Function at 0x7ffbf1cfff18
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x98
xor ebp, ebp
lea rdx, [rax + 0x18]
mov rbx, rcx
mov dword [rax - 0x50], 0x120089
mov dword [rax - 0x4c], 0x120116
mov dword [rax - 0x48], 0x1200a0
mov qword [rax + 0x20], rbp
mov qword [rax - 0x58], rbp
mov qword [rsp + 0x40], rbp
mov qword [rax - 0x68], rbp
mov qword [rax - 0x80], rbp
mov qword [rax - 0x70], rbp
mov qword [rax - 0x60], rbp
mov qword [rax - 0x78], rbp
mov dword [rax - 0x44], 0x1f01ff
call fcn.7ffbf1cffee0
cmp eax, ebp
jl 0x7ffbf1d001d9
mov edi, dword [rsp + 0xe0]
cmp edi, ebp
je 0x7ffbf1cfff91
cmp edi, 2
jne 0x7ffbf1d001d9
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rcx, [0x7ffbf1d674d8]
mov r13d, 0x600
ror ax, 8
lea rsi, [0x7ffbf1d674b0]
lea r8, [rsp + 0xe8]
cmp ax, r13w
cmovae rsi, rcx
xor r9d, r9d
mov rcx, qword [rsi + rdi*8]
lea r12d, [r9 + 1]
mov edx, r12d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
cmp eax, ebp
jne 0x7ffbf1cfffff
lea eax, [rdi + 1]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov rcx, qword [rsi + rax*8]
mov edx, r12d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
cmp eax, ebp
jne 0x7ffbf1cfffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x7ffbf1d001d9
lea rcx, [rsp + 0x50]
call fcn.7ffbf1cffa40
cmp eax, ebp
jne 0x7ffbf1d0006b
mov rdx, qword [rsp + 0xe8]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], 0x19
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreatePrivateObjectSecurityEx]
cmp eax, r12d
jne 0x7ffbf1d0006b
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
mov rcx, qword [rsp + 0xe8]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp eax, ebp
je 0x7ffbf1d001d9
mov edi, 0x80000004
cmp qword [rsp + 0x48], rbp
je 0x7ffbf1d0012a
cmp dword [rbx + 4], ebp
mov rcx, rbp
jl 0x7ffbf1d000b2
mov rcx, qword [rbx + 0x10]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov edx, r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
cmp eax, ebp
jne 0x7ffbf1d0012a
mov rcx, qword [rsp + 0x58]
cmp rcx, rbp
je 0x7ffbf1d0012a
mov rdx, qword [rsp + 0x48]
movzx eax, word [rdx + 2]
cmp word [rcx + 2], ax
jne 0x7ffbf1d0012a
movzx r8d, ax
cmp r8, rbp
je 0x7ffbf1d001d9
jmp 0x7ffbf1d00117
mov al, byte [rdx]
cmp byte [rcx], al
jne 0x7ffbf1d0011c
add rcx, r12
add rdx, r12
sub r8, r12
jne 0x7ffbf1d0010b
movzx eax, byte [rdx]
movzx ecx, byte [rcx]
sub ecx, eax
je 0x7ffbf1d001d9
cmp dword [rbx + 4], ebp
mov rcx, rbp
jl 0x7ffbf1d00136
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, edi
mov edx, r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
ror ax, 8
cmp ax, r13w
jb 0x7ffbf1d001ce
cmp edi, ebp
jne 0x7ffbf1d001ce
mov rcx, qword [rsp + 0xe8]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
cmp eax, ebp
je 0x7ffbf1d001c8
cmp dword [rbx + 4], ebp
mov rcx, rbp
jl 0x7ffbf1d001a2
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x68]
xor r9d, r9d
mov edx, r12d
mov qword [rsp + 0x30], rax
lea r8d, [r9 + 0x10]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
jmp 0x7ffbf1d001ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
or edx, 0xffffffff
mov rcx, rbx
call fcn.7ffbf1cc768c
cmp dword [rbx + 4], ebp
jl 0x7ffbf1d001e9
cmp dword [rbx + 8], ebp
je 0x7ffbf1d001e9
mov rcx, qword [rbx + 0x10]
jmp 0x7ffbf1d001f0
lea rcx, [0x7ffbf1cafb98]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0xe8]
cmp rcx, rbp
je 0x7ffbf1d0020e
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x7ffbf1d0021e
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x40], rbp
je 0x7ffbf1d00230
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_DestroyPrivateObjectSecurity]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x7ffbf1d00240
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x98
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret