Function at 0x1400caaa0
Capabilities:
Set file attributes

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
xor r12d, r12d
mov dword [rbp + 8], 2
xorps xmm0, xmm0
mov dword [rbp + 0x1c], 0xfa0
xor eax, eax
mov dword [rbp + 0x20], 0x8009
mov qword [rbp - 0x64], rax
mov r14d, r9d
mov eax, dword [rbp + 0x120]
mov r15, r8
mov dword [rbp - 0x54], eax
lea rax, [rbp + 8]
mov qword [rbp - 0x30], rax
mov rbx, rdx
mov dword [rbp + 0x24], 0x6603
mov rdi, rcx
mov qword [rbp + 0x28], r12
mov dword [rbp + 0x30], r12d
mov qword [rsp + 0x50], 2
mov dword [rsp + 0x58], r12d
mov qword [rbp - 0x5c], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
movdqa xmmword [rbp - 0x20], xmm0
movups xmmword [rbp + 0xc], xmm0
movups xmmword [rsp + 0x5c], xmm0
movups xmmword [rsp + 0x6c], xmm0
movups xmmword [rsp + 0x7c], xmm0
movups xmmword [rbp - 0x74], xmm0
test rdx, rdx
je 0x1400cb168
lea rcx, str.Key_GUID:
call fcn.14000afb0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x1400cab94
lea rdx, [rsp + 0x40]
lea rcx, [0x14015fbb8]
call fcn.14000afb0
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
test r15, r15
je 0x1400cb179
test r14d, r14d
je 0x1400cb179
lea rdx, [rbp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x1400cb168
mov ebx, 0x10
mov qword [rsp + 0x1e0], rsi
mov edx, ebx
lea rcx, [rbp + 0xc]
call qword [sym.imp.cryptdll.dll_CDGenerateRandomBits]
movzx r8d, word [rbp + 0x38]
lea rcx, [rsp + 0x5c]
mov rdx, qword [rbp + 0x40]
sub r8, 4
add rdx, 2
call fcn.14011b4a0
mov rsi, qword [rbp + 0x100]
test rsi, rsi
je 0x1400cb050
test byte [rbp - 0x54], 4
mov eax, 0x8004
mov qword [rsp + 0x1a0], r13
mov r15d, r12d
mov r13d, 0x8002
cmovne r13d, eax
mov ecx, r13d
call fcn.1400042b0
mov edx, eax
lea ecx, [rbx + 0x30]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400cad3f
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], r15w
jne 0x1400cac52
add r8d, r8d
mov dword [rsp + 0x20], r12d
mov r9, r14
mov rdx, rsi
mov ecx, r13d
call fcn.1400032b0
test eax, eax
je 0x1400cad31
cmp dword [rbp + 0x118], r15d
je 0x1400cacaa
test rdi, rdi
je 0x1400cacaa
cmp r12d, ebx
jne 0x1400cacaa
movups xmm0, xmmword [r14]
mov r8, rdi
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.140007f00
lea rsi, [rsp + 0x40]
jmp 0x1400cacb5
mov rsi, r14
mov rbx, r12
test rdi, rdi
je 0x1400cacf6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x30], Ordinal_26
mov qword [rsp + 0x28], rcx
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
lea eax, [rax*2 + 2]
mov ecx, 0x8004
mov dword [rsp + 0x20], eax
call fcn.1400035d0
mov r15d, eax
test eax, eax
je 0x1400cad31
jmp 0x1400cad10
mov r8d, SQLAllocHandle
cmp ebx, 0x14
ja 0x1400cad04
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.14011b4a0
mov eax, dword [rbp + 0xf8]
lea rdx, [rbp - 0x10]
mov r9, qword [rbp + 0xf0]
lea rcx, [rbp + 8]
mov dword [rsp + 0x20], eax
call fcn.1400082c0
mov r15d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15d, r15d
jne 0x1400cad4b
lea rcx, str.ERROR_kuhl_m_dpapi_create_data___kull_m_dpapi_protect_masterkey_with_password_n
call fcn.14000afb0
mov r13, qword [rsp + 0x1a0]
xor r12d, r12d
cmp qword [rbp + 0x28], 0
je 0x1400cb160
mov rbx, qword [rbp - 0x30]
mov r14, r12
mov rsi, r12
mov rdi, r12
mov r15, r12
test rbx, rbx
je 0x1400cadb8
mov edx, dword [rbx + 0x28]
mov ecx, 0x40
add edx, 0x20
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x1400cadb8
movups xmm0, xmmword [rbx]
lea rcx, [rax + 0x20]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov r8d, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
call fcn.14011b4a0
mov eax, dword [rbx + 0x28]
add eax, 0x20
mov qword [rbp - 0x50], rax
mov rbx, qword [rbp - 0x28]
test rbx, rbx
je 0x1400cae03
mov edx, dword [rbx + 0x28]
mov ecx, 0x40
add edx, 0x20
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400cae03
movups xmm0, xmmword [rbx]
lea rcx, [rax + 0x20]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov r8d, dword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
call fcn.14011b4a0
mov eax, dword [rbx + 0x28]
add eax, 0x20
mov qword [rbp - 0x48], rax
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x1400cae36
mov edx, SQLAllocHandle
lea ecx, [rdx + 0x2c]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400cae36
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov eax, dword [rbx + 0x10]
mov dword [rdi + 0x10], eax
mov qword [rbp - 0x40], Ordinal_26
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400caea9
mov ecx, dword [rbx + 4]
mov edx, dword [rbx + 8]
add ecx, 0x1c
add edx, ecx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
test rax, rax
je 0x1400caea9
movups xmm0, xmmword [rbx]
lea rcx, [r15 + 0x1c]
movups xmmword [rax], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rax + 0x10], xmm1
mov eax, dword [rbx + 0x18]
mov dword [r15 + 0x18], eax
mov r8d, dword [rbx + 4]
mov rdx, qword [rbx + 0x1c]
call fcn.14011b4a0
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx + 8]
add rcx, 0x1c
mov rdx, qword [rbx + 0x24]
add rcx, r15
call fcn.14011b4a0
mov eax, dword [rbx + 8]
add eax, 0x1c
add eax, dword [rbx + 4]
mov qword [rbp - 0x38], rax
mov r8, qword [rbp - 0x38]
mov ecx, 0x40
add r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x50]
add r8, qword [rbp - 0x48]
sub rdx, 0xffffffffffffff80
add rdx, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400cb156
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x80]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [rax + 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movups xmmword [rax + 0x50], xmm1
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rax + 0x60], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rax + 0x70], xmm1
test r14, r14
je 0x1400caf31
mov r8, qword [rbp - 0x50]
lea rcx, [rax + 0x80]
mov rdx, r14
call fcn.14011b4a0
test rsi, rsi
je 0x1400caf4d
mov rcx, qword [rbp - 0x50]
mov rdx, rsi
mov r8, qword [rbp - 0x48]
sub rcx, 0xffffffffffffff80
add rcx, rbx
call fcn.14011b4a0
test rdi, rdi
je 0x1400caf70
mov rcx, qword [rbp - 0x48]
mov rdx, rdi
mov rax, qword [rbp - 0x50]
add rcx, rbx
mov r8, qword [rbp - 0x40]
sub rax, 0xffffffffffffff80
add rcx, rax
call fcn.14011b4a0
test r15, r15
je 0x1400caf97
mov rcx, qword [rbp - 0x40]
mov rdx, r15
mov rax, qword [rbp - 0x50]
add rcx, rbx
add rcx, qword [rbp - 0x48]
sub rax, 0xffffffffffffff80
mov r8, qword [rbp - 0x38]
add rcx, rax
call fcn.14011b4a0
mov rax, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x40]
sub rax, 0xffffffffffffff80
add rcx, qword [rbp - 0x38]
add rcx, qword [rbp - 0x48]
add rcx, rax
cmp dword [rbp + 0x128], 0
mov qword [rbp - 0x50], rcx
je 0x1400cafc5
lea rdx, [rsp + 0x50]
call fcn.140006d10
movups xmm0, xmmword [rsp + 0x5c]
lea rdx, [rbp + 0x50]
mov word [rbp + 0x98], r12w
movups xmm1, xmmword [rsp + 0x6c]
lea rcx, str.File__s__hidden__system_:
movaps xmmword [rbp + 0x50], xmm0
movups xmm0, xmmword [rsp + 0x7c]
movaps xmmword [rbp + 0x60], xmm1
movups xmm1, xmmword [rbp - 0x74]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm0, qword [rbp - 0x64]
movsd qword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm1
call fcn.14000afb0
mov r8d, dword [rbp - 0x50]
lea rcx, [rbp + 0x50]
mov rdx, rbx
call fcn.140008cd0
test eax, eax
je 0x1400cb139
mov edx, Ordinal_41
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400cb12a
lea rcx, [0x140167a88]
call fcn.14000afb0
jmp 0x1400cb14d
mov rsi, qword [rbp + 0x108]
test rsi, rsi
je 0x1400cad56
mov eax, dword [rbp + 0x110]
test eax, eax
je 0x1400cad56
cmp dword [rbp + 0x118], r12d
je 0x1400cb09c
test rdi, rdi
je 0x1400cb09c
cmp eax, ebx
jne 0x1400cb09c
movups xmm0, xmmword [rsi]
mov r8, rdi
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.140007f00
lea rsi, [rsp + 0x40]
jmp 0x1400cb0a4
mov rbx, rax
test rdi, rdi
je 0x1400cb0e2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x30], Ordinal_26
mov qword [rsp + 0x28], rcx
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
lea eax, [rax*2 + 2]
mov ecx, 0x8004
mov dword [rsp + 0x20], eax
call fcn.1400035d0
test eax, eax
je 0x1400cb119
jmp 0x1400cb0fc
mov r8d, SQLAllocHandle
cmp eax, 0x14
ja 0x1400cb0f0
mov r8, rax
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.14011b4a0
mov r9, r15
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 8]
call fcn.1400082c0
test eax, eax
jne 0x1400cad56
lea rcx, str.ERROR_kuhl_m_dpapi_create_data___kull_m_dpapi_protect_masterkey_with_userHash_n
call fcn.14000afb0
jmp 0x1400cad56
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_dpapi_create_data___SetFileAttributes__0x_08x__n
jmp 0x1400cb146
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_dpapi_create_data___kull_m_file_writeData__0x_08x__n
mov edx, eax
call fcn.14000afb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x1e0]
add rsp, 0x1a8
pop r15
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.ERROR_kuhl_m_dpapi_create_data___No_key_n
call fcn.14000afb0
add rsp, 0x1a8
pop r15
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret