Function at 0x100106d1c
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor edi, edi
mov r15, rcx
mov ebp, 0x8008000d
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rdi
cmp rdx, rdi
je 0x100107571
cmp word [rdx], di
je 0x100107571
mov rsi, qword [rcx]
lea r13d, [rdi + 0x78]
mov rax, qword [rsi + 0x738]
mov r12d, dword [rsi + 0x14]
mov qword [rsp + 0x40], r13
mov qword [r11 - 0x68], rax
mov rax, qword [rsi + 0x740]
add r12d, r13d
mov qword [r11 - 0x60], rax
mov rax, qword [rsi + 0x748]
mov ecx, r12d
mov qword [r11 - 0x58], rax
mov eax, dword [rsi + 0x750]
mov ebx, r12d
mov dword [rsp + 0xf0], eax
mov dword [r11 - 0x50], eax
call fcn.10011bdc8
mov r14, rax
cmp rax, rdi
jne 0x100106dfd
mov ebp, 0x8008000e
mov rcx, qword [0x100153eb8]
lea rbx, [0x100153eb8]
cmp rcx, rbx
je 0x10010756d
test byte [rcx + 0x1c], 1
je 0x10010756d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x10001dac0]
mov r9d, r12d
call fcn.100036510
jmp 0x10010756d
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [r12 + r14]
lea rcx, [r14 + 0x78]
cmp rcx, rax
mov qword [rsp + 0x48], rax
lea rdi, [0x10001dac0]
lea rbx, [0x100153eb8]
jg 0x100106e2f
cmp r12d, r13d
jae 0x100106e52
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100106e52
test byte [rcx + 0x1c], 1
je 0x100106e52
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r8, rdi
call fcn.100034784
mov rcx, r14
mov rdx, rsi
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rsi, [r14 + 0x78]
test rsi, rsi
je 0x100107542
cmp rsi, r14
jl 0x100107542
mov rax, qword [r15]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rax + 0x738]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x100107542
cmp ecx, r12d
ja 0x100107542
cmp dword [rsp + 0x70], 0
jbe 0x100106ec8
and dword [rsi], 0
mov rax, qword [r15]
lea r8, [rsi + 8]
mov ecx, dword [rax + 0x738]
mov r13d, 0x80
mov qword [rsp + 0x68], r8
mov dword [rsi + 4], ecx
lea rsi, [r8 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x100107529
cmp rsi, r14
jl 0x100107529
mov rax, qword [r15]
mov ecx, dword [rax + 0x750]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x100107529
cmp ecx, r12d
ja 0x100107529
mov eax, dword [rsp + 0xf0]
test eax, eax
je 0x100106f2c
mov dword [rsi], 6
mov rax, qword [r15]
lea r9, [rsi + 8]
mov ecx, dword [rax + 0x750]
add r13d, 8
mov qword [rsp + 0x60], r9
mov dword [rsi + 4], ecx
lea rsi, [r9 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x100107510
cmp rsi, r14
jl 0x100107510
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x100107510
cmp ecx, r12d
ja 0x100107510
mov r13d, dword [rsp + 0x7c]
test r13d, r13d
je 0x100106f8b
add dword [rsp + 0x40], 8
mov dword [rsi], 3
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rdx, [rsi + 8]
mov dword [rsi + 4], ecx
lea rsi, [rdx + rcx]
mov qword [rsp + 0x50], rdx
mov eax, 0xa0
mov qword [rsp + 0x90], rax
mov rdx, qword [r15]
mov rdx, qword [rax + rdx]
mov rcx, r15
call fcn.100107ef0
mov r10, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1001071d1
mov rcx, qword [r15]
cmp rax, rcx
jl 0x1001071d1
add rcx, qword [rcx + 0x98]
lea rax, [rax + 0x18]
cmp rax, rcx
jg 0x1001071d1
movsxd rax, dword [r10]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + rax*4 + 0x70]
mov dword [rsp + 0xf8], eax
test eax, eax
jne 0x100107024
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x1001071c8
test byte [rcx + 0x1c], 2
je 0x1001071c8
mov r9d, dword [r10 + 4]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x11]
mov r8, rdi
call fcn.100036510
jmp 0x1001071c3
mov ecx, dword [r10]
test ecx, ecx
je 0x10010713b
sub ecx, 3
je 0x1001070e7
sub ecx, 2
je 0x10010709c
cmp ecx, 1
jne 0x10010735a
mov r13, qword [rsp + 0x60]
test r13, r13
je 0x100107336
cmp r13, r14
jl 0x100107336
mov ecx, dword [rsp + 0xf0]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x100107336
cmp ecx, r12d
ja 0x100107336
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.1001076fc
add r13, 0x10
mov qword [rsp + 0x60], r13
jmp 0x100107189
test rsi, rsi
je 0x10010737e
cmp rsi, r14
jl 0x10010737e
mov r9d, dword [rsp + 0x84]
lea rax, [rsi + r9]
cmp rax, qword [rsp + 0x48]
jg 0x10010737e
cmp r9d, r12d
ja 0x10010737e
mov r8, rsi
mov rdx, r10
mov rcx, r15
call fcn.100107998
mov r11d, eax
add rsi, r11
jmp 0x10010718c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1001073a2
cmp rcx, r14
jl 0x1001073a2
mov eax, r13d
add rax, rcx
cmp rax, qword [rsp + 0x48]
jg 0x1001073a2
cmp r13d, r12d
ja 0x1001073a2
mov r8, rcx
mov r9d, r13d
mov rdx, r10
mov rcx, r15
call fcn.1001077e4
mov rdx, qword [rsp + 0x50]
mov r11d, eax
add rdx, r11
mov qword [rsp + 0x50], rdx
jmp 0x10010718c
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x1001073ff
cmp r13, r14
jl 0x1001073ff
mov ecx, dword [rsp + 0x70]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x1001073ff
cmp ecx, r12d
ja 0x1001073ff
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.1001075c8
add r13, 0xc
mov qword [rsp + 0x68], r13
mov r11d, eax
test r11d, r11d
je 0x1001073c6
mov eax, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x98]
sub eax, r11d
add dword [rsp + 0x40], r11d
mov dword [rsp + rcx*4 + 0x70], eax
mov eax, dword [rsp + 0x88]
mov r13d, dword [rsp + 0x7c]
mov dword [rsp + 0xf0], eax
mov r10, qword [rsp + 0x58]
mov rdx, qword [r10 + 8]
jmp 0x100106f9f
mov rax, qword [rsp + 0x90]
add rax, 8
cmp rax, 0x738
mov qword [rsp + 0x90], rax
jl 0x100106f98
mov rax, qword [rsp + 0x40]
cmp eax, r12d
jne 0x1001074e4
xor r15d, r15d
lea rdx, [r14 + 0x14]
lea ebp, [r15 + 0x10]
mov ecx, r15d
movzx eax, byte [rdx]
imul ecx, ecx, 0x65
inc rdx
add ecx, eax
sub rbp, 1
jne 0x10010720d
lea edx, [r12 - 0x78]
mov ebp, 0x8008000d
cmp edx, r15d
jbe 0x100107244
lea r8, [r14 + 0x78]
movzx eax, byte [r8]
imul ecx, ecx, 0x65
dec edx
add ecx, eax
inc r8
cmp edx, r15d
ja 0x100107231
mov dword [r14 + 0xc], ecx
mov rcx, qword [0x100153eb8]
mov rsi, qword [rsp + 0xe8]
cmp rcx, rbx
je 0x10010727b
test byte [rcx + 0x1c], 4
je 0x10010727b
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], r12d
call fcn.10003b678
mov ecx, 1
call fcn.1000f53a4
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov r9, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x10010749e
mov edx, 0x2080
mov rcx, rsi
mov dword [rsp + 0xe8], r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r15d
jne 0x1001072f9
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x1001072f9
test byte [rcx + 0x1c], 2
je 0x1001072f9
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r8, rdi
call fcn.100034784
lea r9, [rsp + 0xe8]
mov r8d, r12d
mov rdx, r14
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r15d
je 0x10010744f
mov eax, dword [rsp + 0xe8]
cmp eax, r12d
jne 0x100107423
mov ebp, r15d
jmp 0x100107490
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0x13
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov r9d, dword [r10]
mov edx, 0x16
jmp 0x1001073ee
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0x15
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0x14
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov rax, qword [rsp + 0x58]
mov edx, 0x17
mov r9d, dword [rax + 4]
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100036510
jmp 0x100107565
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0x12
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107490
test byte [rcx + 0x1c], 1
je 0x100107490
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.10003be4c
jmp 0x100107490
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x10010747c
test byte [rcx + 0x1c], 1
je 0x10010747c
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9d, eax
mov r8, rdi
call fcn.100036510
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100107565
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x1001074cb
test byte [rcx + 0x1c], 1
je 0x1001074cb
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, rdi
call fcn.100036510
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
jmp 0x100107565
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov rcx, qword [rcx + 0x10]
mov edx, 0x1d
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.10003be4c
jmp 0x100107565
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0x10
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0xf
jmp 0x100107559
mov rcx, qword [0x100153eb8]
cmp rcx, rbx
je 0x100107565
test byte [rcx + 0x1c], 1
je 0x100107565
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100034784
mov rcx, r14
call sub.msvcrt.dll_free
mov eax, ebp
jmp 0x1001075a4
mov rcx, qword [0x100153eb8]
lea rbx, [0x100153eb8]
cmp rcx, rbx
je 0x10010759f
test byte [rcx + 0x1c], 1
je 0x10010759f
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dac0]
mov edx, 0xb
call fcn.100034784
mov eax, 0x80080057
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret