0
mov eax, ebx
add rsp, 0xe40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret