Function at 0x100106828
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor edi, edi
mov r15, rcx
mov ebp, 0x8008000d
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rdi
cmp rdx, rdi
je 0x10010707d
cmp word [rdx], di
je 0x10010707d
mov rsi, qword [rcx]
lea r13d, [rdi + 0x78]
mov rax, qword [rsi + 0x738]
mov r12d, dword [rsi + 0x14]
mov qword [rsp + 0x40], r13
mov qword [r11 - 0x68], rax
mov rax, qword [rsi + 0x740]
add r12d, r13d
mov qword [r11 - 0x60], rax
mov rax, qword [rsi + 0x748]
mov ecx, r12d
mov qword [r11 - 0x58], rax
mov eax, dword [rsi + 0x750]
mov ebx, r12d
mov dword [rsp + 0xf0], eax
mov dword [r11 - 0x50], eax
call fcn.10011b8d4
mov r14, rax
cmp rax, rdi
jne 0x100106909
mov ebp, 0x8008000e
mov rcx, qword [0x100152eb8]
lea rbx, [0x100152eb8]
cmp rcx, rbx
je 0x100107079
test byte [rcx + 0x1c], 1
je 0x100107079
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x10001dac0]
mov r9d, r12d
call fcn.100036328
jmp 0x100107079
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [r12 + r14]
lea rcx, [r14 + 0x78]
cmp rcx, rax
mov qword [rsp + 0x48], rax
lea rdi, [0x10001dac0]
lea rbx, [0x100152eb8]
jg 0x10010693b
cmp r12d, r13d
jae 0x10010695e
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x10010695e
test byte [rcx + 0x1c], 1
je 0x10010695e
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r8, rdi
call fcn.100034764
mov rcx, r14
mov rdx, rsi
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rsi, [r14 + 0x78]
test rsi, rsi
je 0x10010704e
cmp rsi, r14
jl 0x10010704e
mov rax, qword [r15]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rax + 0x738]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x10010704e
cmp ecx, r12d
ja 0x10010704e
cmp dword [rsp + 0x70], 0
jbe 0x1001069d4
and dword [rsi], 0
mov rax, qword [r15]
lea r8, [rsi + 8]
mov ecx, dword [rax + 0x738]
mov r13d, 0x80
mov qword [rsp + 0x68], r8
mov dword [rsi + 4], ecx
lea rsi, [r8 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x100107035
cmp rsi, r14
jl 0x100107035
mov rax, qword [r15]
mov ecx, dword [rax + 0x750]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x100107035
cmp ecx, r12d
ja 0x100107035
mov eax, dword [rsp + 0xf0]
test eax, eax
je 0x100106a38
mov dword [rsi], 6
mov rax, qword [r15]
lea r9, [rsi + 8]
mov ecx, dword [rax + 0x750]
add r13d, 8
mov qword [rsp + 0x60], r9
mov dword [rsi + 4], ecx
lea rsi, [r9 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x10010701c
cmp rsi, r14
jl 0x10010701c
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x10010701c
cmp ecx, r12d
ja 0x10010701c
mov r13d, dword [rsp + 0x7c]
test r13d, r13d
je 0x100106a97
add dword [rsp + 0x40], 8
mov dword [rsi], 3
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rdx, [rsi + 8]
mov dword [rsi + 4], ecx
lea rsi, [rdx + rcx]
mov qword [rsp + 0x50], rdx
mov eax, 0xa0
mov qword [rsp + 0x90], rax
mov rdx, qword [r15]
mov rdx, qword [rax + rdx]
mov rcx, r15
call fcn.1001079fc
mov r10, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x100106cdd
mov rcx, qword [r15]
cmp rax, rcx
jl 0x100106cdd
add rcx, qword [rcx + 0x98]
lea rax, [rax + 0x18]
cmp rax, rcx
jg 0x100106cdd
movsxd rax, dword [r10]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + rax*4 + 0x70]
mov dword [rsp + 0xf8], eax
test eax, eax
jne 0x100106b30
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100106cd4
test byte [rcx + 0x1c], 2
je 0x100106cd4
mov r9d, dword [r10 + 4]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x11]
mov r8, rdi
call fcn.100036328
jmp 0x100106ccf
mov ecx, dword [r10]
test ecx, ecx
je 0x100106c47
sub ecx, 3
je 0x100106bf3
sub ecx, 2
je 0x100106ba8
cmp ecx, 1
jne 0x100106e66
mov r13, qword [rsp + 0x60]
test r13, r13
je 0x100106e42
cmp r13, r14
jl 0x100106e42
mov ecx, dword [rsp + 0xf0]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x100106e42
cmp ecx, r12d
ja 0x100106e42
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.100107208
add r13, 0x10
mov qword [rsp + 0x60], r13
jmp 0x100106c95
test rsi, rsi
je 0x100106e8a
cmp rsi, r14
jl 0x100106e8a
mov r9d, dword [rsp + 0x84]
lea rax, [rsi + r9]
cmp rax, qword [rsp + 0x48]
jg 0x100106e8a
cmp r9d, r12d
ja 0x100106e8a
mov r8, rsi
mov rdx, r10
mov rcx, r15
call fcn.1001074a4
mov r11d, eax
add rsi, r11
jmp 0x100106c98
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x100106eae
cmp rcx, r14
jl 0x100106eae
mov eax, r13d
add rax, rcx
cmp rax, qword [rsp + 0x48]
jg 0x100106eae
cmp r13d, r12d
ja 0x100106eae
mov r8, rcx
mov r9d, r13d
mov rdx, r10
mov rcx, r15
call fcn.1001072f0
mov rdx, qword [rsp + 0x50]
mov r11d, eax
add rdx, r11
mov qword [rsp + 0x50], rdx
jmp 0x100106c98
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x100106f0b
cmp r13, r14
jl 0x100106f0b
mov ecx, dword [rsp + 0x70]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x100106f0b
cmp ecx, r12d
ja 0x100106f0b
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.1001070d4
add r13, 0xc
mov qword [rsp + 0x68], r13
mov r11d, eax
test r11d, r11d
je 0x100106ed2
mov eax, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x98]
sub eax, r11d
add dword [rsp + 0x40], r11d
mov dword [rsp + rcx*4 + 0x70], eax
mov eax, dword [rsp + 0x88]
mov r13d, dword [rsp + 0x7c]
mov dword [rsp + 0xf0], eax
mov r10, qword [rsp + 0x58]
mov rdx, qword [r10 + 8]
jmp 0x100106aab
mov rax, qword [rsp + 0x90]
add rax, 8
cmp rax, 0x738
mov qword [rsp + 0x90], rax
jl 0x100106aa4
mov rax, qword [rsp + 0x40]
cmp eax, r12d
jne 0x100106ff0
xor r15d, r15d
lea rdx, [r14 + 0x14]
lea ebp, [r15 + 0x10]
mov ecx, r15d
movzx eax, byte [rdx]
imul ecx, ecx, 0x65
inc rdx
add ecx, eax
sub rbp, 1
jne 0x100106d19
lea edx, [r12 - 0x78]
mov ebp, 0x8008000d
cmp edx, r15d
jbe 0x100106d50
lea r8, [r14 + 0x78]
movzx eax, byte [r8]
imul ecx, ecx, 0x65
dec edx
add ecx, eax
inc r8
cmp edx, r15d
ja 0x100106d3d
mov dword [r14 + 0xc], ecx
mov rcx, qword [0x100152eb8]
mov rsi, qword [rsp + 0xe8]
cmp rcx, rbx
je 0x100106d87
test byte [rcx + 0x1c], 4
je 0x100106d87
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], r12d
call fcn.10009b2f4
mov ecx, 1
call fcn.1000f4eb0
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov r9, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x100106faa
mov edx, 0x2080
mov rcx, rsi
mov dword [rsp + 0xe8], r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r15d
jne 0x100106e05
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100106e05
test byte [rcx + 0x1c], 2
je 0x100106e05
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r8, rdi
call fcn.100034764
lea r9, [rsp + 0xe8]
mov r8d, r12d
mov rdx, r14
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r15d
je 0x100106f5b
mov eax, dword [rsp + 0xe8]
cmp eax, r12d
jne 0x100106f2f
mov ebp, r15d
jmp 0x100106f9c
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0x13
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov r9d, dword [r10]
mov edx, 0x16
jmp 0x100106efa
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0x15
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0x14
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov rax, qword [rsp + 0x58]
mov edx, 0x17
mov r9d, dword [rax + 4]
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100036328
jmp 0x100107071
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0x12
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100106f9c
test byte [rcx + 0x1c], 1
je 0x100106f9c
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.10003b338
jmp 0x100106f9c
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100106f88
test byte [rcx + 0x1c], 1
je 0x100106f88
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9d, eax
mov r8, rdi
call fcn.100036328
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100107071
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100106fd7
test byte [rcx + 0x1c], 1
je 0x100106fd7
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, rdi
call fcn.100036328
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
jmp 0x100107071
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov rcx, qword [rcx + 0x10]
mov edx, 0x1d
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.10003b338
jmp 0x100107071
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0x10
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0xf
jmp 0x100107065
mov rcx, qword [0x100152eb8]
cmp rcx, rbx
je 0x100107071
test byte [rcx + 0x1c], 1
je 0x100107071
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100034764
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, ebp
jmp 0x1001070b0
mov rcx, qword [0x100152eb8]
lea rbx, [0x100152eb8]
cmp rcx, rbx
je 0x1001070ab
test byte [rcx + 0x1c], 1
je 0x1001070ab
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dac0]
mov edx, 0xb
call fcn.100034764
mov eax, 0x80080057
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret