Function at 0x1400169a0
Capabilities:
Encode data using xor
Generate random numbers via winapi
Hash data using sha256
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r13, qword [rbp + 0x348]
mov r12, r9
mov r15, r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov r9d, 1
mov qword [rsp + 0x30], rcx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140016a9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140016a4c
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140016a9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x140016a9f
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048080
mov rsi, 0xffffffffffffffff
test rax, rax
jne 0x140016a7b
xor edi, edi
jmp 0x140016a8a
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016a80
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov eax, esi
jmp 0x140017633
xorps xmm0, xmm0
xor edi, edi
movups xmmword [rbp + 0x110], xmm0
mov esi, edi
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
nop dword [rax + rax]
movups xmm1, xmmword [0x14026a7f0]
mov qword [rsp + 0x50], rdi
mov ebx, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmm0, xmmword [0x14026a7e0]
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xc0]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400176ec
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xc0]
call fcn.1400cd120
inc ebx
cmp ebx, 0x100
jl 0x140016af0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp + rsi + 0x110], xmm0
add rsi, 0x10
cmp rsi, 0x30
jl 0x140016ac0
mov edx, 1
mov dword [rbp + 0xc0], 0x2534541
mov r9, r15
mov byte [rbp + 0xc4], dil
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 4]
call fcn.140202b50
cmp rax, 5
je 0x140016be2
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016bc0
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016bb6
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
mov edx, 1
mov word [rbp + 0xc0], 0x1800
mov r9, r15
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 1]
call fcn.140202b50
cmp rax, 2
je 0x140016c5f
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016c3d
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016c33
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
mov r8d, 0xff
lea rdx, str.CREATED_BY
lea rcx, [rbp + 0x1c0]
call fcn.140202c10
mov edx, 1
mov byte [rbp + 0x2bf], dil
mov r9, r15
lea rcx, [rbp + 0x1c0]
lea r8d, [rdx + 0xa]
call fcn.140202b50
cmp rax, 0xb
je 0x140016cfc
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016cda
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016cd0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
lea r9, str.3.10
lea r8, str.aescrypt
lea rdx, [0x14026232c]
lea rcx, [rbp + 0x1c0]
call fcn.140018560
mov rsi, 0xffffffffffffffff
lea rcx, [rbp + 0x1c0]
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x140016d30
movsxd rbx, eax
lea rcx, [rbp + 0x1c0]
mov r8, rbx
mov r9, r15
mov edx, 1
call fcn.140202b50
cmp rax, rbx
je 0x140016dac
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x140016d8a
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016d80
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
mov edx, 1
mov word [rbp + 0xc0], di
mov r9, r15
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 1]
call fcn.140202b50
cmp rax, 2
je 0x140016e20
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x140016dfe
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016df4
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
movups xmm0, xmmword [0x14026a7e0]
mov qword [rsp + 0x50], rdi
mov ebx, edi
movups xmm1, xmmword [0x14026a7f0]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
nop
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xc0]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14001769c
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xc0]
call fcn.1400cd120
inc ebx
cmp ebx, 0x100
jl 0x140016e40
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
movups xmm0, xmmword [rbp + 0xe0]
mov rcx, qword [rsp + 0x48]
xor edx, edx
movups xmmword [rbp + 0x100], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, 1
lea rcx, [rbp + 0x100]
mov r9, r15
lea r8d, [rdx + 0xf]
call fcn.140202b50
cmp rax, 0x10
je 0x140016eff
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x140016a8a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016ef0
jmp 0x140016a8a
mov eax, dword [rbp + 0x340]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf0], xmm0
mov qword [rsp + 0x3d8], r14
mov ebx, 0x2000
movups xmm0, xmmword [rbp + 0x100]
lea r14d, [rax + rax]
movups xmmword [rbp + 0xe0], xmm0
nop
movups xmm0, xmmword [0x14026a7e0]
lea r8, [rsp + 0x50]
mov edx, 0x20
movups xmm1, xmmword [0x14026a7f0]
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cd120
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, r12
call fcn.1400cd120
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
sub rbx, 1
jne 0x140016f30
call fcn.1400cc260
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xe0]
call fcn.1400cbc90
movdqa xmm0, xmmword [0x1402ae910]
mov rax, rdi
movdqa xmm1, xmmword [0x1402ae960]
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm1
movups xmmword [rbp + 0x1a0], xmm1
movups xmmword [rbp + 0x1b0], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax + 0x140]
movdqu xmm2, xmmword [rbp + rax + 0xe0]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
movdqu xmmword [rbp + rax + 0x140], xmm1
xorps xmm0, xmm2
movdqu xmmword [rbp + rax + 0x180], xmm0
add rax, 0x10
cmp rax, 0x20
jl 0x140016ff0
movups xmm0, xmmword [0x14026a7e0]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026a7f0]
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cd120
mov rbx, rdi
nop word [rax + rax]
movups xmm0, xmmword [rbp + rbx + 0x110]
mov rcx, rdi
mov edx, InitCommonControls
movups xmmword [rbp + 0xc0], xmm0
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x100]
xor byte [rbp + rcx + 0xc0], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140017090
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
call fcn.1400cad20
lea r8, [rsp + 0x50]
mov edx, InitCommonControls
lea rcx, [rbp + 0xc0]
call fcn.1400cd120
mov edx, 1
lea rcx, [rbp + 0xc0]
mov r9, r15
lea r8d, [rdx + 0xf]
call fcn.140202b50
cmp rax, 0x10
jne 0x140017654
movups xmm0, xmmword [rbp + 0xc0]
add rbx, rax
movups xmmword [rbp + 0x100], xmm0
cmp rbx, 0x30
jl 0x140017070
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
movups xmm0, xmmword [0x14026a7e0]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026a7f0]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cd120
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xe0]
call fcn.1400cd120
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
mov edx, 1
lea rcx, [rbp + 0xe0]
mov r9, r15
lea r8d, [rdx + 0x1f]
call fcn.140202b50
cmp rax, 0x20
je 0x1400171d2
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400171c3
jmp 0x14001768a
movups xmm0, xmmword [rbp + 0x110]
movups xmmword [rbp + 0x100], xmm0
call fcn.1400cc260
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x120]
call fcn.1400cbc90
movdqa xmm0, xmmword [0x1402ae910]
mov rax, rdi
movdqa xmm1, xmmword [0x1402ae960]
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm1
movups xmmword [rbp + 0x1a0], xmm1
movups xmmword [rbp + 0x1b0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x140]
movdqu xmm2, xmmword [rbp + rax + 0x120]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
movdqu xmmword [rbp + rax + 0x140], xmm1
xorps xmm0, xmm2
movdqu xmmword [rbp + rax + 0x180], xmm0
add rax, 0x10
cmp rax, 0x20
jl 0x140017240
movups xmm1, xmmword [0x14026a7f0]
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
xorps xmm0, xmm0
lea rcx, [rbp + 0x140]
movups xmmword [rbp + 0x110], xmm0
mov edx, 0x40
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [0x14026a7e0]
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
call fcn.1400cd120
mov r9, qword [rsp + 0x38]
lea rcx, [rbp + 0xc0]
mov edx, 1
xor r15b, r15b
mov r12d, edi
mov r14, rdi
lea r8d, [rdx + 0xf]
call fcn.140202fd4
mov rbx, rax
test eax, eax
jle 0x1400173f1
nop word [rax + rax]
movdqu xmm1, xmmword [rbp + 0xc0]
lea r8, [rbp - 0x40]
movdqu xmm0, xmmword [rbp + 0x100]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
xorps xmm1, xmm0
movdqu xmmword [rbp + 0xc0], xmm1
call fcn.1400cad20
lea r8, [rsp + 0x50]
mov edx, InitCommonControls
lea rcx, [rbp + 0xc0]
call fcn.1400cd120
mov r9, qword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
mov edx, 1
lea r8d, [rdx + 0xf]
call fcn.140202b50
cmp rax, 0x10
jne 0x140017465
mov rcx, qword [rsp + 0x30]
movzx r15d, bl
movups xmm0, xmmword [rbp + 0xc0]
mov eax, ebx
add r14, rax
imul rax, r14, 0x3e8
movups xmmword [rbp + 0x100], xmm0
cqo
idiv qword [rcx + 0xe0]
mov rbx, rax
cmp r12d, eax
je 0x1400173c0
mov rcx, qword [rcx + 0xf0]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x30]
mov r12d, ebx
cmp dword [rcx + 0xf8], edi
jne 0x14001742f
call fcn.140021a90
mov r9, qword [rsp + 0x38]
lea rcx, [rbp + 0xc0]
mov edx, 1
lea r8d, [rdx + 0xf]
call fcn.140202fd4
mov ebx, eax
test eax, eax
jg 0x140017300
test ebx, ebx
jns 0x14001749f
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_READ_ERROR
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017420
jmp 0x14001768a
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_SPLIT_MSG_CANCEL
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017456
jmp 0x14001768a
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017490
jmp 0x14001768a
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
mov edx, 1
and r15b, 0xf
mov r9, rbx
mov byte [rbp + 0xc0], r15b
mov r8d, edx
call fcn.140202b50
cmp rax, 1
je 0x140017528
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x1400174fa
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400174f0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov ecx, 2
call fcn.1402031c0
mov rcx, rax
lea rdx, str.Error:_Could_not_write_the_file_size_modulo_n
call fcn.140018a40
mov eax, esi
jmp 0x14001762b
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
movups xmm0, xmmword [0x14026a7e0]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026a7f0]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cd120
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xe0]
call fcn.1400cd120
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cd260
mov edx, 1
lea rcx, [rbp + 0xe0]
mov r9, rbx
lea r8d, [rdx + 0x1f]
call fcn.140202b50
cmp rax, 0x20
je 0x1400175ef
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400175e0
jmp 0x14001768a
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_SPLIT_MSG_DONE
call fcn.140048080
test rax, rax
je 0x14001761b
nop
inc rsi
cmp word [rax + rsi*2], di
jne 0x140017610
mov edi, esi
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
xor eax, eax
mov r14, qword [rsp + 0x3d8]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x3e0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048080
test rax, rax
je 0x14001768a
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017680
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov eax, esi
jmp 0x14001762b
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048080
test rax, rax
je 0x1400176ca
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400176c0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f70
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017633
call fcn.140044940
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048080
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016a8a
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017720
jmp 0x140016a8a