Function at 0x401ed0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov edi, ecx
push edi
push 1
push edi
call ebx
push eax
push 1
push str.Scanning_file_content:__ws
call fcn.00404640
add esp, 0x14
test eax, eax
je 0x401f02
mov ecx, eax
call fcn.00404450
mov edx, str..KIVRQMWFW
mov ecx, edi
call fcn.00404790
test eax, eax
je 0x402196
mov edx, str..KRAB_key
mov ecx, edi
call fcn.00404790
test eax, eax
jne 0x402196
push 0x41e3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x41e328], 1
push 0x41e3b8
adc dword [0x41e32c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push 1
push edi
call ebx
push eax
push 1
push str.Decrypting_file:__ws
call fcn.00404640
add esp, 0x14
test eax, eax
je 0x401f6f
mov ecx, eax
call fcn.00404450
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [0x41e318], esi
jne 0x401fc6
push edi
push 1
push edi
call ebx
push eax
push esi
push str._s.KRABBACKUP
call fcn.00404640
mov esi, eax
add esp, 0x14
mov dword [ebp - 4], esi
test esi, esi
jne 0x401fc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 1
push 0xa
push str.Proceed__:_Error_allocating_memory_for_backup_name_0x_X_r_n
call fcn.004013b0
add esp, 0x14
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 1
push 1
push edi
call ebx
push eax
push str.Proceed__:_Trying_to_backup_file__extended_path_:__ws_r_n
call fcn.004013b0
add esp, 0x14
cmp dword [0x41e318], 0
jne 0x402054
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402054
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41e3b8
call eax
add dword [0x41e360], 1
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
adc dword [0x41e364], 0
push 0x41e3b8
call eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push edi
push 2
push 1
push edi
call ebx
add eax, 0xa
push eax
push str.___________________________________________FILE:__ws__ERROR_BACKUPING:_0x_X_______________________________________r_n
call fcn.004013b0
add esp, 0x18
call esi
push eax
push edi
push 2
push edi
call ebx
add eax, 0xa
push eax
push 1
push str.ERROR_BACKUPING_FILE:__ws___GetLastError____d_n
jmp 0x402162
push edi
push 1
push 1
push edi
call ebx
push eax
push str.Proceed__:_File:__extended_path___ws_was_BACKUPED_successfully_r_n
call fcn.004013b0
mov edx, dword [ebp + 8]
add esp, 0x14
mov ecx, edi
call fcn.004018f0
test eax, eax
je 0x4020ea
push edi
push 1
push 1
push edi
call ebx
push eax
push str._____________FILE:__ws__DECRYPTED_SUCCESS______________r_n
call fcn.004013b0
add esp, 0x14
push edi
push 1
push edi
call ebx
push eax
push 1
push str.FILE__ws___DECRYPTED_n
call fcn.00404640
add esp, 0x14
test eax, eax
je 0x4020af
mov ecx, eax
call fcn.00404450
cmp dword [0x41e318], 0
jne 0x4020bf
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41e3b8
call eax
add dword [0x41e368], 1
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
adc dword [0x41e36c], 0
push 0x41e3b8
call eax
jmp 0x402175
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41e3b8
call eax
add dword [0x41e360], 1
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
adc dword [0x41e364], 0
push 0x41e3b8
call eax
cmp dword [0x41e318], 0
jne 0x40212c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40212c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push edi
push 2
push 1
push edi
call ebx
add eax, 0xa
push eax
push str.___________________________________________FILE:__ws__ERROR_DECRYPTING:_0x_X_______________________________________r_n
call fcn.004013b0
add esp, 0x18
call esi
push eax
push edi
push 2
push edi
call ebx
add eax, 0xa
push eax
push 1
push str.ERROR_DECRYPTING_FILE:__ws___GetLastError____d_n
call fcn.00404640
add esp, 0x18
test eax, eax
je 0x402175
mov ecx, eax
call fcn.00404450
mov eax, dword [ebp - 4]
test eax, eax
je 0x40218a
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 1
push 1
push edi
call ebx
push eax
push str.Proceed__:_file__ws_is_not_a_KRAB_encrypted_file_r_n
call fcn.004013b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret