Function at 0x180001074
Capabilities:
Set file attributes
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180006070]
xor rax, rsp
mov qword [rbp - 8], rax
cmp edx, 1
jne 0x18000132b
mov eax, 0xa7
lea ebx, [rdx + 0x31]
mov dword [rbp - 0x18], 0xa4
lea ecx, [rax - 0xf]
mov dword [rbp - 0x14], 0x20
mov dword [rbp - 0x10], 0x95
mov dword [rbp - 0xc], eax
mov edi, ebx
mov word [rbp - 0x30], cx
lea rcx, [rbp - 0x30]
lea r9, [rbp - 0x14]
lea r8, [rbp - 0x28]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0xc]
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
mov r9d, dword [rbp - 0x14]
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
movsx edx, word [rbp - 0x30]
lea rcx, str.DisableSerape
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
dec rdi
je 0x180001156
mov eax, dword [rbp - 0xc]
jmp 0x1800010c6
movzx ecx, byte [0x180006064]
movsx eax, word [0x18000605c]
mov edx, 0x12
cmp dword [0x180006060], eax
mov rdi, rbx
cmovle ecx, edx
mov byte [0x180006064], cl
lea rax, [rbp - 0x30]
lea r9, [rbp - 0x14]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0xc]
lea rcx, [rbp - 0x14]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
mov r9d, dword [rbp - 0x14]
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
movsx edx, word [rbp - 0x30]
lea rcx, str.DisableSerape
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
dec rdi
jne 0x18000117b
mov rdi, rbx
lea rax, [rbp - 0x30]
lea r9, [rbp - 0x14]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0xc]
lea rcx, [rbp - 0x14]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
mov r9d, dword [rbp - 0x14]
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
movsx edx, word [rbp - 0x30]
lea rcx, str.DisableSerape
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
dec rdi
jne 0x18000120d
lea rax, [rbp - 0x30]
lea r9, [rbp - 0x14]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0xc]
lea rcx, [rbp - 0x14]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
mov r9d, dword [rbp - 0x14]
lea rax, [rbp - 0x30]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
movsx edx, word [rbp - 0x30]
lea rcx, str.DisableSerape
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
dec rbx
jne 0x18000129c
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001a20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret