Function at 0x46a205
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 2
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 0x46
mov word [ebp - 0xb4], ax
lea eax, [ebp - 0xb2]
push ebx
push eax
mov dword [ebp - 0x1c], 0xfa0
mov dword [ebp - 0x18], 0x8009
mov dword [ebp - 0x14], 0x6603
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x64], eax
add esp, 0xc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
cmp dword [ebp + 0xc], ebx
je 0x46a460
push str.Key_GUID:
call fcn.00409709
pop ecx
push dword [ebp + 0xc]
call fcn.0040f124
mov dword [esp], 0x49ed98
call fcn.00409709
pop ecx
cmp dword [ebp + 0x10], ebx
je 0x46a455
cmp dword [ebp + 0x14], ebx
je 0x46a455
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call sub.ntdll.dll_RtlStringFromGUID
test eax, eax
jl 0x46a460
push 0x10
lea eax, [ebp - 0x2c]
push eax
call sub.cryptdll.dll_CDGenerateRandomBits
movzx eax, word [ebp - 8]
sub eax, 4
push eax
mov eax, dword [ebp - 4]
add eax, 2
push eax
lea eax, [ebp - 0xb4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x18], ebx
je 0x46a34e
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push dword [ebp + 0x10]
push dword [ebp + 0x24]
push dword [ebp + 8]
push dword [ebp + 0x18]
push eax
push dword [ebp - 0x64]
call fcn.00406f49
add esp, 0x1c
test eax, eax
jne 0x46a387
push str.ERROR_kuhl_m_dpapi_create_data___kull_m_dpapi_protect_masterkey_with_password_n
call fcn.00409709
pop ecx
jmp 0x46a387
cmp dword [ebp + 0x1c], ebx
je 0x46a387
cmp dword [ebp + 0x20], ebx
je 0x46a387
push dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebp + 0x24]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp + 0x20]
call fcn.00406fd3
add esp, 0x10
test eax, eax
jne 0x46a385
push str.ERROR_kuhl_m_dpapi_create_data___kull_m_dpapi_protect_masterkey_with_userHash_n
call fcn.00409709
pop ecx
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x46a460
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00406179
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x46a44a
cmp dword [ebp + 0x2c], ebx
je 0x46a3bd
lea edi, [ebp - 0xc0]
call fcn.0040604e
push 0x12
pop ecx
xor eax, eax
lea esi, [ebp - 0xb4]
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0xc8], ax
lea eax, [ebp - 0x110]
push eax
push str.File__s__hidden__system_:
call fcn.00409709
push dword [ebp - 0x60]
lea eax, [ebp - 0x110]
push dword [ebp + 0xc]
push eax
call fcn.00407a3a
add esp, 0x14
test eax, eax
je 0x46a42e
push 0x26
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x46a420
push 0x4c1b0c
call fcn.00409709
jmp 0x46a440
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_dpapi_create_data___SetFileAttributes__0x_08x__n
jmp 0x46a43a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_kuhl_m_dpapi_create_data___kull_m_file_writeData__0x_08x__n
call fcn.00409709
pop ecx
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x46a460
push str.ERROR_kuhl_m_dpapi_create_data___No_key_n
call fcn.00409709
pop ecx
pop edi
pop esi
pop ebx
leave
ret