Function at 0x180068400
Capabilities:
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor r12d, r12d
mov dword [rbp - 0x60], 0x20a0000
xor eax, eax
mov qword [rsp + 0x68], r12
mov qword [rbp - 0x10], rax
lea rax, [rbp]
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
mov qword [rsp + 0x60], r12
mov r15, r8
mov qword [rsp + 0x70], r12
mov r13, rcx
movups xmmword [rbp - 0x20], xmm0
test rcx, rcx
jne 0x180068473
mov eax, 0xc00000ef
jmp 0x1800688b3
test rdx, rdx
jne 0x180068482
mov eax, 0xc00000f0
jmp 0x1800688b3
test r15, r15
jne 0x180068491
mov eax, 0xc00000f1
jmp 0x1800688b3
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
test eax, eax
js 0x1800688b3
lea rdx, str.inifile.upd
lea rcx, [rbp - 0x60]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
test eax, eax
js 0x1800688b3
mov dword [rsp + 0x50], r12d
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], r12
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x50]
mov dword [rsp + 0x38], 3
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x30], 2
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x100083
mov qword [rsp + 0x20], r12
mov dword [rbp - 0x50], 0x30
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x38], 0x40
mov qword [rbp - 0x40], rax
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rsp + 0x78], r12d
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
or r14, 0xffffffffffffffff
mov ebx, eax
test eax, eax
js 0x180068873
mov rcx, qword [rsp + 0x68]
lea r9d, [r14 + 0x19]
lea r8, [rbp - 0x20]
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
cmp eax, 0x80000005
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
js 0x180068873
mov eax, dword [rbp - 0x18]
mov qword [rsp + 0x70], rax
lea rcx, [rax + 8]
cmp rcx, rax
ja 0x18006859f
mov ebx, 0xc00000f2
jmp 0x180068873
lea rax, [rcx + 0x1000]
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x78], rcx
cmp rax, rcx
jbe 0x180068595
mov edi, 4
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x28], edi
lea r9, [rbp - 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], 0x2000
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180068873
mov dword [rsp + 0x28], edi
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x60]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180068873
mov eax, dword [rbp - 0x18]
test eax, eax
je 0x180068692
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
mov qword [rsp + 0x38], r12
xor edx, edx
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x103
jne 0x180068683
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
js 0x180068873
mov ebx, dword [rsp + 0x78]
mov eax, dword [rbp - 0x18]
test ebx, ebx
js 0x180068873
mov rdi, qword [rsp + 0x60]
mov esi, eax
add rsi, rdi
cmp rdi, rsi
jae 0x180068704
mov rdx, qword [r13 + 8]
mov rcx, rdi
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jns 0x1800686da
mov rcx, r14
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x1800686c3
lea rdi, [rdi + rcx*2]
add rdi, 0xa
cmp rdi, rsi
jb 0x1800686a9
cmp rdi, rsi
jae 0x180068704
test eax, eax
jne 0x180068704
mov rcx, r14
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x1800686e6
mov eax, dword [r15]
mov dword [rdi + rcx*2 + 2], eax
mov eax, dword [r15 + 4]
mov dword [rdi + rcx*2 + 6], eax
jmp 0x1800687a5
mov rax, qword [rsp + 0x70]
movzx r14d, word [r13]
add r14, 0xa
lea rcx, [r14 + rax]
cmp rcx, rax
jb 0x180068595
mov qword [rsp + 0x70], rcx
lea r9, [rsp + 0x70]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x180068873
cmp rdi, rsi
jae 0x180068778
mov rax, r14
mov r8, rsi
shr rax, 1
sub r8, rdi
mov rdx, rdi
lea rcx, [rdi + rax*2]
call sym.KERNEL32.dll_RtlMoveMemory
mov r8, qword [r13 + 8]
lea rdx, [r14 - 8]
mov rcx, rdi
add rsi, r14
call fcn.1800179d8
movzx ecx, word [r13]
mov eax, dword [r15]
add rcx, 2
shr rcx, 1
mov dword [rdi + rcx*2], eax
mov eax, dword [r15 + 4]
mov dword [rdi + rcx*2 + 4], eax
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x70]
mov edi, 8
mov qword [rbp - 0x70], r12
mov r9d, edi
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov rax, qword [rsp + 0x60]
mov ecx, esi
sub ecx, eax
mov qword [rsp + 0x40], r12
inc ecx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x103
jne 0x180068835
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
js 0x180068873
mov ebx, dword [rsp + 0x78]
test ebx, ebx
js 0x180068873
sub esi, dword [rsp + 0x60]
lea r8, [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x78]
mov r9d, edi
mov dword [rbp - 0x68], esi
mov dword [rbp - 0x64], r12d
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
cmp qword [rsp + 0x60], r12
je 0x180068899
mov r9d, 0x8000
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x60]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800688b1
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret