Function at 0x4017e0
Capabilities:
Clear file content
Read file on windows
Write file on windows

Disassembly:
push rbp
mov eax, 0x2458
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.00415da0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x0041d2d0]
movzx eax, word [rax]
mov rsi, rcx
mov qword [rbp + 0x2428], rdx
add rax, 0xf
and eax, 0x1fff0
call fcn.00415da0
sub rsp, rax
mov rax, qword [0x0041d2e0]
lea r12, [rsp + 0x50]
movzx eax, word [rax]
add rax, 0xf
and eax, 0x1fff0
call fcn.00415da0
sub rsp, rax
mov rax, qword [0x0041d3c0]
lea r13, [rsp + 0x50]
movzx eax, word [rax]
add rax, 0xf
and eax, 0x1fff0
call fcn.00415da0
mov rcx, qword [0x0041d390]
sub rsp, rax
call fcn.00404920
lea rdi, [rsp + 0x50]
movzx eax, al
add rax, 0xf
and eax, 0x1f0
call fcn.00415da0
mov rcx, qword [0x0041d3a0]
sub rsp, rax
call fcn.00404920
lea r14, [rsp + 0x50]
movzx eax, al
add rax, 0xf
and eax, 0x1f0
call fcn.00415da0
lea rdx, [0x00419010]
sub rsp, rax
mov rcx, rsi
lea rax, [rsp + 0x50]
mov qword [rbp - 0x18], rax
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
mov rbx, rax
je 0x4019e0
xor edx, edx
mov r8d, 2
mov rcx, rax
call fcn.00416f80
mov rcx, rbx
call fcn.00416d30
cmp rax, 0x78c
mov r15, rax
jle 0x4019d0
lea rax, [rax - 0x78c]
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
mov qword [rbp - 0x20], rax
call fcn.00416f80
mov r9, rbx
mov edx, 1
mov rcx, r13
mov rax, qword [0x0041d2e0]
movzx r8d, word [rax]
call sub.msvcrt.dll_fread
mov r9, rbx
mov edx, 1
mov rcx, r12
mov rax, qword [0x0041d2d0]
movzx r8d, word [rax]
call sub.msvcrt.dll_fread
mov rcx, rdi
mov r9, rbx
mov edx, 1
mov rax, qword [0x0041d3c0]
movzx r8d, word [rax]
call sub.msvcrt.dll_fread
mov r9, rbx
mov edx, 1
mov rcx, rbp
mov r8d, 0x10
mov qword [rbp - 0x30], rbp
call sub.msvcrt.dll_fread
lea rax, [rbp + 0x70]
mov rcx, rdi
lea rdx, [rbp + 0x17ec]
mov qword [rbp - 0x28], rax
call fcn.00402900
mov rdi, qword [0x0041d3c0]
cmp ax, word [rdi]
je 0x4019f0
lea rcx, str._t_tDBG:_error_on_import_pub.key_from_file.
call sub.msvcrt.dll_puts
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor eax, eax
lea rsp, [rbp + 0x23d8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str._t_tDBG:_min._size_error.
call sub.msvcrt.dll_puts
jmp 0x4019af
lea rcx, str._t_tDBG:_Error_on_open_file._n
call sub.msvcrt.dll_perror
xor eax, eax
jmp 0x4019b9
mov r8, qword [0x0041d390]
lea rdi, [rbp - 0xe]
xor eax, eax
mov r9, r14
mov rdx, qword [0x0041d2f0]
mov qword [rsp + 0x20], rdi
mov rcx, r12
mov word [rbp - 0xe], ax
call fcn.00404590
test al, al
jne 0x401a2c
mov rax, qword [0x0041d3b0]
movzx eax, word [rax]
cmp word [rbp - 0xe], ax
je 0x401a40
lea rcx, str._t_tDBG:_decrypt_local_priv.key_failed.
call sub.msvcrt.dll_puts
jmp 0x4019af
mov r12, qword [rbp - 0x28]
mov rcx, r14
mov rdx, r12
call fcn.00402c90
mov r9, qword [rbp - 0x18]
mov rdx, r12
mov rcx, r13
mov r8, qword [0x0041d3a0]
mov qword [rsp + 0x20], rdi
call fcn.00404590
test al, al
jne 0x401a75
cmp word [rbp - 0xe], 0x2c
je 0x401a86
lea rcx, str._t_tDBG:_decrypt_uniq._file_password_failed.
call sub.msvcrt.dll_puts
jmp 0x4019af
mov rdi, qword [rbp - 0x18]
lea r12, [rbp + 0x30]
mov r8d, 0x100
lea rdx, [rbp + 0x10]
mov rcx, r12
mov rax, qword [rdi]
mov qword [rbp + 0x10], rax
mov rax, qword [rdi + 8]
mov qword [rbp + 0x18], rax
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x20], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x28], rax
mov rax, qword [rdi + 0x20]
mov qword [rbp - 0xc], rax
mov eax, dword [rdi + 0x28]
mov dword [rbp - 4], eax
call fcn.00413840
test eax, eax
jne 0x401dee
mov r14, qword [rbp - 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
cmp r14, 0x6400000
jle 0x401d16
call fcn.00416f80
mov rcx, qword [rbp + 0x2428]
mov edx, 1
mov r9, rbx
mov r8d, 0x280000
call sub.msvcrt.dll_fread
mov ecx, 0x64
mov rdi, rax
mov rax, r14
mov r14d, 8
cqo
idiv rcx
imul r13, rax, 0xa
mov r15, r13
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call fcn.00416f80
mov r9, rbx
mov edx, 1
add r15, r13
mov rcx, qword [rbp + 0x2428]
mov r8d, 0x280000
add rcx, rdi
call sub.msvcrt.dll_fread
add rdi, rax
sub r14d, 1
jne 0x401b2a
mov r8d, 2
mov rdx, 0xffffffffffd7f874
mov rcx, rbx
call fcn.00416f80
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
add rcx, rdi
call sub.msvcrt.dll_fread
mov rcx, qword [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0xc]
add edi, eax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x10
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp + 0x2428]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.004138a0
test eax, eax
jne 0x401f18
lea rcx, str._t_tDBG:_Data_successfully_decrypted.
mov r14, r13
mov r12d, 8
call sub.msvcrt.dll_puts
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00416f80
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdi, rax
xor r8d, r8d
mov rdx, r14
mov rcx, rbx
call fcn.00416f80
mov r9, rbx
mov edx, 1
add r14, r13
mov rcx, qword [rbp + 0x2428]
mov r8d, 0x280000
add rcx, rdi
call sub.msvcrt.dll_fwrite
add rdi, rax
sub r12d, 1
jne 0x401c1c
mov r8d, 2
mov rdx, 0xffffffffffd7f874
mov rcx, rbx
call fcn.00416f80
add rdi, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov rcx, rbx
call sub.msvcrt.dll_fclose
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rbp - 0x20]
xor r8d, r8d
mov rbx, rax
mov rcx, rax
call fcn.00401790
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x401d00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._t_tDBG:_Data_successfully_written.
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x4019b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._tERR_t_Error_on_set_end_of_file__err:_ld_r_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x401ce1
call fcn.00416f80
mov rax, qword [rbp - 0x20]
cmp rax, 0x500000
jg 0x401dc0
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8, rax
mov edx, 1
call sub.msvcrt.dll_fread
mov rdi, qword [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0xc]
mov dword [rsp + 0x48], 0
mov rcx, r12
mov dword [rsp + 0x40], 0x10
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbp + 0x2428]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], rdi
call fcn.004138a0
test eax, eax
jne 0x401f07
lea rcx, str._t_tDBG:_Data_successfully_decrypted.
call sub.msvcrt.dll_puts
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00416f80
mov r8, qword [rbp - 0x20]
mov r9, rbx
mov edx, 1
mov rcx, qword [rbp + 0x2428]
call sub.msvcrt.dll_fwrite
jmp 0x401c85
lea r10, [r15 - 0x50078d]
cmp r10, 0x5efffff
jbe 0x401dff
lea rcx, str._t_tDBG:_Data_successfully_decrypted.
call sub.msvcrt.dll_puts
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00416f80
jmp 0x401c85
lea rcx, str._t_tDBG:_chachapoly_init_failed.
call sub.msvcrt.dll_puts
jmp 0x4019af
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
call sub.msvcrt.dll_fread
mov r8d, 2
mov rdx, 0xffffffffffd7f874
mov rcx, rbx
mov r13, rax
call fcn.00416f80
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
add rcx, r13
call sub.msvcrt.dll_fread
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
lea rdx, [rbp - 0xc]
mov rdi, rax
mov rax, qword [rbp - 0x30]
mov dword [rsp + 0x48], 0
add r13d, edi
mov dword [rsp + 0x40], 0x10
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x2428]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
call fcn.004138a0
test eax, eax
jne 0x401f29
lea rcx, str._t_tDBG:_Data_successfully_decrypted.
call sub.msvcrt.dll_puts
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00416f80
mov rcx, qword [rbp + 0x2428]
mov r9, rbx
mov r8d, 0x280000
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rbx
mov r8d, 2
mov rdx, 0xffffffffffd7f874
mov r12, rax
call fcn.00416f80
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, qword [rbp + 0x2428]
add rcx, r12
call sub.msvcrt.dll_fwrite
jmp 0x401c85
lea rcx, str._t_tDBG:_decrypt_error._1_
call sub.msvcrt.dll_puts
jmp 0x4019af
lea rcx, str._t_tDBG:_decrypt_error._3_
call sub.msvcrt.dll_puts
jmp 0x401bdd
lea rcx, str._t_tDBG:_decrypt_error._2_
call sub.msvcrt.dll_puts
jmp 0x4019af