Function at 0x1400195c8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb0
mov rax, qword [0x14002c298]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, rdx
mov qword [rbp - 0x49], rdx
mov qword [rbp - 0x41], rcx
mov ecx, dword [0x14002c2b0]
mov dword [rbp - 0x51], ecx
mov edi, dword [0x14002d8a0]
mov ebx, dword [0x14002d880]
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
xor ecx, ecx
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rcx
lea rdx, [rbp - 0x61]
mov rcx, rax
call fcn.14001d14c
nop
xor esi, esi
mov eax, edi
mov ecx, 0x4000
and eax, ecx
mov r14d, ebx
and r14d, ecx
sub r14d, eax
mov eax, edi
mov ecx, 0x800
and eax, ecx
mov r15d, ebx
and r15d, ecx
sub r15d, eax
xor eax, eax
test r15d, r15d
setg al
mov dword [rbp - 0x59], eax
mov r13d, r15d
shr r13d, 0x1f
mov rax, qword [rbp - 0x41]
mov eax, dword [rax + 0x18]
or eax, ebx
not edi
and eax, edi
and eax, 0x1a3127
bts eax, 7
mov dword [rbp - 0x55], eax
neg dword [rbp + 0x7f]
sbb eax, eax
and eax, 0x200000
add eax, 0x2000080
mov dword [rbp - 0x4d], eax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 3]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400197ff
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rax
mov eax, dword [rbp - 0x55]
mov dword [rbp - 9], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x39]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
js 0x1400197ba
test r14d, r14d
jg 0x140019785
js 0x140019771
test r15d, r15d
jg 0x140019745
test r13d, r13d
je 0x140019766
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x61]
call fcn.14001e4cc
test eax, eax
jne 0x140019766
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 1
jne 0x1400197d6
mov r12d, 1
jmp 0x140019838
xor edx, edx
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
jmp 0x140019795
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
nop dword [rax + rax]
test eax, eax
je 0x1400197d6
test r14d, r14d
jg 0x140019766
test r15d, r15d
jg 0x1400197a8
test r13d, r13d
je 0x140019766
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x61]
call fcn.14001e4cc
test eax, eax
jne 0x140019766
jmp 0x1400197d6
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x57
jne 0x1400197f5
mov rcx, qword [rbp - 0x49]
cmp qword [rcx], 0
je 0x140019766
cmp eax, 0x7b
je 0x140019822
cmp eax, 2
je 0x140019822
inc esi
mov r9d, esi
mov r8d, dword [rbp - 0x51]
mov edx, 0x239c
mov rcx, qword [rbp - 0x49]
call fcn.14000f800
test eax, eax
je 0x140019838
mov eax, dword [rbp - 0x4d]
jmp 0x14001969d
lea r9d, [rsi + 1]
xor r8d, r8d
mov edx, 0x239c
mov rcx, qword [rbp - 0x41]
call fcn.14000f800
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140019867
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x1400249b8]
mov eax, r12d
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140001a50
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret