Function at 0x1400034a0
Capabilities:
Encrypt data using des
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r9d, 6
xor r8d, r8d
mov edx, 0x3e8
xor esi, esi
lea rbx, [rsp + 0x50]
mov rcx, rbx
call dbg.blackrock2_init
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov r15d, dword [rsp + 0x70]
mov qword [rsp + 0x30], rax
nop word cs:[rax + rax]
nop
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call dbg.blackrock2_shuffle
mov qword [rsp + 0x20], rbp
mov r8, r14
mov rdx, r13
mov r9, rax
mov ecx, r15d
call sym.DECRYPT
mov rdi, qword [rsp + 0x30]
cmp rax, rdi
jb 0x140003697
mov edi, r15d
mov qword [rsp + 0x40], rsi
lea r12, [0x140056680]
and edi, 1
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x3c], edi
nop dword [rax]
xor edx, edx
mov ecx, dword [rsp + 0x3c]
div r13
mov r11, rdx
mov r10, rax
test ecx, ecx
je 0x1400037c0
mov ecx, dword [rsp + 0x38]
lea r15, [0x140056780]
lea rdi, [0x140056980]
lea rsi, [0x140056580]
jmp 0x1400035d4
mov eax, dword [r15 + rax*4]
xor eax, dword [rdi + r8*4]
xor eax, dword [rsi + r9*4]
mov r8d, eax
lea rax, [0x140056b80]
xor r8d, dword [rax + rdx*4]
cmp r11, r8
jae 0x140003660
mov rax, r8
xor edx, edx
mov r9, r13
sub rax, r11
div r13
xor eax, eax
sub r9, rdx
cmp r13, r9
cmove r9, rax
sub ecx, 1
je 0x140003677
mov r11, r10
mov r10, r9
mov rdx, rbp
ror rdx, cl
xor rdx, r10
mov rax, rdx
mov r8, rdx
mov r9, rdx
shr rdx, 0x18
shr rax, 8
shr r8, 0x10
and r9d, 0x3f
and edx, 0x3f
and eax, 0x3f
and r8d, 0x3f
test cl, 1
jne 0x140003588
lea rbx, [0x140056880]
mov eax, dword [rbx + rax*4]
lea rbx, [0x140056a80]
xor eax, dword [rbx + r8*4]
lea rbx, [0x140056c80]
xor eax, dword [r12 + r9*4]
mov r9d, eax
xor r9d, dword [rbx + rdx*4]
cmp r11, r9
jae 0x1400037a8
mov rax, r9
xor edx, edx
mov r9, r14
sub rax, r11
div r14
xor eax, eax
sub r9, rdx
cmp r14, r9
cmove r9, rax
sub ecx, 1
jmp 0x1400035ce
mov rax, r11
xor edx, edx
sub rax, r8
div r13
mov r9, rdx
sub ecx, 1
jne 0x1400035ce
imul r10, r13
mov rdi, qword [rsp + 0x30]
lea rax, [r10 + r9]
cmp rax, rdi
jae 0x140003550
mov rsi, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x38]
cmp rax, rsi
jne 0x14000381f
lea rsi, [rax + 1]
cmp rax, 9
jne 0x140003500
mov rbx, qword [rsp + 0x48]
mov esi, 0x2355
xor r12d, r12d
lea rsi, [r12 + rsi + 0xb]
add r12, 1
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
imul rsi, r12
mov r9d, 6
mov rcx, rbx
mov r8, rax
mov rdx, rsi
call dbg.blackrock2_init
mov r13, qword [rsp + 0x50]
mov ecx, 1
cmp rsi, r13
mov rbp, r13
cmovbe rbp, rsi
mov rdx, rbp
call dbg.CALLOC
mov rdi, rax
test r13, r13
je 0x140003829
xor r14d, r14d
nop
mov rdx, r14
mov rcx, rbx
call dbg.blackrock2_shuffle
cmp rax, rsi
jae 0x140003724
add byte [rdi + rax], 1
add r14, 1
cmp r13, r14
jne 0x140003710
test rbp, rbp
je 0x140003829
mov rax, rdi
add rbp, rdi
mov r13d, 1
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax + rax]
xor edx, edx
cmp byte [rax], 1
sete dl
add rax, 1
and r13d, edx
cmp rax, rbp
jne 0x140003760
mov rcx, rdi
call sym.free
test r13d, r13d
je 0x140003836
cmp r12, 5
jne 0x1400036bb
xor eax, eax
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r11
xor edx, edx
sub rax, r9
div r14
mov r9, rdx
jmp 0x14000364f
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1400037d8
mov r11, r10
mov r10, rdx
jmp 0x140003567
mov rsi, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x38]
mov rax, r10
jmp 0x140003805
xor edx, edx
div r13
mov rdi, qword [rsp + 0x30]
imul rax, r13
add rax, rdx
cmp rax, rdi
jae 0x140003800
cmp rax, rsi
je 0x1400036a0
mov eax, 1
jmp 0x140003791
mov rcx, rdi
call sym.free
jmp 0x140003785
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x20
mov edx, 1
lea rcx, str.BLACKROCK:_randomization_failed_n
mov r9, rax
call sym.fwrite
mov eax, 1
jmp 0x140003791