Function at 0x140154660
Capabilities:
Set file attributes

Disassembly:
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0x2a8
movabs rax, 0x750f2433d40df7b5
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x2b8]
sub eax, 0x8fe
movzx ecx, word [rsp + 0x2b0]
cmp eax, ecx
jl 0x140154763
movzx eax, word [rsp + 0x2b8]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0xac2
je 0x140154753
cmp dword [rsp + 0x5c], 0xb57
je 0x1401546c6
jmp 0x140154763
mov edx, 0x1d
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
mov dword [rsp + 0x6c], eax
mov ecx, 0xe2
call fcn.140153e90
movzx eax, word [rsp + 0x2b0]
mov word [rsp + 0x2b8], ax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0x68], eax
movzx eax, word [rsp + 0x2b8]
mov word [rsp + 0x2b0], ax
mov dword [rsp + 0x28], 0xdb
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x100]
lea r8, str.airworthy_wipe_fledglings
mov edx, 0x1b
mov ecx, 0x7c
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [rsp + 0x3c], eax
jmp 0x140154763
movzx eax, word [rsp + 0x2b8]
mov word [rsp + 0x2b0], ax
movzx eax, word [rsp + 0x2b8]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x14015477b
jmp 0x140154b0d
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x60], eax
movabs rax, 0x6b47d6af1276f9a7
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
mov eax, 0x7c82
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa0], rax
movabs rax, 0xfbc11f165fddb7d9
cmp qword [rsp + 0xa0], rax
je 0x1401547d2
jmp 0x14015481a
movzx eax, word [rsp + 0x2b8]
mov word [rsp + 0x2b0], ax
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov dword [rsp + 0x84], eax
mov ecx, dword [rsp + 0x58]
call fcn.140153e90
movzx eax, word [rsp + 0x2b0]
mov word [rsp + 0x2b8], ax
jmp 0x140154ac3
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x60]
and ecx, eax
mov eax, ecx
cmp eax, dword [rsp + 0x40]
jl 0x140154920
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
movzx eax, word [rsp + 0x2b0]
shl eax, 0x84
movzx ecx, word [rsp + 0x2b8]
cmp eax, ecx
je 0x1401548fe
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [rsp + 0x38], ax
movsx eax, word [rsp + 0x30]
or eax, 0x62dd
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
mov dl, 0xba
mov ecx, 7
call fcn.140154b70
mov ecx, 0xb3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0xa8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax]
shr eax, cl
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
mov rax, qword [rsp + 0x88]
mov r9, qword [rax]
movzx r8d, word [rsp + 0x38]
mov rax, qword [rsp + 0x70]
mov edx, dword [rax]
mov cl, 0xad
call fcn.140153480
nop
mov byte [rsp + 0x35], 0x46
lea rax, [rsp + 0x50]
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov qword [rsp + 0xb0], rax
movabs rax, 0xa5366c74adf200a0
cmp qword [rsp + 0xb0], rax
je 0x140154954
jmp 0x14015498d
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax]
add rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
movzx r8d, word [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax]
call fcn.1401539e0
nop
jmp 0x140154a9b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38]
sub eax, ecx
movzx ecx, word [rsp + 0x2b0]
movzx edx, word [rsp + 0x2b8]
and ecx, edx
cmp eax, ecx
jg 0x140154a9b
mov rax, qword [rsp + 0x90]
movzx eax, word [rax]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x1401549ef
cmp dword [rsp + 0x64], 0x1fa
je 0x140154a84
jmp 0x140154a9b
movzx eax, byte [rsp + 0x35]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x7c], al
cmp byte [rsp + 0x7c], 0x67
je 0x140154a0a
jmp 0x140154a82
mov rax, qword [rsp + 0x48]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x30]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x48]
movsx eax, word [rax]
add eax, 0x4023
mov word [rsp + 0x30], ax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov dword [rsp + 0x98], eax
mov r9d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movzx r8d, word [rax]
movzx edx, byte [rsp + 0x34]
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax]
call fcn.140154120
movsx eax, word [rsp + 0x30]
sub eax, 0x459a
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
jmp 0x140154a9b
mov edx, 0xfb
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xe8], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x9c], eax
lea r9, [rsp + 0x30]
mov r8d, 0xef
lea rdx, [rsp + 0x100]
mov ecx, 0x9d
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [rsp + 0x84], eax
mov dl, 0x27
mov ecx, 0x3a
call fcn.140154b70
mov edx, 0x3d
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rsp + 0x68], eax
jmp 0x140154b3a
mov dword [rsp + 0x3c], 0x3d06d032
movzx edx, word [rsp + 0x2b0]
movzx ecx, word [rsp + 0x2b0]
call fcn.140154660
movzx eax, word [rsp + 0x2b8]
mov word [rsp + 0x2b0], ax
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x3c]
mov edx, 0x4f
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
mov dword [rsp + 0x44], eax
mov eax, 0x78
add rsp, 0x2a8
ret