Function at 0x14001a9a8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [0x14002c298]
xor rax, rsp
mov qword [rbp - 1], rax
mov r14, rdx
mov qword [rbp - 0x41], rdx
mov rdi, rcx
mov eax, dword [0x14002c2b0]
mov dword [rbp - 0x79], eax
mov eax, dword [0x14002d8a0]
mov dword [rbp - 0x75], eax
mov esi, dword [0x14002d880]
mov eax, dword [0x14002c2c8]
mov dword [rbp - 0x69], eax
mov r12d, dword [0x14002c2bc]
lea rdx, [rbp - 0x49]
call fcn.14001fe70
mov rbx, rax
lea rdx, [rbp - 0x51]
mov rcx, r14
call fcn.14001d14c
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x71]
call fcn.140019220
nop
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001aa5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x1400249b8]
nop
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001aa8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [0x1400249b8]
and dword [rbp - 0x65], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xor r15d, r15d
xor r14d, r14d
xor ebx, ebx
xor r13d, r13d
xor r9d, r9d
mov qword [rbp - 0x59], r9
lea r10d, [r15 + 1]
cmp dword [0x14002d8c0], ebx
je 0x14001aac4
cmp dword [rdi + 0x74], 0xa000000c
cmove r9d, r10d
mov qword [rbp - 0x59], r9
xor r8d, r8d
mov qword [rbp - 0x61], r8
cmp dword [0x14002d8b0], ebx
je 0x14001aae2
cmp dword [rdi + 0x74], 0xa0000003
cmove r8, r10
mov qword [rbp - 0x61], r8
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rax
cmp dword [rbp - 0x69], eax
je 0x14001ab17
mov rax, qword [rdi + 0x78]
mov qword [rbp - 0x29], rax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x21], rax
mov rax, qword [rdi]
mov qword [rbp - 0x19], rax
mov rax, qword [rdi + 0x80]
mov qword [rbp - 0x11], rax
test r12d, r12d
je 0x14001ab6b
mov ecx, dword [rdi + 0x70]
or ecx, esi
mov edx, dword [rbp - 0x75]
mov eax, edx
not eax
and ecx, eax
and ecx, 0x1a3127
bts ecx, 7
mov dword [rbp - 9], ecx
mov r14d, esi
mov ecx, 0x4000
and r14d, ecx
mov eax, edx
and eax, ecx
sub r14d, eax
test r14d, r14d
setg r15b
shr r14d, 0x1f
mov eax, 0x800
and esi, eax
and edx, eax
sub esi, edx
test esi, esi
setg bl
test esi, esi
jns 0x14001ab6b
mov r13d, r10d
xor esi, esi
test r9, r9
jne 0x14001ab85
test r8, r8
jne 0x14001ab85
cmp dword [0x14002d790], r8d
mov eax, 0x2000080
je 0x14001ab8a
mov eax, 0x2200080
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001acdd
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x39]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rbp - 0x75], eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rbp - 0x75]
test eax, eax
js 0x14001acc1
test r15d, r15d
jne 0x14001ac8e
test r14d, r14d
jne 0x14001ac7a
test ebx, ebx
jne 0x14001ac20
test r13d, r13d
je 0x14001ac44
mov edx, ebx
lea rcx, [rbp - 0x71]
call fcn.14001e4cc
test eax, eax
jne 0x14001ac44
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 1
jne 0x14001acdd
mov r12d, dword [rbp - 0x79]
cmp dword [rbp - 0x69], 0
je 0x14001ac70
test r15d, r15d
jne 0x14001ac61
test r14d, r14d
jne 0x14001ac61
test ebx, ebx
jne 0x14001ac61
test r13d, r13d
je 0x14001ac70
mov r9d, r12d
mov rdx, qword [rbp - 0x41]
mov rcx, rdi
call fcn.14001a6e0
mov ebx, 1
jmp 0x14001ad38
xor edx, edx
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
jmp 0x14001ac9e
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
nop dword [rax + rax]
test eax, eax
je 0x14001acdd
test r15d, r15d
jne 0x14001ac44
test ebx, ebx
jne 0x14001acb0
test r13d, r13d
je 0x14001ac44
mov edx, ebx
lea rcx, [rbp - 0x71]
call fcn.14001e4cc
test eax, eax
jne 0x14001ac44
jmp 0x14001acdd
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7b
je 0x14001ad21
cmp eax, 2
je 0x14001ad21
inc esi
mov r9d, esi
mov r12d, dword [rbp - 0x79]
mov r8d, r12d
mov edx, 0x239c
mov rcx, rdi
call fcn.14000f774
test eax, eax
mov r8, qword [rbp - 0x61]
mov r9, qword [rbp - 0x59]
jne 0x14001ab6d
jmp 0x14001ac48
lea r9d, [rsi + 1]
xor r8d, r8d
mov edx, 0x239c
mov rcx, rdi
call fcn.14000f774
mov ebx, dword [rbp - 0x65]
mov rdx, qword [rbp - 0x71]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14001ad67
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x1400249b8]
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140001a50
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret