Function at 0x10001beb8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
xor r15d, r15d
xor eax, eax
and dword [rsp + 0x80], r13d
mov ebp, r9d
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x88], r15d
test rdx, rdx
jne 0x10001bf09
xor ecx, ecx
call fcn.100016f54
test rax, rax
mov r13, rax
cmovne rdi, rax
mov eax, r15d
test rsi, rsi
je 0x10001bf1d
cmp qword [rsi + 0x40], r15
mov rcx, rsi
cmovne rcx, qword [rsi + 0x40]
mov eax, dword [rcx + 0x24]
and eax, 0x1000000
mov edx, 0x80
mov rcx, rdi
mov dword [rsp + 0x98], eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
or ebp, 1
and qword [rsp + 0x30], 0
xor r9d, r9d
mov edx, 0xc10d0000
lea r8d, [r9 + 7]
mov rcx, rdi
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x10001c11c
xor ebx, ebx
test bpl, 7
je 0x10001c01c
lea eax, [rbx + 1]
test al, bpl
je 0x10001bf8d
mov r9d, dword [r12 + 0x1c]
jmp 0x10001bf90
xor r9d, r9d
mov r10d, ebp
lea rcx, [r12 + 0x50]
and r10d, 4
mov eax, r10d
neg eax
mov eax, r10d
sbb r8, r8
and r8, rcx
neg eax
lea rcx, [r12 + 0x48]
sbb rdx, rdx
mov qword [rsp + 0x30], r8
lea rax, [r12 + 0x40]
and rdx, rcx
neg r10d
mov r8, rdi
sbb rcx, rcx
mov qword [rsp + 0x28], rdx
mov rdx, r14
and rcx, rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.10001d380
mov ebx, eax
test eax, eax
jns 0x10001c01c
lea rax, [0x10000ebb8]
mov dword [rsp + 0x30], 0x997
lea r9, [0x10000ebe0]
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, rsi
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.100018010
jmp 0x10001c111
test bpl, 2
je 0x10001c03b
bt dword [r12 + 0x1c], 0xe
jb 0x10001c03b
mov r8, qword [r12 + 0x10]
mov rdx, rdi
mov rcx, r14
call fcn.100017690
test ebx, ebx
js 0x10001c111
mov eax, 1
test al, bpl
je 0x10001c068
test bpl, 0x40
je 0x10001c068
mov r9d, dword [r12 + 0x1c]
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.10001d24c
mov ebx, eax
test ebx, ebx
js 0x10001c111
test bpl, 0x10
je 0x10001c0e0
cmp qword [r12 + 0x68], 0
je 0x10001c0e0
mov r8, r12
mov rdx, r14
mov rcx, rsi
call fcn.10001e70c
mov ebx, eax
test eax, eax
jns 0x10001c0e4
bt eax, 0x1c
mov ecx, eax
jae 0x10001c0b3
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x10001c0c5
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ebx, eax
jmp 0x10001c0c5
and ecx, 0x1fff0000
movzx eax, ax
cmp ecx, 0x70000
cmove ebx, eax
and qword [rsp + 0x20], 0
mov r9d, ebx
mov r8, rdi
mov edx, 0x9487
mov rcx, rsi
call fcn.1000185d8
xor ebx, ebx
test ebx, ebx
js 0x10001c111
test bpl, 0x20
je 0x10001c111
xor eax, eax
mov r9, r12
mov r8, rdi
cmp qword [r12 + 0x80], rax
lea ecx, [rax + 1]
mov rdx, r14
cmove eax, ecx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.10001d454
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10001c130
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea r14, [0x10000ebb8]
test ebx, ebx
jns 0x10001c163
mov dword [rsp + 0x30], 0x9fc
lea r9, [0x10000ec40]
mov r8, rdi
mov rdx, rsi
mov ecx, 2
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], ebx
call fcn.100018010
movsxd rax, dword [rsp + 0x98]
test rax, rax
je 0x10001c1c5
cmp ebx, 0x80070020
jne 0x10001c232
cmp dword [rsp + 0x80], 0
jne 0x10001c19e
mov ebx, 0x3e8
mov r15d, 4
mov dword [rsp + 0x80], 1
jmp 0x10001c1a5
mov ebx, dword [rsp + 0x88]
mov eax, r15d
dec r15d
test eax, eax
je 0x10001c1cd
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, ebx
mov dword [rsp + 0x88], ebx
jmp 0x10001bf3a
cmp ebx, 0x80070020
jne 0x10001c232
cmp dword [rsp + 0x98], 0
mov r8, rdi
mov rdx, rsi
jne 0x10001c207
mov dword [rsp + 0x30], 0xa0f
lea r9, [0x10000ec90]
mov ecx, 2
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80070020
call fcn.100018010
xor ebx, ebx
jmp 0x10001c232
mov dword [rsp + 0x30], 0xa14
lea r9, [0x10000ec40]
mov ecx, 1
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80070020
call fcn.100018010
mov ebx, 0xc1420135
test r13, r13
je 0x10001c24b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret