Function at 0x140012568
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb0
mov rax, qword [0x140023128]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, rdx
mov qword [rbp - 0x49], rdx
mov qword [rbp - 0x41], rcx
mov ecx, dword [0x140023140]
mov dword [rbp - 0x51], ecx
mov edi, dword [0x140024660]
mov ebx, dword [0x140024640]
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
xor ecx, ecx
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rcx
lea rdx, [rbp - 0x61]
mov rcx, rax
call fcn.1400160ec
nop
xor esi, esi
mov eax, edi
mov ecx, 0x4000
and eax, ecx
mov r14d, ebx
and r14d, ecx
sub r14d, eax
mov eax, edi
mov ecx, 0x800
and eax, ecx
mov r15d, ebx
and r15d, ecx
sub r15d, eax
xor eax, eax
test r15d, r15d
setg al
mov dword [rbp - 0x59], eax
mov r13d, r15d
shr r13d, 0x1f
mov rax, qword [rbp - 0x41]
mov eax, dword [rax + 0x18]
or eax, ebx
not edi
and eax, edi
and eax, 0x1a3127
bts eax, 7
mov dword [rbp - 0x55], eax
neg dword [rbp + 0x7f]
sbb eax, eax
and eax, 0x200000
add eax, 0x2000080
mov dword [rbp - 0x4d], eax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x100
lea r8d, [r9 + 3]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001279f
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rax
mov eax, dword [rbp - 0x55]
mov dword [rbp - 9], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rbp - 0x29]
lea rdx, [rbp - 0x39]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
js 0x14001275a
test r14d, r14d
jg 0x140012725
js 0x140012711
test r15d, r15d
jg 0x1400126e5
test r13d, r13d
je 0x140012706
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x61]
call fcn.1400173fc
test eax, eax
jne 0x140012706
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 1
jne 0x140012776
mov r12d, 1
jmp 0x1400127d8
xor edx, edx
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_DecryptFileW]
nop dword [rax + rax]
jmp 0x140012735
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.ADVAPI32.dll_EncryptFileW]
nop dword [rax + rax]
test eax, eax
je 0x140012776
test r14d, r14d
jg 0x140012706
test r15d, r15d
jg 0x140012748
test r13d, r13d
je 0x140012706
mov edx, dword [rbp - 0x59]
lea rcx, [rbp - 0x61]
call fcn.1400173fc
test eax, eax
jne 0x140012706
jmp 0x140012776
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x57
jne 0x140012795
mov rcx, qword [rbp - 0x49]
cmp qword [rcx], 0
je 0x140012706
cmp eax, 0x7b
je 0x1400127c2
cmp eax, 2
je 0x1400127c2
inc esi
mov r9d, esi
mov r8d, dword [rbp - 0x51]
mov edx, 0x239c
mov rcx, qword [rbp - 0x49]
call fcn.14000a814
test eax, eax
je 0x1400127d8
mov eax, dword [rbp - 0x4d]
jmp 0x14001263d
lea r9d, [rsi + 1]
xor r8d, r8d
mov edx, 0x239c
mov rcx, qword [rbp - 0x41]
call fcn.14000a814
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140012807
mov rcx, qword [rdx]
mov r8, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [r8 + 8]
call qword [0x14001d898]
mov eax, r12d
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140001800
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret