Function at 0x1400112e4
Capabilities:
Create process on windows
Delete file
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140011e00
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xb38
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1fa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xb58]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xad0], rax
lea rcx, [0x1400250ca]
call fcn.140011406
nop
cmp dword [rbp + 0xb00], 2
je 0x140011e81
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xb08]
mov rdx, qword [rcx + rax]
lea rcx, str.Usage:__s__encrypted_file__n
call fcn.1400111f4
nop
mov eax, 1
jmp 0x1400127f4
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xb08]
mov rax, qword [rcx + rax]
mov qword [rbp + 8], rax
xor edx, edx
mov ecx, 2
call fcn.140011357
nop
xor edx, edx
mov ecx, 0xc
call fcn.140011357
nop
mov edx, 0x100
lea rcx, [rbp + 0x30]
call fcn.140011361
nop
lea rdx, [0x14001c0c4]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
jne 0x140011f10
lea rcx, str.Unable_to_open_encrypted_file
call qword [sym.imp.ucrtbased.dll_perror]
nop
xor eax, eax
test eax, eax
je 0x140011efc
jmp 0x140011ef2
xor eax, eax
test eax, eax
je 0x140011f06
jmp 0x140011efc
mov eax, 1
jmp 0x1400127f4
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x140011f63
lea rcx, str.fseek_failed
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
xor eax, eax
test eax, eax
je 0x140011f4f
jmp 0x140011f45
xor eax, eax
test eax, eax
je 0x140011f59
jmp 0x140011f4f
mov eax, 1
jmp 0x1400127f4
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0xffffffff
jne 0x140011fb9
lea rcx, str.ftell_failed
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
xor eax, eax
test eax, eax
je 0x140011fa5
jmp 0x140011f9b
xor eax, eax
test eax, eax
je 0x140011faf
jmp 0x140011fa5
mov eax, 1
jmp 0x1400127f4
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x140012009
lea rcx, str.fseek_failed
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
xor eax, eax
test eax, eax
je 0x140011ff5
jmp 0x140011feb
xor eax, eax
test eax, eax
je 0x140011fff
jmp 0x140011ff5
mov eax, 1
jmp 0x1400127f4
movsxd rax, dword [rbp + 0x164]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0
jne 0x140012064
lea rcx, str.Failed_to_allocate_memory_for_ciphertext
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
xor eax, eax
test eax, eax
je 0x140012050
jmp 0x140012046
xor eax, eax
test eax, eax
je 0x14001205a
jmp 0x140012050
mov eax, 1
jmp 0x1400127f4
movsxd rax, dword [rbp + 0x164]
mov r9, qword [rbp + 0x148]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x1a8], rax
movsxd rax, dword [rbp + 0x164]
cmp qword [rbp + 0x1a8], rax
je 0x1400120e6
lea rcx, str.Failed_to_read_encrypted_file
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x1400120d2
jmp 0x1400120c8
xor eax, eax
test eax, eax
je 0x1400120dc
jmp 0x1400120d2
mov eax, 1
jmp 0x1400127f4
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
cmp dword [rbp + 0x164], 0x20
jge 0x140012144
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Encrypted_file_is_too_short._n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x140012130
jmp 0x140012126
xor eax, eax
test eax, eax
je 0x14001213a
jmp 0x140012130
mov eax, 1
jmp 0x1400127f4
mov r8d, 0x10
mov rdx, qword [rbp + 0x188]
lea rcx, [rbp + 0x1c8]
call fcn.140011212
nop
mov rax, qword [rbp + 0x188]
add rax, 0x10
mov r8d, 0x10
mov rdx, rax
lea rcx, [rbp + 0x1f8]
call fcn.140011212
nop
mov rax, qword [rbp + 0x188]
add rax, 0x20
mov qword [rbp + 0x228], rax
mov eax, dword [rbp + 0x164]
sub eax, 0x20
mov dword [rbp + 0x244], eax
call fcn.140011262
mov qword [rbp + 0xac8], rax
lea rcx, [rbp + 0x30]
call fcn.1400111cc
lea rcx, [rbp + 0x268]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x20
mov rcx, qword [rbp + 0xac8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x186a0
mov r9d, 0x10
lea r8, [rbp + 0x1c8]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140011168
test eax, eax
jne 0x140012240
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.Key_derivation_failed_n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x14001222c
jmp 0x140012222
xor eax, eax
test eax, eax
je 0x140012236
jmp 0x14001222c
mov eax, 1
jmp 0x1400127f4
call fcn.1400110a5
mov rcx, rax
call fcn.1400110be
mov ecx, dword [rbp + 0x244]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x2a4], eax
movsxd rax, dword [rbp + 0x2a4]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x1400122b8
lea rcx, str.Failed_to_allocate_memory_for_plaintext
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x1400122a4
jmp 0x14001229a
xor eax, eax
test eax, eax
je 0x1400122ae
jmp 0x1400122a4
mov eax, 1
jmp 0x1400127f4
mov rax, qword [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f8]
lea r8, [rbp + 0x268]
mov edx, dword [rbp + 0x244]
mov rcx, qword [rbp + 0x228]
call fcn.140011384
mov dword [rbp + 0x2e4], eax
lea rdx, [rbp + 0x310]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140012348
lea rcx, str.GetTempPath_failed
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x140012334
jmp 0x14001232a
xor eax, eax
test eax, eax
je 0x14001233e
jmp 0x140012334
mov eax, 1
jmp 0x1400127f4
lea r9, [rbp + 0x440]
xor r8d, r8d
lea rdx, [0x14001c200]
lea rcx, [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1400123b2
lea rcx, str.GetTempFileName_failed
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x14001239e
jmp 0x140012394
xor eax, eax
test eax, eax
je 0x1400123a8
jmp 0x14001239e
mov eax, 1
jmp 0x1400127f4
lea r8, [rbp + 0x440]
mov edx, 0x104
lea rcx, [rbp + 0x570]
call qword [sym.imp.ucrtbased.dll_strcpy_s]
mov dword [rbp + 0x694], eax
cmp dword [rbp + 0x694], 0
je 0x140012436
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8d, dword [rbp + 0x694]
lea rdx, str.strcpy_s_failed_with_error_code__d_n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x140012422
jmp 0x140012418
xor eax, eax
test eax, eax
je 0x14001242c
jmp 0x140012422
mov eax, 1
jmp 0x1400127f4
mov edx, 0x2e
lea rcx, [rbp + 0x570]
call fcn.140011479
mov qword [rbp + 0x6b8], rax
cmp qword [rbp + 0x6b8], 0
je 0x140012502
lea rax, [rbp + 0x570]
mov rcx, qword [rbp + 0x6b8]
sub rcx, rax
mov rax, rcx
mov ecx, 0x104
sub rcx, rax
mov rax, rcx
lea r8, str..exe
mov rdx, rax
mov rcx, qword [rbp + 0x6b8]
call qword [sym.imp.ucrtbased.dll_strcpy_s]
mov dword [rbp + 0x694], eax
cmp dword [rbp + 0x694], 0
je 0x1400124fd
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8d, dword [rbp + 0x694]
lea rdx, str.strcpy_s_failed_with_error_code__d_n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x1400124e9
jmp 0x1400124df
xor eax, eax
test eax, eax
je 0x1400124f3
jmp 0x1400124e9
mov eax, 1
jmp 0x1400127f4
jmp 0x140012586
lea r8, str..exe
mov edx, 0x104
lea rcx, [rbp + 0x570]
call qword [sym.imp.ucrtbased.dll_strcat_s]
mov dword [rbp + 0x694], eax
cmp dword [rbp + 0x694], 0
je 0x140012586
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov r8d, dword [rbp + 0x694]
lea rdx, str.strcat_s_failed_with_error_code__d_n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x140012572
jmp 0x140012568
xor eax, eax
test eax, eax
je 0x14001257c
jmp 0x140012572
mov eax, 1
jmp 0x1400127f4
lea rdx, [0x14001c28c]
lea rcx, [rbp + 0x570]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x6d8], rax
cmp qword [rbp + 0x6d8], 0
jne 0x1400125f3
lea rcx, str.Unable_to_open_decrypted_file_for_writing
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x1400125df
jmp 0x1400125d5
xor eax, eax
test eax, eax
je 0x1400125e9
jmp 0x1400125df
mov eax, 1
jmp 0x1400127f4
movsxd rax, dword [rbp + 0x2e4]
mov r9, qword [rbp + 0x6d8]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov qword [rbp + 0x6f8], rax
movsxd rax, dword [rbp + 0x2e4]
cmp qword [rbp + 0x6f8], rax
je 0x140012683
lea rcx, str.Failed_to_write_decrypted_data_to_file
call qword [sym.imp.ucrtbased.dll_perror]
nop
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x14001266f
jmp 0x140012665
xor eax, eax
test eax, eax
je 0x140012679
jmp 0x14001266f
mov eax, 1
jmp 0x1400127f4
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x720]
call fcn.140011339
nop
mov dword [rbp + 0x720], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x7a8]
call fcn.140011339
nop
lea rax, [rbp + 0x7a8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x720]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14001278d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xac4], eax
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
mov ecx, dword [rbp + 0xac4]
mov r8d, ecx
lea rdx, str.CreateProcess_failed___lu_._n
mov rcx, rax
call fcn.1400113c5
nop
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
xor eax, eax
test eax, eax
je 0x14001277c
jmp 0x140012772
xor eax, eax
test eax, eax
je 0x140012786
jmp 0x14001277c
mov eax, 1
jmp 0x1400127f4
mov rcx, qword [rbp + 0x7a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_free]
nop
xor eax, eax
test eax, eax
je 0x1400127e8
jmp 0x1400127de
xor eax, eax
test eax, eax
je 0x1400127f2
jmp 0x1400127e8
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001bfd0]
call fcn.140011398
mov rax, rdi
mov rcx, qword [rbp + 0xad0]
xor rcx, rbp
call fcn.14001120d
lea rsp, [rbp + 0xae8]
pop rdi
pop rbp
ret