Function at 0x140001cd0
Capabilities:
Clear file content
Encrypt data using salsa20 or chacha
Encrypt or decrypt via wincrypt
Move file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r15
sub rsp, 0x70
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov r12, rdx
mov r15, rcx
xor ebx, ebx
call fcn.1400016a0
test eax, eax
je 0x1400020ff
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 0x20c
mov qword [rsp + 0x28], rax
lea rbp, [r15 + 0x8c]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor edx, edx
lea r8d, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x1400020ff
mov qword [rsp + 0xb0], rsi
mov rcx, rbp
mov edx, 4
nop dword [rax + rax]
mov rax, qword [rcx]
mov qword [rcx - 0x6c], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140001d50
mov rax, qword [r15 + 0xac]
lea rsi, [r15 + 0x4c]
mov qword [r15 + 0x40], rax
mov eax, dword [r15 + 0x20]
mov dword [rsi + 0x10], eax
mov eax, dword [r15 + 0x24]
mov dword [rsi + 0x14], eax
mov eax, dword [r15 + 0x28]
mov dword [rsi + 0x18], eax
mov eax, dword [r15 + 0x2c]
mov dword [rsi + 0x1c], eax
mov eax, dword [r15 + 0x30]
mov dword [rsi + 0x20], eax
mov eax, dword [r15 + 0x34]
mov dword [rsi + 0x24], eax
mov eax, dword [r15 + 0x38]
mov dword [rsi + 0x28], eax
mov eax, dword [r15 + 0x3c]
mov dword [rsi + 0x2c], eax
mov dword [rsi], 0x61707865
mov dword [rsi + 4], 0x3320646e
mov dword [rsi + 8], 0x79622d32
mov dword [rsi + 0xc], 0x6b206574
mov qword [r15 + 0x7c], rbx
mov eax, dword [r15 + 0x40]
mov dword [r15 + 0x84], eax
mov eax, dword [r15 + 0x44]
mov dword [r15 + 0x88], eax
movzx eax, byte [r15 + 0x48]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r14
cmp al, 0x24
jne 0x140001f0b
mov rax, qword [r15 + 0x18]
mov rdi, rbx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], rax
test rax, rax
jle 0x140002024
mov ecx, 0x500000
nop dword [rax]
nop word [rax + rax]
mov r8, rax
mov qword [rsp + 0x20], rbx
sub r8, rdi
lea r9, [rsp + 0x40]
cmp r8, rcx
mov rdx, r12
cmovg r8d, ecx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000201d
mov r14d, dword [rsp + 0x40]
test r14d, r14d
je 0x14000201d
add rdi, r14
mov r9d, r14d
mov r8, r12
mov qword [rsp + 0x38], rdi
mov rdx, r12
mov rcx, rsi
call section..text
mov edx, dword [rsp + 0x40]
mov r9d, 1
mov rcx, qword [r15 + 8]
neg rdx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14000201d
mov r13, qword [r15 + 8]
mov edi, ebx
mov dword [rsp + 0x44], ebx
mov esi, r14d
mov ebp, ebx
test r14d, r14d
je 0x140001eea
nop dword [rax]
mov edx, ebp
lea r9, [rsp + 0x44]
add rdx, r12
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000201d
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14000201d
add ebp, eax
add edi, eax
sub esi, eax
cmp edi, r14d
jne 0x140001eb0
mov rdi, qword [rsp + 0x38]
lea rsi, [r15 + 0x4c]
mov rax, qword [rsp + 0x30]
mov ecx, 0x500000
cmp rdi, rax
jl 0x140001e20
jmp 0x14000201d
cmp al, 0x25
jne 0x140001f26
movzx r9d, byte [r15 + 0x49]
mov rdx, r12
mov rcx, r15
call fcn.140001850
mov ebx, eax
jmp 0x140002029
cmp al, 0x26
jne 0x140002029
mov dword [rsp + 0x40], ebx
mov rdi, rbx
mov eax, 0x500000
nop word [rax + rax]
mov rcx, qword [r15 + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x100000
mov qword [rsp + 0x20], rbx
sub r8, rdi
mov rdx, r12
cmp r8, rax
cmovg r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000201d
mov r14d, dword [rsp + 0x40]
test r14d, r14d
je 0x14000201d
add rdi, r14
mov r9d, r14d
mov r8, r12
mov qword [rsp + 0x30], rdi
mov rdx, r12
mov rcx, rsi
call section..text
mov edx, dword [rsp + 0x40]
mov r9d, 1
mov rcx, qword [r15 + 8]
neg rdx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14000201d
mov r13, qword [r15 + 8]
mov edi, ebx
mov dword [rsp + 0x44], ebx
mov esi, r14d
mov ebp, ebx
test r14d, r14d
je 0x140002002
nop dword [rax + rax]
mov edx, ebp
lea r9, [rsp + 0x44]
add rdx, r12
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000201d
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14000201d
add ebp, eax
add edi, eax
sub esi, eax
cmp edi, r14d
jne 0x140001fd0
mov rdi, qword [rsp + 0x30]
lea rsi, [r15 + 0x4c]
mov eax, 0x500000
cmp rdi, 0x100000
jl 0x140001f40
lea rbp, [r15 + 0x8c]
mov ebx, 1
mov rcx, qword [r15 + 8]
mov r9d, 2
xor r8d, r8d
mov rdx, 0xfffffffffffffdea
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
test eax, eax
je 0x14000205b
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test ebx, ebx
je 0x1400020cf
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [r15]
mov qword [r15 + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x7fd7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400020cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rdi
mov rcx, rsi
lea r8d, [rax - 5]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [r15 + 8]
mov rsi, qword [rsp + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x1400020ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r15 + 8], 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov ecx, 0x20c
rep stosb byte [rdi], al
mov eax, ebx
jmp 0x140002101
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140006290
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret