Function at 0x1000bd08c
Capabilities:
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor edi, edi
mov r15, rcx
mov ebp, 0x8008000d
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rdi
cmp rdx, rdi
je 0x1000bd8e3
cmp word [rdx], di
je 0x1000bd8e3
mov rsi, qword [rcx]
lea r13d, [rdi + 0x78]
mov rax, qword [rsi + 0x738]
mov r12d, dword [rsi + 0x14]
mov qword [rsp + 0x40], r13
mov qword [r11 - 0x68], rax
mov rax, qword [rsi + 0x740]
add r12d, r13d
mov qword [r11 - 0x60], rax
mov rax, qword [rsi + 0x748]
mov ecx, r12d
mov qword [r11 - 0x58], rax
mov eax, dword [rsi + 0x750]
mov ebx, r12d
mov dword [rsp + 0xf0], eax
mov dword [r11 - 0x50], eax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r14, rax
cmp rax, rdi
jne 0x1000bd16d
mov ebp, 0x8008000e
mov rcx, qword [0x1000dedd8]
lea rbx, [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8df
test byte [rcx + 0x1c], 1
je 0x1000bd8df
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xc]
lea r8, [0x100002ec8]
mov r9d, r12d
call fcn.100020d8c
jmp 0x1000bd8df
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [r12 + r14]
lea rcx, [r14 + 0x78]
cmp rcx, rax
mov qword [rsp + 0x48], rax
lea rdi, [0x100002ec8]
lea rbx, [0x1000dedd8]
jg 0x1000bd19f
cmp r12d, r13d
jae 0x1000bd1c2
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd1c2
test byte [rcx + 0x1c], 1
je 0x1000bd1c2
mov rcx, qword [rcx + 0x10]
mov edx, 0xd
mov r8, rdi
call fcn.100020584
mov rcx, r14
mov rdx, rsi
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rsi, [r14 + 0x78]
test rsi, rsi
je 0x1000bd8b4
cmp rsi, r14
jl 0x1000bd8b4
mov rax, qword [r15]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rax + 0x738]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x1000bd8b4
cmp ecx, r12d
ja 0x1000bd8b4
cmp dword [rsp + 0x70], 0
jbe 0x1000bd238
and dword [rsi], 0
mov rax, qword [r15]
lea r8, [rsi + 8]
mov ecx, dword [rax + 0x738]
mov r13d, 0x80
mov qword [rsp + 0x68], r8
mov dword [rsi + 4], ecx
lea rsi, [r8 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x1000bd89b
cmp rsi, r14
jl 0x1000bd89b
mov rax, qword [r15]
mov ecx, dword [rax + 0x750]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x1000bd89b
cmp ecx, r12d
ja 0x1000bd89b
mov eax, dword [rsp + 0xf0]
test eax, eax
je 0x1000bd29c
mov dword [rsi], 6
mov rax, qword [r15]
lea r9, [rsi + 8]
mov ecx, dword [rax + 0x750]
add r13d, 8
mov qword [rsp + 0x60], r9
mov dword [rsi + 4], ecx
lea rsi, [r9 + rcx]
mov qword [rsp + 0x40], r13
test rsi, rsi
je 0x1000bd882
cmp rsi, r14
jl 0x1000bd882
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rax, [rsi + rcx]
cmp rax, rdx
jg 0x1000bd882
cmp ecx, r12d
ja 0x1000bd882
mov r13d, dword [rsp + 0x7c]
test r13d, r13d
je 0x1000bd2fb
add dword [rsp + 0x40], 8
mov dword [rsi], 3
mov rax, qword [r15]
mov ecx, dword [rax + 0x744]
lea rdx, [rsi + 8]
mov dword [rsi + 4], ecx
lea rsi, [rdx + rcx]
mov qword [rsp + 0x50], rdx
mov eax, 0xa0
mov qword [rsp + 0x90], rax
mov rdx, qword [r15]
mov rdx, qword [rax + rdx]
mov rcx, r15
call fcn.1000be260
mov r10, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1000bd541
mov rcx, qword [r15]
cmp rax, rcx
jl 0x1000bd541
add rcx, qword [rcx + 0x98]
lea rax, [rax + 0x18]
cmp rax, rcx
jg 0x1000bd541
movsxd rax, dword [r10]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + rax*4 + 0x70]
mov dword [rsp + 0xf8], eax
test eax, eax
jne 0x1000bd394
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd538
test byte [rcx + 0x1c], 2
je 0x1000bd538
mov r9d, dword [r10 + 4]
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x11]
mov r8, rdi
call fcn.100020d8c
jmp 0x1000bd533
mov ecx, dword [r10]
test ecx, ecx
je 0x1000bd4ab
sub ecx, 3
je 0x1000bd457
sub ecx, 2
je 0x1000bd40c
cmp ecx, 1
jne 0x1000bd6ca
mov r13, qword [rsp + 0x60]
test r13, r13
je 0x1000bd6a6
cmp r13, r14
jl 0x1000bd6a6
mov ecx, dword [rsp + 0xf0]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x1000bd6a6
cmp ecx, r12d
ja 0x1000bd6a6
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.1000bda6c
add r13, 0x10
mov qword [rsp + 0x60], r13
jmp 0x1000bd4f9
test rsi, rsi
je 0x1000bd6ee
cmp rsi, r14
jl 0x1000bd6ee
mov r9d, dword [rsp + 0x84]
lea rax, [rsi + r9]
cmp rax, qword [rsp + 0x48]
jg 0x1000bd6ee
cmp r9d, r12d
ja 0x1000bd6ee
mov r8, rsi
mov rdx, r10
mov rcx, r15
call fcn.1000bdd08
mov r11d, eax
add rsi, r11
jmp 0x1000bd4fc
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1000bd712
cmp rcx, r14
jl 0x1000bd712
mov eax, r13d
add rax, rcx
cmp rax, qword [rsp + 0x48]
jg 0x1000bd712
cmp r13d, r12d
ja 0x1000bd712
mov r8, rcx
mov r9d, r13d
mov rdx, r10
mov rcx, r15
call fcn.1000bdb54
mov rdx, qword [rsp + 0x50]
mov r11d, eax
add rdx, r11
mov qword [rsp + 0x50], rdx
jmp 0x1000bd4fc
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x1000bd76f
cmp r13, r14
jl 0x1000bd76f
mov ecx, dword [rsp + 0x70]
lea rax, [r13 + rcx]
cmp rax, qword [rsp + 0x48]
jg 0x1000bd76f
cmp ecx, r12d
ja 0x1000bd76f
mov r9d, ecx
mov r8, r13
mov rdx, r10
mov rcx, r15
call fcn.1000bd938
add r13, 0xc
mov qword [rsp + 0x68], r13
mov r11d, eax
test r11d, r11d
je 0x1000bd736
mov eax, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x98]
sub eax, r11d
add dword [rsp + 0x40], r11d
mov dword [rsp + rcx*4 + 0x70], eax
mov eax, dword [rsp + 0x88]
mov r13d, dword [rsp + 0x7c]
mov dword [rsp + 0xf0], eax
mov r10, qword [rsp + 0x58]
mov rdx, qword [r10 + 8]
jmp 0x1000bd30f
mov rax, qword [rsp + 0x90]
add rax, 8
cmp rax, 0x738
mov qword [rsp + 0x90], rax
jl 0x1000bd308
mov rax, qword [rsp + 0x40]
cmp eax, r12d
jne 0x1000bd856
xor r15d, r15d
lea rdx, [r14 + 0x14]
lea ebp, [r15 + 0x10]
mov ecx, r15d
movzx eax, byte [rdx]
imul ecx, ecx, 0x65
inc rdx
add ecx, eax
sub rbp, 1
jne 0x1000bd57d
lea edx, [r12 - 0x78]
mov ebp, 0x8008000d
cmp edx, r15d
jbe 0x1000bd5b4
lea r8, [r14 + 0x78]
movzx eax, byte [r8]
imul ecx, ecx, 0x65
dec edx
add ecx, eax
inc r8
cmp edx, r15d
ja 0x1000bd5a1
mov dword [r14 + 0xc], ecx
mov rcx, qword [0x1000dedd8]
mov rsi, qword [rsp + 0xe8]
cmp rcx, rbx
je 0x1000bd5eb
test byte [rcx + 0x1c], 4
je 0x1000bd5eb
mov rcx, qword [rcx + 0x10]
mov edx, 0x18
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], r12d
call fcn.100020b88
mov ecx, 1
call fcn.1000aaec4
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov r9, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1000bd80f
mov edx, 0x2080
mov rcx, rsi
mov dword [rsp + 0xe8], r15d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, r15d
jne 0x1000bd669
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd669
test byte [rcx + 0x1c], 2
je 0x1000bd669
mov rcx, qword [rcx + 0x10]
mov edx, 0x19
mov r8, rdi
call fcn.100020584
lea r9, [rsp + 0xe8]
mov r8d, r12d
mov rdx, r14
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r15d
je 0x1000bd7bf
mov eax, dword [rsp + 0xe8]
cmp eax, r12d
jne 0x1000bd793
mov ebp, r15d
jmp 0x1000bd801
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0x13
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov r9d, dword [r10]
mov edx, 0x16
jmp 0x1000bd75e
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0x15
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0x14
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov rax, qword [rsp + 0x58]
mov edx, 0x17
mov r9d, dword [rax + 4]
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100020d8c
jmp 0x1000bd8d7
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0x12
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd801
test byte [rcx + 0x1c], 1
je 0x1000bd801
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.100020f2c
jmp 0x1000bd801
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd7ed
test byte [rcx + 0x1c], 1
je 0x1000bd7ed
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9d, eax
mov r8, rdi
call fcn.100020d8c
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000bd8d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd83d
test byte [rcx + 0x1c], 1
je 0x1000bd83d
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, rdi
call fcn.100020d8c
mov ebp, esi
and ebp, 0x1000ffff
or ebp, 0x80080000
cmp esi, r15d
cmovle ebp, esi
jmp 0x1000bd8d7
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov rcx, qword [rcx + 0x10]
mov edx, 0x1d
mov r9d, r12d
mov r8, rdi
mov dword [rsp + 0x20], eax
call fcn.100020f2c
jmp 0x1000bd8d7
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0x10
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0xf
jmp 0x1000bd8cb
mov rcx, qword [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd8d7
test byte [rcx + 0x1c], 1
je 0x1000bd8d7
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
mov r8, rdi
call fcn.100020584
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, ebp
jmp 0x1000bd916
mov rcx, qword [0x1000dedd8]
lea rbx, [0x1000dedd8]
cmp rcx, rbx
je 0x1000bd911
test byte [rcx + 0x1c], 1
je 0x1000bd911
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ec8]
mov edx, 0xb
call fcn.100020584
mov eax, 0x80080057
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret