Function at 0x14001c830
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140054358]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
cmp ecx, 1
jne 0x14001c929
lea rdx, str.ERROR:_You_must_provide_an_input_path_to_an_ElbeeCrypt_symmetric_key_file.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._tExample:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
mov rdx, qword [rbx]
mov rcx, rax
call fcn.140016b80
mov rcx, rax
lea rdx, [0x140043460]
call fcn.140016b80
mov rcx, rax
lea rdx, str._path_to_elbeecrypt__SHA_256_of_your_key__key.
call fcn.140016b80
lea rdx, [0x140054120]
cmp qword [0x140054138], 0x10
cmovae rdx, qword [0x140054120]
mov r8, qword [0x140054130]
mov rcx, rax
call fcn.140017580
lea rdx, [0x14004342c]
mov rcx, rax
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [r13 - 1]
jmp 0x14001d4af
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x48], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r13b
jne 0x14001c940
lea rcx, [rbp - 0x48]
call fcn.140012630
nop
lea rax, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
call fcn.140017150
mov edi, 4
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14001c9c3
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c9be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c9be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x38]
call fcn.14003c218
mov edx, eax
mov ebx, 0xa
lea r12d, [rbx - 9]
test eax, eax
jne 0x14001ca4d
mov r8d, dword [rbp + 0x48]
test r12b, r8b
mov eax, 0x1ff
mov ecx, 0x16d
cmovne eax, ecx
mov dword [rsp + 0x34], eax
bt r8d, 0xa
jae 0x14001ca3e
mov eax, dword [rbp + 0x4c]
cmp eax, 0xa000000c
jne 0x14001ca33
mov eax, edi
jmp 0x14001ca6f
cmp eax, 0xa0000003
jne 0x14001ca3e
mov eax, ebx
jmp 0x14001ca6f
movzx eax, r8b
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14001ca6f
mov dword [rsp + 0x34], 0xffff
sub eax, 2
je 0x14001ca6c
sub eax, r12d
je 0x14001ca6c
sub eax, 0x32
je 0x14001ca6c
cmp eax, 0x46
mov eax, r13d
jne 0x14001ca6f
mov eax, r12d
mov dword [rsp + 0x30], edx
lea rcx, [0x140054190]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rsi, [0x140054120]
test eax, eax
je 0x14001cb87
cmp eax, r12d
je 0x14001cb8f
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x38]
call fcn.14003c218
mov edx, eax
test eax, eax
jne 0x14001caf6
mov ecx, dword [rbp + 0x48]
bt ecx, 0xa
jae 0x14001cae9
mov eax, dword [rbp + 0x4c]
cmp eax, 0xa000000c
jne 0x14001cae2
mov ebx, edi
jmp 0x14001cb10
cmp eax, 0xa0000003
je 0x14001cb10
mov ebx, ecx
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x14001cb10
sub eax, 2
je 0x14001cb0d
sub eax, r12d
je 0x14001cb0d
sub eax, 0x32
je 0x14001cb0d
cmp eax, 0x46
mov ebx, r13d
jne 0x14001cb10
mov ebx, r12d
test edx, edx
je 0x14001cb22
lea eax, [rbx - 1]
test eax, 0xfffffff7
jne 0x14001d4f5
cmp ebx, 2
jne 0x14001cb8f
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x78]
call fcn.140022a10
nop
mov dword [rsp + 0x30], 5
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140023ad0
lea edi, [rbx + 5]
mov rdx, rsi
cmp qword [0x140054138], 0x10
cmovae rdx, qword [0x140054120]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14001cb6e
mov rax, qword [rax]
cmp r8, qword [0x140054130]
jne 0x14001cb8f
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001cb8f
xor bl, bl
jmp 0x14001cb91
test edx, edx
jne 0x14001d4df
mov bl, 1
test dil, 2
je 0x14001cbe9
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14001cbd8
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cbd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cbd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
test dil, 1
je 0x14001cc31
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14001cc31
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cc2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
test bl, bl
je 0x14001cc8e
lea rdx, str.ERROR:_The_input_path_must_point_to_an_existing_ElbeeCrypt_symmetric_key_file_with_extension_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140016b80
cmp qword [0x140054138], 0x10
cmovae rsi, qword [0x140054120]
mov r8, qword [0x140054130]
mov rdx, rsi
mov rcx, rax
call fcn.140017580
lea rdx, str.._Try_your_input_again.
mov rcx, rax
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001d4a3
lea rcx, str.username
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x78], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14001ccb0
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140012630
nop
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
sub rax, r8
mov r15d, 9
lea r14, str.C:Users_
cmp rax, r15
jb 0x14001cd63
lea rax, [r8 + 9]
mov qword [rbp - 0x78], rax
lea rbx, [rsp + 0x78]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x78]
lea rax, [0x140043519]
cmp rax, rbx
jbe 0x14001cd26
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14001cd26
cmp rbx, r14
ja 0x14001cd1e
mov rsi, r13
jmp 0x14001cd29
mov rsi, rbx
sub rsi, r14
jmp 0x14001cd29
mov rsi, r15
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
sub r15, rsi
lea rdx, [r14 + 9]
add rdx, rsi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
jmp 0x14001cd80
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140017a50
mov qword [rbp - 0x68], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or edi, 8
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rax, qword [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x58]
call fcn.140017150
or edi, 0x10
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14001ce1b
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ce16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14001ce6b
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ce66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
movdqa xmm0, xmmword [0x1400431d0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
lea rdx, str.Base_path:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
mov rcx, rax
lea rdx, [rbp + 0x58]
call fcn.1400166e0
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [0x1400431e0]
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x78]
call fcn.14001f8f0
nop
lea rdx, str.LibSodium_Init:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
mov rbx, rax
call fcn.140023c50
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.14001b930
nop
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x78]
call fcn.140020cb0
nop
lea rdx, str.Verifying_key....
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._tFrom_filename:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rax
call fcn.140017580
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._tFrom_engine:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, rax
call fcn.140017580
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Hashes_check_out:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
mov rbx, rax
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rcx, qword [rbp - 8]
mov r8, qword [rbp + 8]
cmp r8, qword [rbp - 0x18]
jne 0x14001cff9
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001cff9
mov al, 1
jmp 0x14001cffb
xor al, al
lea rcx, str.true
lea rdx, str.false__either_the_file_was_renamed_or_the_key_was_tampered_with_
test al, al
cmovne rdx, rcx
mov rcx, rbx
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140017db0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x38]
call fcn.1400181a0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.140015330
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rbx, [rax + 0x20]
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x48]
mov qword [rbp - 0x78], rcx
lea rdx, [rbp + 0x38]
mov rcx, rax
call fcn.1400181a0
nop
mov qword [rsp + 0x50], rbx
lea r9, [fcn.140014450]
mov r8, r12
mov edx, 0x20
lea rcx, [rbp + 0x38]
call fcn.14003c800
lea rdx, str.Decryption_routines_started_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Your_key_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140016b80
mov rbx, rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x78]
call fcn.140020cb0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14001d112
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140017580
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14001d16c
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d167
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d167
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
lea r8, [rbp + 0x78]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.14001ab10
nop
mov rsi, qword [rsp + 0x68]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
sub rax, rbx
sar rax, 5
cmp rax, 1
jae 0x14001d1a5
mov r12d, 0xffffffff
jmp 0x14001d2cc
lea rax, [0x1400540c0]
cmp qword [0x1400540d8], 0x10
cmovae rax, qword [0x1400540c0]
mov qword [rsp + 0x30], rax
mov rax, qword [0x1400540d0]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.140017150
or edi, 0x20
lea rax, str.Desktop
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140017150
bts edi, 8
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x68]
call fcn.1400181a0
or edi, 0x40
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call fcn.140019730
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x48]
call fcn.1400181a0
bts edi, 7
mov dword [rsp + 0x30], edi
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.140019730
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x48]
call fcn.1400239a0
nop
lea rcx, [rbp - 0x48]
call fcn.140015200
nop
lea rcx, [rbp - 0x68]
call fcn.140015200
nop
lea rcx, [rsp + 0x78]
call fcn.140015200
nop
lea rcx, [rbp + 0x38]
call fcn.140015200
lea rdx, [0x140017db0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, str.Your_files_have_been_decrypted__Have_a_secure_day_:_
call fcn.140016b80
lea rdx, [0x140017db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r12d, r13d
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14001d336
cmp rbx, rsi
je 0x14001d2ec
mov rcx, rbx
call fcn.140015200
add rbx, 0x20
cmp rbx, rsi
jne 0x14001d2d6
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001d320
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d320
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003c90c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r13
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14001d3f3
mov rdi, qword [rsp + 0x50]
cmp rbx, rdi
je 0x14001d3a9
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001d38b
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001d386
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001d3d6
mov rcx, r8
call fcn.14003c90c
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
add rbx, 0x20
cmp rbx, rdi
jne 0x14001d350
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001d3dd
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d3dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14003c90c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14001d431
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d42c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d42c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14001d47f
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d47a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d47a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003c90c
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
lea rcx, [rbp + 0x78]
call fcn.14001f970
nop
lea rcx, [rbp + 0x58]
call fcn.140015200
nop
lea rcx, [rbp + 0x18]
call fcn.140015200
mov eax, r12d
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14003ccd0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x18]
lea rdx, [rsp + 0x30]
lea rcx, str.exists
call fcn.14001a5d0
int3
lea r8, [rbp + 0x18]
lea rcx, str.status
call fcn.14001a630
int3