Function at 0x140001d80
Capabilities:
Clear file content
Encrypt data using salsa20 or chacha
Encrypt or decrypt via wincrypt
Move file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov rdi, r9
mov esi, eax
mov r15, rdx
mov r14, rcx
call fcn.140001710
test eax, eax
je 0x1400021e3
xor r9d, r9d
mov dword [rsp + 0x40], 0x20c
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r12, [r14 + 0x8c]
mov rcx, rdi
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400021e3
mov qword [rsp + 0xa0], rbx
mov rcx, r12
mov edx, 4
nop
mov rax, qword [rcx]
mov qword [rcx - 0x6c], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140001e00
mov rax, qword [r14 + 0xac]
lea rbx, [r14 + 0x4c]
mov qword [r14 + 0x40], rax
xor r9d, r9d
mov eax, dword [r14 + 0x20]
mov dword [rbx + 0x10], eax
mov eax, dword [r14 + 0x24]
mov dword [rbx + 0x14], eax
mov eax, dword [r14 + 0x28]
mov dword [rbx + 0x18], eax
mov eax, dword [r14 + 0x2c]
mov dword [rbx + 0x1c], eax
mov eax, dword [r14 + 0x30]
mov dword [rbx + 0x20], eax
mov eax, dword [r14 + 0x34]
mov dword [rbx + 0x24], eax
mov eax, dword [r14 + 0x38]
mov dword [rbx + 0x28], eax
mov eax, dword [r14 + 0x3c]
mov dword [rbx + 0x2c], eax
mov dword [rbx], 0x61707865
mov dword [rbx + 4], 0x3320646e
mov dword [rbx + 8], 0x79622d32
mov dword [rbx + 0xc], 0x6b206574
mov qword [r14 + 0x7c], r9
mov eax, dword [r14 + 0x40]
mov dword [r14 + 0x84], eax
mov eax, dword [r14 + 0x44]
mov dword [r14 + 0x88], eax
movzx eax, byte [r14 + 0x48]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r13
cmp al, 0x24
jne 0x140001fbb
mov rax, qword [r14 + 0x18]
mov r13d, r9d
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x30], rax
test rax, rax
jle 0x1400020d4
mov ecx, 0x500000
nop word [rax + rax]
mov r8, rax
mov qword [rsp + 0x20], r9
sub r8, r13
lea r9, [rsp + 0x38]
cmp r8, rcx
mov rdx, r15
cmovg r8d, ecx
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400020cd
mov ebp, dword [rsp + 0x38]
test ebp, ebp
je 0x1400020cd
mov r9d, ebp
mov r8, r15
mov rdx, r15
mov rcx, rbx
add r13, rbp
call section..text
mov edx, dword [rsp + 0x38]
mov r9d, 1
mov rcx, qword [r14 + 8]
neg rdx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400020cd
mov r12, qword [r14 + 8]
xor r9d, r9d
mov dword [rsp + 0x3c], r9d
mov edi, r9d
mov ebx, ebp
mov esi, r9d
test ebp, ebp
je 0x140001f9f
nop word [rax + rax]
mov qword [rsp + 0x20], r9
mov r8d, ebx
mov edx, esi
lea r9, [rsp + 0x3c]
add rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400020cd
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x1400020cd
add esi, eax
add edi, eax
sub ebx, eax
mov r9d, 0
cmp edi, ebp
jne 0x140001f60
mov rax, qword [rsp + 0x30]
lea rbx, [r14 + 0x4c]
mov ecx, 0x500000
cmp r13, rax
jl 0x140001ed0
jmp 0x1400020cd
cmp al, 0x25
jne 0x140001fd6
movzx r9d, byte [r14 + 0x49]
mov rdx, r15
mov rcx, r14
call fcn.1400018c0
mov esi, eax
jmp 0x1400020d9
cmp al, 0x26
jne 0x1400020d9
mov dword [rsp + 0x38], r9d
mov r13, r9
mov eax, 0x500000
nop dword [rax + rax]
mov rcx, qword [r14 + 8]
mov r8d, 0x100000
sub r8, r13
mov qword [rsp + 0x20], r9
cmp r8, rax
lea r9, [rsp + 0x38]
mov rdx, r15
cmovg r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400020cd
mov ebp, dword [rsp + 0x38]
test ebp, ebp
je 0x1400020cd
mov r9d, ebp
mov r8, r15
mov rdx, r15
mov rcx, rbx
add r13, rbp
call section..text
mov edx, dword [rsp + 0x38]
mov r9d, 1
mov rcx, qword [r14 + 8]
neg rdx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400020cd
mov r12, qword [r14 + 8]
xor r9d, r9d
mov dword [rsp + 0x3c], r9d
mov edi, r9d
mov ebx, ebp
mov esi, r9d
test ebp, ebp
je 0x1400020b7
nop word [rax + rax]
mov qword [rsp + 0x20], r9
mov r8d, ebx
mov edx, esi
lea r9, [rsp + 0x3c]
add rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400020cd
mov eax, dword [rsp + 0x3c]
test eax, eax
je 0x1400020cd
add esi, eax
add edi, eax
sub ebx, eax
mov r9d, 0
cmp edi, ebp
jne 0x140002080
lea rbx, [r14 + 0x4c]
mov eax, 0x500000
cmp r13, 0x100000
jl 0x140001ff0
lea r12, [r14 + 0x8c]
mov esi, 1
mov rcx, qword [r14 + 8]
mov r9d, 2
xor r8d, r8d
mov rdx, 0xfffffffffffffdea
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r13, qword [rsp + 0x50]
test eax, eax
je 0x140002106
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test esi, esi
je 0x1400021ae
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [r14]
lea rdx, str.._ID_
mov rcx, rbp
mov qword [r14 + 8], 0xffffffffffffffff
call fcn.140007168
mov rbx, rax
test rax, rax
je 0x14000219f
sub rbx, rbp
sar rbx, 1
lea rdi, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000219f
lea rdx, [rbx + 1]
mov r9, rbx
mov r8, rbp
mov rcx, rax
call fcn.14000d2cc
xor eax, eax
mov rdx, rdi
mov rcx, rbp
mov word [rdi + rbx*2], ax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [r14]
lea rcx, str.File_decrypted:__s_n
call fcn.1400016b0
mov rcx, qword [r14 + 8]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xa0]
cmp rcx, 0xffffffffffffffff
je 0x1400021d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 8], 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov ecx, 0x20c
rep stosb byte [rdi], al
mov eax, esi
jmp 0x1400021e5
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006250
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret