Function at 0x140016980
Capabilities:
Encode data using xor
Generate random numbers via winapi
Hash data using sha256
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r13, qword [rbp + 0x348]
mov r12, r9
mov r15, r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov r9d, 1
mov qword [rsp + 0x30], rcx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140016a7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140016a2c
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140016a7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x140016a7f
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048480
mov rsi, 0xffffffffffffffff
test rax, rax
jne 0x140016a5b
xor edi, edi
jmp 0x140016a6a
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016a60
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov eax, esi
jmp 0x140017613
xorps xmm0, xmm0
xor edi, edi
movups xmmword [rbp + 0x110], xmm0
mov esi, edi
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
nop dword [rax + rax]
movups xmm1, xmmword [0x14026f830]
mov qword [rsp + 0x50], rdi
mov ebx, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmm0, xmmword [0x14026f820]
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xc0]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400176cc
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xc0]
call fcn.1400cf6c0
inc ebx
cmp ebx, 0x100
jl 0x140016ad0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp + rsi + 0x110], xmm0
add rsi, 0x10
cmp rsi, 0x30
jl 0x140016aa0
mov edx, 1
mov dword [rbp + 0xc0], 0x2534541
mov r9, r15
mov byte [rbp + 0xc4], dil
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 4]
call fcn.140206a40
cmp rax, 5
je 0x140016bc2
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016ba0
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016b96
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
mov edx, 1
mov word [rbp + 0xc0], 0x1800
mov r9, r15
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 1]
call fcn.140206a40
cmp rax, 2
je 0x140016c3f
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016c1d
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016c13
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
mov r8d, 0xff
lea rdx, str.CREATED_BY
lea rcx, [rbp + 0x1c0]
call fcn.140206b00
mov edx, 1
mov byte [rbp + 0x2bf], dil
mov r9, r15
lea rcx, [rbp + 0x1c0]
lea r8d, [rdx + 0xa]
call fcn.140206a40
cmp rax, 0xb
je 0x140016cdc
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016cba
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016cb0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
lea r9, str.3.10
lea r8, str.aescrypt
lea rdx, [0x14026734c]
lea rcx, [rbp + 0x1c0]
call fcn.140018540
mov rsi, 0xffffffffffffffff
lea rcx, [rbp + 0x1c0]
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x140016d10
movsxd rbx, eax
lea rcx, [rbp + 0x1c0]
mov r8, rbx
mov r9, r15
mov edx, 1
call fcn.140206a40
cmp rax, rbx
je 0x140016d8c
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x140016d6a
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016d60
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
mov edx, 1
mov word [rbp + 0xc0], di
mov r9, r15
lea rcx, [rbp + 0xc0]
lea r8d, [rdx + 1]
call fcn.140206a40
cmp rax, 2
je 0x140016e00
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x140016dde
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016dd4
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
movups xmm0, xmmword [0x14026f820]
mov qword [rsp + 0x50], rdi
mov ebx, edi
movups xmm1, xmmword [0x14026f830]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
nop
mov rcx, qword [rsp + 0x48]
lea r8, [rbp + 0xc0]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14001767c
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xc0]
call fcn.1400cf6c0
inc ebx
cmp ebx, 0x100
jl 0x140016e20
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
movups xmm0, xmmword [rbp + 0xe0]
mov rcx, qword [rsp + 0x48]
xor edx, edx
movups xmmword [rbp + 0x100], xmm0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov edx, 1
lea rcx, [rbp + 0x100]
mov r9, r15
lea r8d, [rdx + 0xf]
call fcn.140206a40
cmp rax, 0x10
je 0x140016edf
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x140016a6a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140016ed0
jmp 0x140016a6a
mov eax, dword [rbp + 0x340]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf0], xmm0
mov qword [rsp + 0x3d8], r14
mov ebx, 0x2000
movups xmm0, xmmword [rbp + 0x100]
lea r14d, [rax + rax]
movups xmmword [rbp + 0xe0], xmm0
nop
movups xmm0, xmmword [0x14026f820]
lea r8, [rsp + 0x50]
mov edx, 0x20
movups xmm1, xmmword [0x14026f830]
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cf6c0
lea r8, [rsp + 0x50]
mov edx, r14d
mov rcx, r12
call fcn.1400cf6c0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
sub rbx, 1
jne 0x140016f10
call fcn.1400ce7b0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xe0]
call fcn.1400ce1e0
movdqa xmm0, xmmword [0x1402b45f0]
mov rax, rdi
movdqa xmm1, xmmword [0x1402b4640]
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm1
movups xmmword [rbp + 0x1a0], xmm1
movups xmmword [rbp + 0x1b0], xmm1
nop word [rax + rax]
movdqu xmm1, xmmword [rbp + rax + 0xe0]
movdqu xmm0, xmmword [rbp + rax + 0x140]
xorps xmm0, xmm1
movdqu xmmword [rbp + rax + 0x140], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
xorps xmm0, xmm1
movdqu xmmword [rbp + rax + 0x180], xmm0
add rax, 0x10
cmp rax, 0x20
jl 0x140016fd0
movups xmm0, xmmword [0x14026f820]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026f830]
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cf6c0
mov rbx, rdi
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rbp + rbx + 0x110]
mov rcx, rdi
mov edx, InitCommonControls
movups xmmword [rbp + 0xc0], xmm0
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x100]
xor byte [rbp + rcx + 0xc0], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140017070
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
call fcn.1400cd240
lea r8, [rsp + 0x50]
mov edx, InitCommonControls
lea rcx, [rbp + 0xc0]
call fcn.1400cf6c0
mov edx, 1
lea rcx, [rbp + 0xc0]
mov r9, r15
lea r8d, [rdx + 0xf]
call fcn.140206a40
cmp rax, 0x10
jne 0x140017634
movups xmm0, xmmword [rbp + 0xc0]
add rbx, rax
movups xmmword [rbp + 0x100], xmm0
cmp rbx, 0x30
jl 0x140017050
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
movups xmm0, xmmword [0x14026f820]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026f830]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cf6c0
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xe0]
call fcn.1400cf6c0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
mov edx, 1
lea rcx, [rbp + 0xe0]
mov r9, r15
lea r8d, [rdx + 0x1f]
call fcn.140206a40
cmp rax, 0x20
je 0x1400171b2
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400171a3
jmp 0x14001766a
movups xmm0, xmmword [rbp + 0x110]
movups xmmword [rbp + 0x100], xmm0
call fcn.1400ce7b0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x120]
call fcn.1400ce1e0
movdqa xmm0, xmmword [0x1402b45f0]
mov rax, rdi
movdqa xmm1, xmmword [0x1402b4640]
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm1
movups xmmword [rbp + 0x190], xmm1
movups xmmword [rbp + 0x1a0], xmm1
movups xmmword [rbp + 0x1b0], xmm1
movdqu xmm1, xmmword [rbp + rax + 0x120]
movdqu xmm0, xmmword [rbp + rax + 0x140]
xorps xmm0, xmm1
movdqu xmmword [rbp + rax + 0x140], xmm0
movdqu xmm0, xmmword [rbp + rax + 0x180]
xorps xmm0, xmm1
movdqu xmmword [rbp + rax + 0x180], xmm0
add rax, 0x10
cmp rax, 0x20
jl 0x140017220
movups xmm1, xmmword [0x14026f830]
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
xorps xmm0, xmm0
lea rcx, [rbp + 0x140]
movups xmmword [rbp + 0x110], xmm0
mov edx, 0x40
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [0x14026f820]
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x58], xmm0
call fcn.1400cf6c0
mov r9, qword [rsp + 0x38]
lea rcx, [rbp + 0xc0]
mov edx, 1
xor r15b, r15b
mov r12d, edi
mov r14, rdi
lea r8d, [rdx + 0xf]
call fcn.140206ec4
mov rbx, rax
test eax, eax
jle 0x1400173d1
nop word [rax + rax]
movdqu xmm1, xmmword [rbp + 0xc0]
lea r8, [rbp - 0x40]
movdqu xmm0, xmmword [rbp + 0x100]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xc0]
xorps xmm1, xmm0
movdqu xmmword [rbp + 0xc0], xmm1
call fcn.1400cd240
lea r8, [rsp + 0x50]
mov edx, InitCommonControls
lea rcx, [rbp + 0xc0]
call fcn.1400cf6c0
mov r9, qword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
mov edx, 1
lea r8d, [rdx + 0xf]
call fcn.140206a40
cmp rax, 0x10
jne 0x140017445
mov rcx, qword [rsp + 0x30]
movzx r15d, bl
movups xmm0, xmmword [rbp + 0xc0]
mov eax, ebx
add r14, rax
imul rax, r14, 0x3e8
movups xmmword [rbp + 0x100], xmm0
cqo
idiv qword [rcx + 0xe0]
mov rbx, rax
cmp r12d, eax
je 0x1400173a0
mov rcx, qword [rcx + 0xf0]
xor r9d, r9d
movsxd r8, ebx
mov edx, 0x402
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x30]
mov r12d, ebx
cmp dword [rcx + 0xf8], edi
jne 0x14001740f
call fcn.140021bc0
mov r9, qword [rsp + 0x38]
lea rcx, [rbp + 0xc0]
mov edx, 1
lea r8d, [rdx + 0xf]
call fcn.140206ec4
mov ebx, eax
test eax, eax
jg 0x1400172e0
test ebx, ebx
jns 0x14001747f
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_READ_ERROR
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017400
jmp 0x14001766a
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_SPLIT_MSG_CANCEL
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017436
jmp 0x14001766a
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017470
jmp 0x14001766a
mov rbx, qword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
mov edx, 1
and r15b, 0xf
mov r9, rbx
mov byte [rbp + 0xc0], r15b
mov r8d, edx
call fcn.140206a40
cmp rax, 1
je 0x140017508
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x1400174da
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400174d0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov ecx, 2
call fcn.1402070b0
mov rcx, rax
lea rdx, str.Error:_Could_not_write_the_file_size_modulo_n
call fcn.140018a20
mov eax, esi
jmp 0x14001760b
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
movups xmm0, xmmword [0x14026f820]
lea r8, [rsp + 0x50]
mov edx, 0x40
movups xmm1, xmmword [0x14026f830]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x50], rdi
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm1
call fcn.1400cf6c0
lea r8, [rsp + 0x50]
mov edx, 0x20
lea rcx, [rbp + 0xe0]
call fcn.1400cf6c0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400cf800
mov edx, 1
lea rcx, [rbp + 0xe0]
mov r9, rbx
lea r8d, [rdx + 0x1f]
call fcn.140206a40
cmp rax, 0x20
je 0x1400175cf
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400175c0
jmp 0x14001766a
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_SPLIT_MSG_DONE
call fcn.140048480
test rax, rax
je 0x1400175fb
nop
inc rsi
cmp word [rax + rsi*2], di
jne 0x1400175f0
mov edi, esi
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
xor eax, eax
mov r14, qword [rsp + 0x3d8]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x3e0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_WRITE_ERROR
call fcn.140048480
test rax, rax
je 0x14001766a
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017660
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov eax, esi
jmp 0x14001760b
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048480
test rax, rax
je 0x1400176aa
mov rdi, rsi
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400176a0
mov r8d, edi
mov rdx, rax
mov rcx, r13
call fcn.140018f50
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
jmp 0x140017613
call fcn.140044d30
mov rcx, rax
lea r8, str.TEXT
lea rdx, str.TEXT_ENCRYPT_MSG_ERROR
call fcn.140048480
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140016a6a
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140017700
jmp 0x140016a6a