Function at 0x41495f
Capabilities:
Get disk information
Print debug messages
Suspend thread
Terminate process
Terminate thread

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x1b8
mov eax, dword [0x49ab28]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
push ebx
push 0x10000
xor ebx, ebx
push 8
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x138], 0x5c3a41
mov byte [ebp - 0x119], bl
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x144], eax
cmp eax, ebx
je 0x41484f
push esi
lea esi, [eax + 0x104]
mov dword [ebp - 0x12c], esi
push edi
mov edi, 0x400
add esi, edi
mov dword [ebp - 0x100], esi
mov eax, 0x800
add esi, eax
mov dword [ebp - 0xfc], esi
add esi, eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x120], esi
add esi, 0x1000
mov dword [ebp - 0x128], esi
add eax, 0x238
add esi, edi
push eax
mov dword [ebp - 0x134], esi
add esi, edi
push 0x486fc4
push dword [ebp - 0x12c]
mov dword [ebp - 0x13c], esi
add esi, edi
mov byte [ebp - 0xe0], bl
mov byte [ebp - 0xa0], bl
mov byte [ebp - 0x20], bl
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x6c], 0x4946fa
call fcn.0046ec88
add esp, 0xc
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp - 0x124]
add eax, 0x238
jmp 0x4144ab
mov cl, byte [eax]
cmp cl, 0xd
je 0x4144a7
cmp cl, 0xa
jne 0x4144aa
mov byte [eax], 0x20
inc eax
cmp byte [eax], bl
jne 0x41449b
push str.Generic_Ransomware__Standalone_
push dword [ebp - 0x12c]
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
lea eax, [ebp + 0x68]
push eax
mov eax, dword [ebp - 0x124]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x4144e3
lea eax, [ebp + 0x68]
push eax
call fcn.004012a0
pop ecx
call fcn.00406ca2
mov ecx, dword [ebp - 0x120]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x124]
push dword [eax + 0x12c]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
push 0x800
cmp eax, ebx
je 0x414600
push dword [ebp - 0x120]
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
mov eax, dword [ebp - 0x120]
push 9
add eax, 2
push str.:WINDOWS
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x41457f
mov eax, dword [ebp - 0x120]
push 0xf
add eax, 2
push str.:PROGRAM_FILES
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x41457f
push 0xdeaddead
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [ebp - 0x119], 0x53
jmp 0x4145f2
mov eax, dword [ebp - 0x124]
push dword [eax + 0x130]
push ebx
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x130], eax
cmp eax, ebx
je 0x4145df
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4145cc
push 0xdeaddead
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x119], 0x49
push str.Generic_Ransomware__Injected_
push dword [ebp - 0x12c]
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
push dword [ebp - 0x140]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41465f
mov eax, dword [ebp - 0x124]
add eax, 0x134
push eax
push dword [ebp - 0x120]
call fcn.0046c445
mov eax, dword [ebp - 0x120]
push 9
add eax, 2
push str.:WINDOWS
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0x18
test eax, eax
je 0x414658
mov eax, dword [ebp - 0x120]
push 0xf
add eax, 2
push str.:PROGRAM_FILES
push eax
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
mov byte [ebp - 0x119], 0x53
test eax, eax
jne 0x41465f
mov byte [ebp - 0x119], 0x49
cmp byte [ebp - 0x119], 0x49
mov ecx, dword [ebp - 0x120]
mov al, byte [ecx]
mov byte [ebp - 0x138], al
jne 0x4146ad
mov eax, dword [ebp - 0x124]
push dword [eax + 0x12c]
push ecx
push dword [eax + 0x130]
push str.ThreadID__d____s__ProcessID__d_
push dword [ebp - 0x100]
call fcn.00407d7e
push dword [ebp - 0x100]
push dword [ebp - 0x120]
call fcn.0046e0b5
add esp, 0x1c
push ebx
push ebx
push edi
push dword [ebp - 0x128]
push 0xffffffffffffffff
push dword [ebp - 0x120]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4146df
push edi
push dword [ebp - 0x120]
push dword [ebp - 0x128]
call fcn.0046fe9f
add esp, 0xc
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x134]
push ecx
mov byte [eax], bl
push eax
mov eax, dword [ebp - 0x124]
mov byte [ecx], bl
push dword [eax + 0xc]
call fcn.0041266c
lea edi, [esi + 0x400]
push edi
push esi
push dword [ebp - 0x134]
mov byte [esi], bl
mov byte [edi], bl
call fcn.004125e4
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x114], eax
xor eax, eax
add esp, 0x18
cmp byte [ebp - 0x119], 0x53
mov byte [ebp - 0xf7], bl
setne al
mov byte [ebp - 0xf8], bl
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], edi
dec eax
and eax, 0xfa00f2
add eax, 0x44524854
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp byte [ebp - 0x119], 0x53
pop edi
mov dword [ebp - 0xe4], eax
pop esi
jne 0x4147f0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x128]
call fcn.0041258c
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x128]
call fcn.00407b51
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x128]
call fcn.00407b85
add esp, 0x18
mov byte [ebp - 0xf7], 0x78
cmp byte [0x49c17d], bl
je 0x41481d
mov eax, dword [ebp - 0x124]
add eax, 0x238
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x118]
push eax
call fcn.00415057
pop ecx
mov dword [ebp + 0x6c], ebx
cmp dword [0x49c1a8], ebx
jne 0x41482e
cmp dword [0x49c404], 3
je 0x41483b
lea eax, [ebp - 0x118]
push eax
call fcn.00415af9
pop ecx
push dword [ebp - 0x144]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x124]
call fcn.00411f08
pop ecx
mov ecx, dword [ebp + 0x70]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.0046c1d2
add ebp, 0x74
leave
ret
jmp 0x4143a3