Function at 0x1400129e0
Capabilities:
Clear file content
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov r14, rcx
xor esi, esi
lea r13, [rcx + 0x20]
mov qword [rsp + 0x50], r13
mov r8, r13
lea rax, [r13 + 0x18]
mov qword [rsp + 0xa8], rax
cmp qword [rax], 8
jb 0x140012a1e
mov r8, qword [r13]
mov rdx, r14
lea r12, [rcx + 0x18]
mov qword [rsp + 0x60], r12
cmp qword [r12], 8
jb 0x140012a34
mov rdx, qword [rcx]
lea rcx, str.____Decrypt_file:__s_____s_n
call fcn.140001b40
mov rcx, r14
cmp qword [r12], 8
jb 0x140012a4d
mov rcx, qword [r14]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x140013045
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rsi
mov ecx, 0x500
call fcn.1400195f4
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xb0], rax
lea rbx, [rax + 0x500]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0xc0], rbx
xor edx, edx
mov r8d, 0x500
mov rcx, rax
call fcn.14001bc40
mov qword [rsp + 0xb8], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rsi
mov ecx, 0x100
call fcn.1400195f4
mov r15, rax
mov qword [rsp + 0x88], rax
lea rbx, [rax + 0x100]
mov qword [rsp + 0x98], rbx
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.14001bc40
mov qword [rsp + 0x90], rbx
sub qword [rsp + 0x40], rdi
sub rbx, r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
mov edx, 0x614
lea rcx, [rsp + 0x70]
call fcn.1400064a0
mov rax, qword [rsp + 0x70]
lea rdi, [rax + 0x614]
mov r8, rdi
sub r8, rax
xor edx, edx
mov rcx, rax
call fcn.14001bc40
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x1f8], esi
sub rdi, qword [rsp + 0x70]
mov rax, qword [r14 + 0x40]
sub rax, rdi
mov qword [r14 + 0x40], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf8], rsi
mov dword [rsp + 0xf0], eax
mov eax, dword [r14 + 0x44]
mov dword [rsp + 0xf4], eax
mov dword [rsp + 0x1f0], esi
mov dword [rsp + 0x1e8], esi
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e8]
mov r8d, edi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012f17
mov eax, dword [rsp + 0x1e8]
cmp rax, rdi
mov rdi, qword [rsp + 0x58]
jne 0x140012f1c
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.14001b360
mov rdx, qword [rsp + 0x40]
add rdx, qword [rsp + 0x70]
mov r8, rbx
mov rcx, r15
call fcn.14001b360
mov rax, qword [rsp + 0x70]
mov r13, qword [rax + 0x600]
mov ecx, dword [rax + 0x608]
mov dword [rsp + 0x68], ecx
mov ebx, dword [rax + 0x60c]
mov eax, dword [rax + 0x610]
mov dword [rsp + 0x6c], eax
lea rdx, [rsp + 0x88]
call fcn.140010fa0
mov r15, qword [rsp + 0x88]
test eax, eax
je 0x140012fb3
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xa0], r15
sub rax, r15
cmp rax, 0x28
jne 0x140012fb3
lea r8, [r15 + 0x20]
mov rdx, r15
lea rcx, [rsp + 0x110]
call fcn.140011fa0
mov qword [rsp + 0x190], 0x40
mov qword [rsp + 0x140], rsi
mov rdi, r13
cmp r13, rbx
cmovg rdi, rbx
mov qword [rsp + 0xd0], rdi
mov rcx, rdi
call fcn.140019638
mov rbx, rax
mov qword [rsp + 0xd8], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14001bc40
mov r15, rsi
mov rdi, qword [rsp + 0x48]
test r13, r13
je 0x140012e56
nop dword [rax + rax]
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc8], rsi
mov dword [rsp + 0xc0], r15d
mov rax, r15
shr rax, 0x20
mov dword [rsp + 0xc4], eax
mov rax, r13
sub rax, r15
mov r12, qword [rsp + 0xd0]
cmp r12, rax
cmovae r12, rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e8]
mov r8d, r12d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012ea5
mov r8d, dword [rsp + 0x1e8]
mov edi, r8d
cmp r8, r12
jne 0x140012ea0
test r8d, r8d
je 0x140012dec
mov rax, qword [rsp + 0x190]
cmp rax, 0x40
jb 0x140012db6
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x110]
call fcn.140012580
mov rax, rsi
mov qword [rsp + 0x190], rax
movzx eax, byte [rsp + rax + 0x150]
xor byte [rbx], al
mov rax, qword [rsp + 0x190]
inc rax
mov qword [rsp + 0x190], rax
inc rbx
sub rdi, 1
jne 0x140012d90
mov r8d, dword [rsp + 0x1e8]
mov rbx, qword [rsp + 0xd8]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f0]
mov rdx, rbx
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140012ea5
mov eax, dword [rsp + 0x1e8]
cmp dword [rsp + 0x1f0], eax
jne 0x140012ea5
add r15, r12
cmp dword [rsp + 0x68], 1
jne 0x140012e48
mov rcx, r13
sub rcx, r15
mov eax, dword [rsp + 0x6c]
cmp rax, rcx
cmovge rax, rcx
add r15, rax
cmp r15, r13
jne 0x140012d00
mov r12, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r14 + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140012edb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140012edb
mov rdx, r14
cmp qword [r12], 8
jb 0x140012e87
mov rdx, qword [r14]
lea rcx, str.___Decrypted_file:__s_n
call fcn.140001b40
mov dword [rsp + 0x1f8], 1
jmp 0x140012efd
mov rdi, qword [rsp + 0x48]
cmp r15, r13
je 0x140012e51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
mov r12, qword [rsp + 0x60]
cmp qword [r12], 8
jb 0x140012ec2
mov rdx, qword [r14]
mov qword [rsp + 0x20], r13
mov r9, r15
mov r8d, eax
lea rcx, str.____File_not_decrypted:__s__error:_0x_X___lld____lld_n
call fcn.140001b40
jmp 0x140012efd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
cmp qword [r12], 8
jb 0x140012eee
mov rdx, qword [r14]
mov r8d, eax
lea rcx, str.____File_is_not_cropped:__s__error:_0x_X_n
call fcn.140001b40
test rbx, rbx
je 0x140012f0a
mov rcx, rbx
call fcn.1400195ec
mov r15, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x1f8], 0
je 0x140012f77
mov rdx, r13
mov rax, qword [rsp + 0xa8]
cmp qword [rax], 8
jb 0x140012f46
mov rdx, qword [r13]
mov rcx, r14
cmp qword [r12], 8
jb 0x140012f53
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140012f77
mov rdx, r14
cmp qword [r12], 8
jb 0x140012f6a
mov rdx, qword [r14]
lea rcx, str.____Decrypted_file_not_moved:__s_n
call fcn.140001b40
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140012fc3
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012fbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001311d
jmp 0x140012fbd
mov r13, qword [rsp + 0x50]
jmp 0x140012f1c
call fcn.1400195ec
nop
test r15, r15
je 0x140013001
mov rdx, qword [rsp + 0x98]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140012ff8
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013123
mov rcx, r15
call fcn.1400195ec
nop
test rdi, rdi
je 0x140013045
mov rax, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x140013039
mov qword [rsp + 0x40], 0x527
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140013129
mov rdi, rcx
mov rax, qword [rsp + 0x40]
mov rdx, rax
mov rcx, rdi
call fcn.1400195ec
nop
jmp 0x140013051
mov rdi, qword [rsp + 0xa8]
mov rdx, qword [rdi]
mov rbx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14001309c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140013097
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013117
mov rcx, r8
call fcn.1400195ec
mov qword [rbx + 0x10], rsi
mov qword [rdi], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rbx]
cmp rdx, 8
jb 0x1400130e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1400130e4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013117
mov rcx, r8
call fcn.1400195ec
mov qword [r14 + 0x10], rsi
mov qword [rbx], 7
mov word [r14], si
mov edx, 0x48
mov rcx, r14
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.1400195ec
call fcn.14002a224
nop
call fcn.14002a224
nop
call fcn.14002a224
nop
call fcn.14002a224
int3