Function at 0x402f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x174]
movq xmm0, qword [str.Mode:]
mov ecx, 0x57
push dword [0x417f04]
mov esi, str.Usage:_r_n_noback_:_option_turns_off_file_backuping_while_decrypting__use_at_your_own_risk._r_n_path__C:
mov dword [ebp - 0x194], eax
mov eax, dword [0x4196f8]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
mov ax, word [0x4196fc]
movq qword [ebp - 0x14], xmm0
movsw word es:[edi], word [esi]
xor edi, edi
mov word [ebp - 8], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x417f08]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x417f0c]
add esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [0x417f10]
add esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, esi
lea esi, [eax*2 + 2]
mov eax, dword [0x41e37c]
test eax, eax
jne 0x403035
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
push esi
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x14]
mov dword [0x41e310], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.GandCrab_ransomware_decryptor_n_n
call fcn.004050cb
mov eax, dword [ebp + 8]
add esp, 4
cmp eax, 1
jle 0x403158
mov esi, 1
lea ecx, [ecx]
mov eax, dword [ebp - 0x194]
push str._noback
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40309e
push str.No_backuping_mode_turned_on_r_n
mov dword [0x41e318], 1
call fcn.00405007
jmp 0x40310e
mov eax, dword [ebp - 0x194]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4030bb
lea edi, [eax + 1]
jmp 0x403111
test edi, edi
je 0x403137
test ebx, ebx
jne 0x403137
mov eax, dword [ebp - 0x194]
push str.Decrypting_single_file_directory:
mov dword [ebp - 0x178], 0
mov ebx, dword [eax + esi*4]
call fcn.004050cb
add esp, 4
lea eax, [ebp - 0x178]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x4197a0
call fcn.004050cb
add esp, 4
inc esi
cmp esi, dword [ebp + 8]
jl 0x403070
test edi, edi
je 0x403158
test ebx, ebx
jne 0x403158
push str.Please_specify_an_absolute_path_to_file_or_directory_to_decrypt_r_n
call fcn.004050cb
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Invalid_options._r_n
call fcn.00405007
lea eax, [ebp - 0x174]
push eax
call fcn.00405007
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x41e310]
test eax, eax
je 0x40319b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
test ebx, ebx
je 0x403173
push dword [0x417f08]
jmp 0x403179
push dword [0x417f04]
push eax
call esi
cmp dword [0x41e318], 0
je 0x40318d
push dword [0x417f10]
jmp 0x403193
push dword [0x417f0c]
push dword [0x41e310]
call esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x41e2f0
call esi
push 0x41e2d8
call esi
call fcn.004014b0
mov dword [0x41e308], eax
test eax, eax
jne 0x4031d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_while_creating_decryption_log_n_n
call fcn.004050cb
jmp 0x4031db
push eax
push str.Decryption_log_path:__s_n_nDo_not_remove_it__it_is_needed_for_debugging_some_decryption_problems.
call fcn.00405007
add esp, 8
push 0
push 1
push 0
push str.This_is_the_decryptor_with_extended_error_output_r_n_r_n
call fcn.004013b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
mov dword [ebp - 0x194], 0
push str.BwIAAACkAABSU0EyAAgAAAEAAQCn8HVHO_8P_fSF2rrDl0LNgBLwTwKzmkBr2QinyZbbEz78Fp0S0FA0iVIe8q4AjPagdjs9IV1GNjHDEEFnLORO8iyAF1CBe3cExiDrBFxfK84OM9pl3LFiJvO61520m7ETsvC_pSz5zktzvK74ujKdh1BvXSjF3x8mNmgXtxLVI48QPUYirBqPlYPrf1EgHcbjy9IVCd443KLF0pZ5lzG81DbWuc3YIFYOFDVZsCYPnu_kBTz0Kn43z_dY3qiBQs7YVmM1hL6P3LSpBgzNVUoztvsanGTpLaLHmmJ9WI9RO522fcdsAPgfxOG129r4TBSGJhffl0KHTDrncg_0AoW2_2GA4fXf4oy0ukuR_hkSNeVkClRaik3ay103vh7rWDEJvm3JoTfBXYO3YTB7Gels_y69axUT9N17ulwe6DpvyTlr1JyYbRuVZFjZbgOtq7zt0UYj6gKxA8F3k2o9ix3H2KGSr1uCku5zzpBgtvznoy0o9i3bLI6PMN2y48ctD7VQ0eMa5BpUM6idUvFWhyB2_4sZXukvF7IKr9WVNZJ5WEqf9CXnjd9E1bXHh6gTuefYk6t5F4122RAXbU12UoEIfZhZCcq_kFq4YoP3ZE8UbvQ644Dj7Asa_NJnjCWGTXiLkfYHAUKbvKcn8ykucLz4hgAmQmq5yUZtxnCkTlvnVzSDweLsK4A_dsX1rc8yVLuGC0mhEM4logQ9z0QJoW8clIWry8xI5A42wVjwulNT8eiuqovX9z1xo3AmOZUF0ChbsKez17YCk0b6cCF4BO5Wp9Eqvrlfemd6Mr1YmkABUWSf2ZBs1uAQten5h5D35P78t1fYLciP26xfqhjCKQ0xKd_HSWw1dMkH5TtUCmzm2FllC9aWqmlqZ9lsToiSQgpqQtyK6Mb7roVP_t2uR9xNqeJjh4CirLiK1A9pOhibx8Raa8fCc5eSOnX22XRMczjwE4OHCwFysTNfGYPha7K3QHA1JPBl5o6W2DDCD_iEaLDgaxycVkka5SvPimCSCmQWMeJOxKH7Cgn9CN0fu3GvwcG1wLgTfjwyTEV4KSJvJZfLJauEYoqXHdwuBJ5MSDOqEC9ZraTAR393eNBDvExf0vZoIbYQvOO8jeEHG5QjRRIpsdXF4hU2eOBvTlnFxS7F48d_jlcxnhLFPwrMI06mUGP0CNMWOpTzQAv2CsKuEOi4MGfCw99_sAuBb2t8939q1xdcap6biNcbiEDtCNFth3CUrxCZPPlnd0vCwHTprgcOzRQP3bfvzQdp_WoWS7y2NKx0rZ81wVhB7ihAcVhDWybezQTxpYBh6qxFir0quidOVtKlsk0kfGs0O1bJ87i0SHN63unBm0PXOeqIAcQZmPfFozERvRkExxbdw0cDhPM7BHRFuU5SJu88LtjRf5rG_FVSZZ_KlXnKUzE84ADEtTk7U7J9sfLeK0WEbIwcdK02BBl0fSyO4KjbCUCYfcx2pEHcZscYZkfKKJY30DxIFE9fg2VouaE8
call edi
push 4
push 0x3000
lea eax, [eax*2 + 2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push str.BwIAAACkAABSU0EyAAgAAAEAAQCn8HVHO_8P_fSF2rrDl0LNgBLwTwKzmkBr2QinyZbbEz78Fp0S0FA0iVIe8q4AjPagdjs9IV1GNjHDEEFnLORO8iyAF1CBe3cExiDrBFxfK84OM9pl3LFiJvO61520m7ETsvC_pSz5zktzvK74ujKdh1BvXSjF3x8mNmgXtxLVI48QPUYirBqPlYPrf1EgHcbjy9IVCd443KLF0pZ5lzG81DbWuc3YIFYOFDVZsCYPnu_kBTz0Kn43z_dY3qiBQs7YVmM1hL6P3LSpBgzNVUoztvsanGTpLaLHmmJ9WI9RO522fcdsAPgfxOG129r4TBSGJhffl0KHTDrncg_0AoW2_2GA4fXf4oy0ukuR_hkSNeVkClRaik3ay103vh7rWDEJvm3JoTfBXYO3YTB7Gels_y69axUT9N17ulwe6DpvyTlr1JyYbRuVZFjZbgOtq7zt0UYj6gKxA8F3k2o9ix3H2KGSr1uCku5zzpBgtvznoy0o9i3bLI6PMN2y48ctD7VQ0eMa5BpUM6idUvFWhyB2_4sZXukvF7IKr9WVNZJ5WEqf9CXnjd9E1bXHh6gTuefYk6t5F4122RAXbU12UoEIfZhZCcq_kFq4YoP3ZE8UbvQ644Dj7Asa_NJnjCWGTXiLkfYHAUKbvKcn8ykucLz4hgAmQmq5yUZtxnCkTlvnVzSDweLsK4A_dsX1rc8yVLuGC0mhEM4logQ9z0QJoW8clIWry8xI5A42wVjwulNT8eiuqovX9z1xo3AmOZUF0ChbsKez17YCk0b6cCF4BO5Wp9Eqvrlfemd6Mr1YmkABUWSf2ZBs1uAQten5h5D35P78t1fYLciP26xfqhjCKQ0xKd_HSWw1dMkH5TtUCmzm2FllC9aWqmlqZ9lsToiSQgpqQtyK6Mb7roVP_t2uR9xNqeJjh4CirLiK1A9pOhibx8Raa8fCc5eSOnX22XRMczjwE4OHCwFysTNfGYPha7K3QHA1JPBl5o6W2DDCD_iEaLDgaxycVkka5SvPimCSCmQWMeJOxKH7Cgn9CN0fu3GvwcG1wLgTfjwyTEV4KSJvJZfLJauEYoqXHdwuBJ5MSDOqEC9ZraTAR393eNBDvExf0vZoIbYQvOO8jeEHG5QjRRIpsdXF4hU2eOBvTlnFxS7F48d_jlcxnhLFPwrMI06mUGP0CNMWOpTzQAv2CsKuEOi4MGfCw99_sAuBb2t8939q1xdcap6biNcbiEDtCNFth3CUrxCZPPlnd0vCwHTprgcOzRQP3bfvzQdp_WoWS7y2NKx0rZ81wVhB7ihAcVhDWybezQTxpYBh6qxFir0quidOVtKlsk0kfGs0O1bJ87i0SHN63unBm0PXOeqIAcQZmPfFozERvRkExxbdw0cDhPM7BHRFuU5SJu88LtjRf5rG_FVSZZ_KlXnKUzE84ADEtTk7U7J9sfLeK0WEbIwcdK02BBl0fSyO4KjbCUCYfcx2pEHcZscYZkfKKJY30DxIFE9fg2VouaE8
mov esi, eax
call edi
push eax
push str.BwIAAACkAABSU0EyAAgAAAEAAQCn8HVHO_8P_fSF2rrDl0LNgBLwTwKzmkBr2QinyZbbEz78Fp0S0FA0iVIe8q4AjPagdjs9IV1GNjHDEEFnLORO8iyAF1CBe3cExiDrBFxfK84OM9pl3LFiJvO61520m7ETsvC_pSz5zktzvK74ujKdh1BvXSjF3x8mNmgXtxLVI48QPUYirBqPlYPrf1EgHcbjy9IVCd443KLF0pZ5lzG81DbWuc3YIFYOFDVZsCYPnu_kBTz0Kn43z_dY3qiBQs7YVmM1hL6P3LSpBgzNVUoztvsanGTpLaLHmmJ9WI9RO522fcdsAPgfxOG129r4TBSGJhffl0KHTDrncg_0AoW2_2GA4fXf4oy0ukuR_hkSNeVkClRaik3ay103vh7rWDEJvm3JoTfBXYO3YTB7Gels_y69axUT9N17ulwe6DpvyTlr1JyYbRuVZFjZbgOtq7zt0UYj6gKxA8F3k2o9ix3H2KGSr1uCku5zzpBgtvznoy0o9i3bLI6PMN2y48ctD7VQ0eMa5BpUM6idUvFWhyB2_4sZXukvF7IKr9WVNZJ5WEqf9CXnjd9E1bXHh6gTuefYk6t5F4122RAXbU12UoEIfZhZCcq_kFq4YoP3ZE8UbvQ644Dj7Asa_NJnjCWGTXiLkfYHAUKbvKcn8ykucLz4hgAmQmq5yUZtxnCkTlvnVzSDweLsK4A_dsX1rc8yVLuGC0mhEM4logQ9z0QJoW8clIWry8xI5A42wVjwulNT8eiuqovX9z1xo3AmOZUF0ChbsKez17YCk0b6cCF4BO5Wp9Eqvrlfemd6Mr1YmkABUWSf2ZBs1uAQten5h5D35P78t1fYLciP26xfqhjCKQ0xKd_HSWw1dMkH5TtUCmzm2FllC9aWqmlqZ9lsToiSQgpqQtyK6Mb7roVP_t2uR9xNqeJjh4CirLiK1A9pOhibx8Raa8fCc5eSOnX22XRMczjwE4OHCwFysTNfGYPha7K3QHA1JPBl5o6W2DDCD_iEaLDgaxycVkka5SvPimCSCmQWMeJOxKH7Cgn9CN0fu3GvwcG1wLgTfjwyTEV4KSJvJZfLJauEYoqXHdwuBJ5MSDOqEC9ZraTAR393eNBDvExf0vZoIbYQvOO8jeEHG5QjRRIpsdXF4hU2eOBvTlnFxS7F48d_jlcxnhLFPwrMI06mUGP0CNMWOpTzQAv2CsKuEOi4MGfCw99_sAuBb2t8939q1xdcap6biNcbiEDtCNFth3CUrxCZPPlnd0vCwHTprgcOzRQP3bfvzQdp_WoWS7y2NKx0rZ81wVhB7ihAcVhDWybezQTxpYBh6qxFir0quidOVtKlsk0kfGs0O1bJ87i0SHN63unBm0PXOeqIAcQZmPfFozERvRkExxbdw0cDhPM7BHRFuU5SJu88LtjRf5rG_FVSZZ_KlXnKUzE84ADEtTk7U7J9sfLeK0WEbIwcdK02BBl0fSyO4KjbCUCYfcx2pEHcZscYZkfKKJY30DxIFE9fg2VouaE8
push esi
call fcn.00404eea
add esp, 0xc
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push str.Working_with_krab_key:__ws__r_n_r_n
call fcn.004013b0
add esp, 0x14
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea eax, [ebp - 0x194]
push eax
push str.BwIAAACkAABSU0EyAAgAAAEAAQCn8HVHO_8P_fSF2rrDl0LNgBLwTwKzmkBr2QinyZbbEz78Fp0S0FA0iVIe8q4AjPagdjs9IV1GNjHDEEFnLORO8iyAF1CBe3cExiDrBFxfK84OM9pl3LFiJvO61520m7ETsvC_pSz5zktzvK74ujKdh1BvXSjF3x8mNmgXtxLVI48QPUYirBqPlYPrf1EgHcbjy9IVCd443KLF0pZ5lzG81DbWuc3YIFYOFDVZsCYPnu_kBTz0Kn43z_dY3qiBQs7YVmM1hL6P3LSpBgzNVUoztvsanGTpLaLHmmJ9WI9RO522fcdsAPgfxOG129r4TBSGJhffl0KHTDrncg_0AoW2_2GA4fXf4oy0ukuR_hkSNeVkClRaik3ay103vh7rWDEJvm3JoTfBXYO3YTB7Gels_y69axUT9N17ulwe6DpvyTlr1JyYbRuVZFjZbgOtq7zt0UYj6gKxA8F3k2o9ix3H2KGSr1uCku5zzpBgtvznoy0o9i3bLI6PMN2y48ctD7VQ0eMa5BpUM6idUvFWhyB2_4sZXukvF7IKr9WVNZJ5WEqf9CXnjd9E1bXHh6gTuefYk6t5F4122RAXbU12UoEIfZhZCcq_kFq4YoP3ZE8UbvQ644Dj7Asa_NJnjCWGTXiLkfYHAUKbvKcn8ykucLz4hgAmQmq5yUZtxnCkTlvnVzSDweLsK4A_dsX1rc8yVLuGC0mhEM4logQ9z0QJoW8clIWry8xI5A42wVjwulNT8eiuqovX9z1xo3AmOZUF0ChbsKez17YCk0b6cCF4BO5Wp9Eqvrlfemd6Mr1YmkABUWSf2ZBs1uAQten5h5D35P78t1fYLciP26xfqhjCKQ0xKd_HSWw1dMkH5TtUCmzm2FllC9aWqmlqZ9lsToiSQgpqQtyK6Mb7roVP_t2uR9xNqeJjh4CirLiK1A9pOhibx8Raa8fCc5eSOnX22XRMczjwE4OHCwFysTNfGYPha7K3QHA1JPBl5o6W2DDCD_iEaLDgaxycVkka5SvPimCSCmQWMeJOxKH7Cgn9CN0fu3GvwcG1wLgTfjwyTEV4KSJvJZfLJauEYoqXHdwuBJ5MSDOqEC9ZraTAR393eNBDvExf0vZoIbYQvOO8jeEHG5QjRRIpsdXF4hU2eOBvTlnFxS7F48d_jlcxnhLFPwrMI06mUGP0CNMWOpTzQAv2CsKuEOi4MGfCw99_sAuBb2t8939q1xdcap6biNcbiEDtCNFth3CUrxCZPPlnd0vCwHTprgcOzRQP3bfvzQdp_WoWS7y2NKx0rZ81wVhB7ihAcVhDWybezQTxpYBh6qxFir0quidOVtKlsk0kfGs0O1bJ87i0SHN63unBm0PXOeqIAcQZmPfFozERvRkExxbdw0cDhPM7BHRFuU5SJu88LtjRf5rG_FVSZZ_KlXnKUzE84ADEtTk7U7J9sfLeK0WEbIwcdK02BBl0fSyO4KjbCUCYfcx2pEHcZscYZkfKKJY30DxIFE9fg2VouaE8
call edi
mov edx, eax
call section..text
mov edi, eax
add esp, 4
mov dword [ebp - 0x1a4], edi
test edi, edi
je 0x40357c
push 0
push 1
push 0
push str.Key_has_been_decoded_n
call fcn.004013b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push str..KIVRQMWFW
push 1
push 1
push str..KIVRQMWFW
call esi
push eax
push str.Searching_by_extension:__ws_r_n
call fcn.004013b0
add esp, 0x14
push str..KIVRQMWFW
push 1
push str..KIVRQMWFW
call esi
push eax
push 1
push str.Target_Extension:__ws
call fcn.00404640
add esp, 0x14
mov dword [0x41e30c], eax
call fcn.004011d0
push str..KIVRQMWFW
push 1
push str..KIVRQMWFW
call esi
push eax
push 1
push str.Starting__Target_extension:__ws
call fcn.00404640
add esp, 0x14
mov dword [ebp - 0x198], eax
test eax, eax
je 0x4033de
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor ecx, ecx
mov dword [ebp - 0x1a0], eax
mov word [ebp - 0x190], cx
xorps xmm0, xmm0
mov dword [ebp - 0x17e], ecx
lea ecx, [ebp - 0x190]
push ecx
push eax
movdqu xmmword [ebp - 0x18e], xmm0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4033de
push dword [ebp - 0x198]
call esi
cdq
sub eax, edx
mov esi, dword [ebp - 0x198]
mov ecx, eax
movsx eax, word [ebp - 0x182]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
mov edx, esi
sub eax, ecx
mov ecx, dword [ebp - 0x1a0]
mov word [ebp - 0x186], ax
mov eax, dword [ebp - 0x18a]
add eax, 4
mov word [ebp - 0x184], ax
mov ax, word [ebp - 0x18e]
mov word [ebp - 0x180], ax
xor eax, eax
mov dword [ebp - 0x19c], eax
lea eax, [ebp - 0x186]
push eax
push 0xc
push dword [ebp - 0x19c]
call fcn.004012f0
mov eax, dword [0x41e37c]
add esp, 0xc
test eax, eax
jne 0x4033d4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x419b20
call fcn.00404f12
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 4
push 0x41e3b8
call esi
push 8
push 8
call fcn.004051a4
add esp, 8
mov dword [0x41e35c], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push 0x41e384
call esi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
mov dword [0x41e358], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
push 0x64
push 0
push 0
push 0x403dc0
push 0
push 0x41e334
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test ebx, ebx
jne 0x403462
mov edx, dword [ebp - 0x194]
mov ecx, edi
call fcn.00402de0
jmp 0x403474
push dword [ebp - 0x194]
mov edx, edi
mov ecx, ebx
call fcn.00402a20
add esp, 4
push dword [0x41e35c]
mov edi, dword [sym.imp.KERNEL32.dll_QueryDepthSList]
call edi
cmp ax, 5
jb 0x4034a4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push dword [0x41e35c]
call edi
push 0x37
movzx esi, ax
call ebx
cmp esi, 5
jae 0x403490
mov esi, dword [0x41e35c]
test esi, esi
je 0x4034cd
push 8
push 8
call fcn.004051a4
add esp, 8
test eax, eax
je 0x4034cd
push eax
push esi
mov dword [eax + 4], str.Decryptions_is_finished___Press_any_key...
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
call fcn.00403d60
push 0x40
push 0x419b80
push str.Decryption_is_FINISHED
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 1
push 0
push str._nDecryption_finished__n
call fcn.004013b0
add esp, 0x10
push 0x8000
push 0
push dword [ebp - 0x1a4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [0x41e30c]
test esi, esi
je 0x403538
mov eax, dword [0x41e37c]
test eax, eax
jne 0x40352a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
push eax
call ebx
jmp 0x40353e
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [0x41e310]
test esi, esi
je 0x403562
mov eax, dword [0x41e37c]
test eax, eax
jne 0x40355c
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
push esi
push 0
push eax
call ebx
call fcn.00405187
push 0x419b20
call fcn.00404f12
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x41e2f0
call esi
push 0x41e2d8
call esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004048b1
mov esp, ebp
pop ebp
ret