Function at 0x140029890
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Get disk size
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov r14, rdx
xor r13d, r13d
mov dword [rbp - 0x41], r13d
mov r8d, dword [0x1401c4d60]
imul r8d, r8d
mov eax, 0x6bca1af3
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 8
jne 0x1400298fb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x49], rbx
mov rax, qword [r14]
mov esi, 1
cmp dword [rax - 0x10], 0
je 0x140029995
movzx eax, word [rax]
cmp ax, word [0x14014d8b8]
jne 0x140029933
mov eax, r13d
jmp 0x140029937
sbb eax, eax
or eax, esi
test eax, eax
je 0x140029995
lea rcx, [rbp - 9]
call fcn.140028210
nop
mov dword [rbp - 0x41], esi
mov rdx, qword [rax]
mov eax, r13d
test rdx, rdx
setne al
test eax, eax
jne 0x140029963
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [r14]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140029987
add rax, 2
test cx, cx
jne 0x140029970
mov eax, r13d
jmp 0x14002998c
sbb eax, eax
or eax, 1
test eax, eax
je 0x140029995
xor dil, dil
jmp 0x140029998
mov dil, 1
or r15, 0xffffffffffffffff
test byte [rbp - 0x41], 1
je 0x1400299c2
and dword [rbp - 0x41], 0xfffffffe
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], r15d
jg 0x1400299be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x49]
test dil, dil
je 0x140029b3a
lea rcx, [rbp + 0xf]
call fcn.140028210
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140029b19
cmp dword [rdi + 0x10], 0
jl 0x140029a1c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140029a1c
call fcn.140002400
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140029a13
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x140029b15
movsxd r14, dword [r13 - 0x10]
test r14d, r14d
jne 0x140029a7e
mov rsi, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x140029b19
cmp dword [rdi + 0x10], r14d
jge 0x140029a59
cmp dword [rbx - 0xc], r14d
jge 0x140029a49
mov ecx, 0x80070057
call fcn.140001920
int3
xor r13d, r13d
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140029b19
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140029a6c
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140029b15
test r13, r13
jne 0x140029a8e
mov ecx, 0x80070057
call fcn.140001920
int3
mov eax, dword [rbx - 0x10]
mov dword [rbp + 0x77], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test r14d, r14d
jns 0x140029aad
mov ecx, 0x80070057
call fcn.140001920
int3
sub esi, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, esi
jge 0x140029aca
mov edx, r14d
lea rcx, [rbp - 0x49]
call fcn.1400023a0
mov rbx, qword [rbp - 0x49]
mov eax, dword [rbp + 0x77]
lea rdi, [r14 + r14]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x140029aee
lea r8, [rbx + r12*2]
call fcn.1400ceaf4
jmp 0x140029af6
mov r8, r13
call fcn.1400cebf0
cmp r14d, dword [rbx - 0xc]
jg 0x140029b0a
mov dword [rbx - 0x10], r14d
xor r13d, r13d
mov word [rdi + rbx], r13w
jmp 0x140029b19
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [rbp - 0x49], rax
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140029b31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x49]
jmp 0x14002a26b
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov edi, 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rbp + 0x77], rax
cmp rax, 0xffffffffffffffff
jne 0x140029cc9
lea rcx, [rbp + 7]
call fcn.140028210
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x140029cc0
cmp dword [rdi + 0x10], 0
jl 0x140029bc3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140029bc3
call fcn.140002400
mov rbx, rax
lock add dword [rdi + 0x10], r12d
jg 0x140029bba
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x140029cbc
movsxd r14, dword [r13 - 0x10]
test r14d, r14d
jne 0x140029c25
mov rsi, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x140029cc0
cmp dword [rdi + 0x10], r14d
jge 0x140029c00
cmp dword [rbx - 0xc], r14d
jge 0x140029bf0
mov ecx, 0x80070057
call fcn.140001920
int3
xor r13d, r13d
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140029cc0
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140029c13
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x140029cbc
test r13, r13
jne 0x140029c35
mov ecx, 0x80070057
call fcn.140001920
int3
mov eax, dword [rbx - 0x10]
mov dword [rbp + 0x77], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test r14d, r14d
jns 0x140029c54
mov ecx, 0x80070057
call fcn.140001920
int3
sub esi, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, esi
jge 0x140029c71
mov edx, r14d
lea rcx, [rbp - 0x49]
call fcn.1400023a0
mov rbx, qword [rbp - 0x49]
mov eax, dword [rbp + 0x77]
lea rdi, [r14 + r14]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x140029c95
lea r8, [rbx + r12*2]
call fcn.1400ceaf4
jmp 0x140029c9d
mov r8, r13
call fcn.1400cebf0
cmp r14d, dword [rbx - 0xc]
jg 0x140029cb1
mov dword [rbx - 0x10], r14d
xor r13d, r13d
mov word [rdi + rbx], r13w
jmp 0x140029cc0
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [rbp - 0x49], rax
mov rdx, qword [rbp + 7]
jmp 0x140029b1d
xor eax, eax
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x21]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140029d5d
lea rcx, [rbp + 0x17]
call fcn.140028210
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140029d3c
cmp dword [rbx + 0x10], 0
jl 0x140029d2e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140029d2e
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140029d24
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x140029d3c
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.1400022b0
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002a25e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a25e
cmp dword [rbp - 0x1d], 0
je 0x140029dc8
lea rcx, [rbp - 1]
call fcn.140028210
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140029dbf
cmp dword [rbx + 0x10], 0
jl 0x140029db1
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140029db1
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140029da7
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x140029dbf
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.1400022b0
nop
mov rdx, qword [rbp - 1]
jmp 0x140029d40
cmp dword [rbp - 0x21], 0
je 0x14002a262
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
mov edx, dword [rbp - 0x21]
lea rcx, [rbp - 0x39]
call fcn.14002a560
mov dword [rbp + 0x7f], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x7f]
mov r8d, dword [rbp - 0x21]
mov r14, qword [rbp - 0x39]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140029e31
test r14, r14
je 0x14002a262
mov rcx, r14
call fcn.1400ce2b0
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
jmp 0x14002a262
xor r12b, r12b
xor r13b, r13b
movzx eax, byte [r14]
cmp al, 0xff
jne 0x140029e50
cmp byte [r14 + 1], 0xfe
jne 0x140029e50
mov r12b, 1
mov edi, 2
jmp 0x140029e87
cmp al, 0xfe
jne 0x140029e69
cmp byte [r14 + 1], 0xff
jne 0x140029e69
mov r12b, 1
movzx r13d, r12b
mov edi, 2
jmp 0x140029e87
cmp al, 0xef
jne 0x140029f39
cmp byte [r14 + 1], 0xbb
jne 0x140029f39
cmp byte [r14 + 2], 0xbf
jne 0x140029f39
movsxd rdx, edi
add rdx, r14
mov rdi, qword [rbp - 0x31]
cmp rdx, rdi
jne 0x140029e9f
mov rdi, r14
mov qword [rbp - 0x31], r14
jmp 0x140029eb9
cmp r14, rdx
je 0x140029eb9
sub rdi, rdx
mov r8, rdi
mov rcx, r14
call fcn.1400ce300
add rdi, r14
mov qword [rbp - 0x31], rdi
mov r9d, dword [0x1401c4d60]
test r13b, r13b
je 0x140029f44
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
xor r13d, r13d
cmp ecx, 7
jne 0x140029f11
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r9d, dword [0x1401c4d60]
mov rcx, r14
cmp r14, rdi
je 0x140029f47
nop dword [rax]
movzx r8d, byte [rcx + 1]
movzx edx, byte [rcx]
mov byte [rcx + 1], dl
mov byte [rcx], r8b
add rcx, 2
cmp rcx, rdi
jne 0x140029f20
jmp 0x140029f47
mov rdi, qword [rbp - 0x31]
mov r9d, dword [0x1401c4d60]
xor r13d, r13d
sub rdi, r14
cmp byte [r14 + rdi - 1], 0
je 0x14002a09f
mov ecx, r9d
imul ecx, r9d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 8
jne 0x14002a01a
mov edx, r13d
nop
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
add r9d, eax
inc edx
cmp edx, 0x100
jl 0x140029f80
mov dword [0x1401c4d60], r9d
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x39]
call fcn.14002a560
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x14002a075
cmp r8d, 1
jle 0x14002a06f
nop
mov eax, r8d
cdq
idiv esi
inc esi
add esi, edx
cmp esi, r8d
jl 0x14002a060
mov dword [0x1401c4d60], esi
mov r14, qword [rbp - 0x39]
mov byte [r14 + rdi], 0
test r12b, r12b
je 0x14002a1a3
lea rdx, [rdi + 2]
lea rcx, [rbp - 0x39]
call fcn.14002a560
mov rsi, qword [rbp - 0x39]
mov byte [rsi + rdi + 1], 0
jmp 0x14002a0bf
test r12b, r12b
je 0x14002a1a3
lea rdx, [rdi + 2]
lea rcx, [rbp - 0x39]
call fcn.14002a560
mov rsi, qword [rbp - 0x39]
mov word [rsi + rdi], 0
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x19], rdi
test rsi, rsi
je 0x14002a11c
test rsi, 0xffffffffffff0000
jne 0x14002a106
movzx esi, si
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x14002a132
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.1400025a0
jmp 0x14002a12e
mov rax, r15
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x14002a110
jmp 0x14002a11f
mov eax, r13d
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x19]
call fcn.1400022b0
mov rdi, qword [rbp - 0x19]
lea rsi, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x14002a187
cmp dword [rbx + 0x10], 0
jl 0x14002a176
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x14002a176
mov rcx, rsi
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002a16c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x14002a187
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.1400022b0
nop
lock add dword [rsi + 0x10], 0xffffffff
jg 0x14002a240
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a240
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x11], rax
mov rdx, r14
lea rcx, [rbp - 0x11]
call fcn.140003350
nop
mov rdx, qword [rbp - 0x11]
lea rdi, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rdi, rbx
je 0x14002a21f
cmp dword [rbx + 0x10], 0
jl 0x14002a211
mov rax, qword [rbx]
cmp qword [rdi], rax
jne 0x14002a211
mov rcx, rdi
call fcn.140002400
mov rsi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002a207
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x49], rax
jmp 0x14002a21f
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x49]
call fcn.1400022b0
nop
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14002a232
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x49]
call fcn.140027080
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14002a25a
call fcn.1400ce2b0
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
mov r12, qword [rbp + 0x77]
mov rbx, qword [rbp - 0x49]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14002a28e
cmp rax, qword [rbx - 0x18]
jne 0x14002a28e
lea rdi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14002a2cb
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x14002a2aa
call fcn.140002490
int3
mov eax, dword [rbx - 0x10]
mov dword [rdi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.1400cebf0
lea rax, [rdi + 0x18]
mov rdi, qword [rbp + 0x67]
mov qword [rdi], rax
or dword [rbp - 0x41], 2
lock add dword [rbx - 8], 0xffffffff
jg 0x14002a2ef
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret