Function at 0x410800
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Get common file path
Move file
Set registry value
Suspend thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459690
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10220
call fcn.00430230
mov eax, dword [0x468004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x54f3]
push ebx
push eax
mov dword [ebp - 0x100b0], esi
mov dword [ebp - 0x10138], ebx
mov byte [ebp - 0x54f4], bl
call fcn.0042e2e0
push 0x103
lea ecx, [ebp - 0x56f7]
push ebx
push ecx
mov byte [ebp - 0x56f8], bl
call fcn.0042e2e0
push 0x103
lea edx, [ebp - 0xedf]
push ebx
push edx
mov byte [ebp - 0xee0], bl
call fcn.0042e2e0
push 0x103
lea eax, [ebp - 0x38af]
push ebx
push eax
mov byte [ebp - 0x38b0], bl
call fcn.0042e2e0
mov al, 0x5d
mov dl, 0x74
mov cl, 0x61
add esp, 0x30
mov byte [ebp - 0x100ec], 0x55
mov byte [ebp - 0x100eb], 0x89
mov byte [ebp - 0x100e0], 0x55
mov byte [ebp - 0x100df], 0x8b
mov byte [ebp - 0x100f8], 0x51
mov byte [ebp - 0x100f7], 0x83
mov byte [ebp - 0x100f0], 0x6a
mov byte [ebp - 0x100ef], bl
mov byte [ebp - 0x1e0], 0x72
mov byte [ebp - 0x1df], 0x6d
mov byte [ebp - 0x1de], 0x6e
mov byte [ebp - 0x1dd], 0x73
mov byte [ebp - 0x1dc], 0x6f
mov byte [ebp - 0x1db], 0x66
mov byte [ebp - 0x1da], dl
mov byte [ebp - 0x1d9], 0x2e
mov byte [ebp - 0x1d8], 0x64
mov byte [ebp - 0x1d7], 0x6c
mov byte [ebp - 0x1d6], 0x6c
mov byte [ebp - 0x1d5], bl
mov byte [ebp - 0x88], 0xe8
mov byte [ebp - 0x87], bl
mov byte [ebp - 0x86], bl
mov byte [ebp - 0x85], bl
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], al
mov byte [ebp - 0x82], 0x81
mov byte [ebp - 0x58], 0xe8
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x8b
mov byte [ebp - 0x98], 0xc8
mov byte [ebp - 0x97], bl
mov byte [ebp - 0x96], bl
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x94], 0x8b
mov byte [ebp - 0x93], 0x6d
mov byte [ebp - 0x92], 8
mov byte [ebp - 0x100f4], 0x55
mov byte [ebp - 0x100f3], 0x8b
mov byte [ebp - 0x100f2], 0xec
mov byte [ebp - 0x124], cl
mov byte [ebp - 0x123], bl
mov byte [ebp - 0x122], 0x76
mov byte [ebp - 0x121], bl
mov byte [ebp - 0x120], 0x70
mov al, 0x65
mov byte [ebp - 0x11f], bl
mov byte [ebp - 0x11e], 0x2e
mov byte [ebp - 0x11d], bl
mov byte [ebp - 0x11c], al
mov byte [ebp - 0x11b], bl
mov byte [ebp - 0x11a], 0x78
mov byte [ebp - 0x119], bl
mov byte [ebp - 0x118], al
mov byte [ebp - 0x160], cl
mov byte [ebp - 0x15f], bl
mov byte [ebp - 0x15e], 0x76
mov byte [ebp - 0x15d], bl
mov byte [ebp - 0x15c], 0x69
mov byte [ebp - 0x15b], bl
mov byte [ebp - 0x15a], 0x72
mov byte [ebp - 0x159], bl
mov byte [ebp - 0x158], cl
mov byte [ebp - 0x157], bl
mov byte [ebp - 0x156], 0x2e
mov byte [ebp - 0x155], bl
mov byte [ebp - 0x154], 0x63
mov byte [ebp - 0x153], bl
mov byte [ebp - 0x152], 0x6f
mov byte [ebp - 0x151], bl
mov byte [ebp - 0x150], 0x6d
mov byte [ebp - 0x100e8], 0x55
mov byte [ebp - 0x100e7], 0x8b
mov byte [ebp - 0x100e6], 0xec
mov byte [ebp - 0xe8], 0x8b
mov byte [ebp - 0xe7], 0xff
mov byte [ebp - 0xe6], 0x55
mov byte [ebp - 0xe5], 0x8b
mov byte [ebp - 0xe4], 0xec
mov byte [ebp - 0x2c0], 0x73
mov byte [ebp - 0x2bf], bl
mov byte [ebp - 0x2be], 0x68
mov byte [ebp - 0x2bd], bl
mov byte [ebp - 0x2bc], al
mov byte [ebp - 0x2bb], bl
mov byte [ebp - 0x2ba], 0x6c
mov byte [ebp - 0x2b9], bl
mov byte [ebp - 0x2b8], 0x6c
mov byte [ebp - 0x2b7], bl
mov byte [ebp - 0x2b6], 0x2e
mov byte [ebp - 0x2b5], bl
mov byte [ebp - 0x2b4], 0x7b
mov byte [ebp - 0x2b3], bl
mov byte [ebp - 0x2b2], 0x31
mov byte [ebp - 0x2b1], bl
mov byte [ebp - 0x2b0], 0x37
mov byte [ebp - 0x2af], bl
mov byte [ebp - 0x2ae], 0x45
mov byte [ebp - 0x2ad], bl
mov byte [ebp - 0x2ac], 0x33
mov byte [ebp - 0x2ab], bl
mov byte [ebp - 0x2aa], 0x30
mov byte [ebp - 0x2a9], bl
mov byte [ebp - 0x2a8], 0x31
mov byte [ebp - 0x2a7], bl
mov byte [ebp - 0x2a6], 0x46
mov byte [ebp - 0x2a5], bl
mov byte [ebp - 0x2a4], 0x35
mov byte [ebp - 0x2a3], bl
mov byte [ebp - 0x2a2], 0x2d
mov byte [ebp - 0x2a1], bl
mov byte [ebp - 0x2a0], 0x32
mov byte [ebp - 0x29f], bl
mov byte [ebp - 0x29e], 0x33
mov byte [ebp - 0x29d], bl
mov byte [ebp - 0x29c], 0x43
mov byte [ebp - 0x29b], bl
mov byte [ebp - 0x29a], 0x35
mov byte [ebp - 0x299], bl
mov byte [ebp - 0x298], 0x2d
mov byte [ebp - 0x297], bl
mov byte [ebp - 0x296], 0x43
mov byte [ebp - 0x295], bl
mov byte [ebp - 0x294], 0x45
mov byte [ebp - 0x293], bl
mov byte [ebp - 0x292], 0x30
mov byte [ebp - 0x291], bl
mov byte [ebp - 0x290], 0x30
mov byte [ebp - 0x28f], bl
mov byte [ebp - 0x28e], 0x2d
mov byte [ebp - 0x28d], bl
mov byte [ebp - 0x28c], 0x41
mov byte [ebp - 0x28b], bl
mov byte [ebp - 0x28a], 0x36
mov byte [ebp - 0x289], bl
mov byte [ebp - 0x288], 0x38
mov byte [ebp - 0x287], bl
mov byte [ebp - 0x286], 0x43
mov byte [ebp - 0x285], bl
mov byte [ebp - 0x284], 0x2d
mov byte [ebp - 0x283], bl
mov byte [ebp - 0x282], 0x36
mov byte [ebp - 0x281], bl
mov byte [ebp - 0x280], 0x46
mov byte [ebp - 0x27f], bl
mov byte [ebp - 0x27e], 0x39
mov byte [ebp - 0x27d], bl
mov byte [ebp - 0x27c], 0x34
mov byte [ebp - 0x27b], bl
mov byte [ebp - 0x27a], 0x41
mov byte [ebp - 0x279], bl
mov byte [ebp - 0x278], 0x41
mov byte [ebp - 0x277], bl
mov byte [ebp - 0x276], 0x36
mov byte [ebp - 0x275], bl
mov byte [ebp - 0x274], 0x38
mov byte [ebp - 0x273], bl
mov byte [ebp - 0x272], 0x35
mov byte [ebp - 0x271], bl
mov byte [ebp - 0x270], 0x32
mov byte [ebp - 0x26f], bl
mov byte [ebp - 0x26e], 0x35
mov byte [ebp - 0x26d], bl
mov byte [ebp - 0x26c], 0x44
mov byte [ebp - 0x26b], bl
mov byte [ebp - 0x26a], 0x7d
mov byte [ebp - 0xa8], 0x55
mov byte [ebp - 0xa7], 0x8b
mov byte [ebp - 0xa6], 0xec
mov byte [ebp - 0xa5], 0x6a
mov byte [ebp - 0xa4], 0xff
mov byte [ebp - 0xa3], 0x68
mov byte [ebp - 0xa2], 0xb0
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x6c
mov byte [ebp - 0x196], 0x6f
mov byte [ebp - 0x195], 0x62
mov byte [ebp - 0x194], cl
mov byte [ebp - 0x193], 0x6c
mov byte [ebp - 0x192], 0x5c
mov byte [ebp - 0x191], 0x53
mov byte [ebp - 0x190], 0x59
mov byte [ebp - 0x18f], 0x53
mov byte [ebp - 0x18e], 0x5f
mov byte [ebp - 0x18d], 0x45
mov byte [ebp - 0x18c], 0x30
mov byte [ebp - 0x18b], 0x41
mov byte [ebp - 0x18a], 0x39
mov byte [ebp - 0x189], 0x31
mov byte [ebp - 0x188], 0x33
mov byte [ebp - 0x187], 0x38
mov byte [ebp - 0x50], 0x5c
mov byte [ebp - 0x4f], 0x63
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x79
mov byte [ebp - 0x4c], 0x73
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x5c
mov byte [ebp - 0xf4], 0x5c
mov byte [ebp - 0xf3], 0x70
mov byte [ebp - 0xf2], cl
mov byte [ebp - 0xf1], 0x79
mov byte [ebp - 0xf0], 0x6c
mov byte [ebp - 0xef], 0x6f
mov byte [ebp - 0xee], cl
mov byte [ebp - 0xed], 0x64
mov byte [ebp - 0xec], 0x2e
mov byte [ebp - 0xeb], 0x70
mov byte [ebp - 0xea], 0x64
mov byte [ebp - 0xe9], 0x62
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x8b
mov byte [ebp - 0x2e], 0xec
mov byte [ebp - 0x2d], 0x83
mov byte [ebp - 0x2c], 0xe4
mov byte [ebp - 0x2b], 0xf8
mov byte [ebp - 0xd0], 0x81
mov byte [ebp - 0xcf], 0xec
mov byte [ebp - 0xce], 0x4c
mov byte [ebp - 0xcd], 1
mov byte [ebp - 0xcc], bl
mov byte [ebp - 0xcb], bl
mov byte [ebp - 0xc0], 0x8b
mov byte [ebp - 0xbf], 0x54
mov byte [ebp - 0xbe], 0x24
mov byte [ebp - 0xbd], 4
mov byte [ebp - 0xbc], 0x8b
mov byte [ebp - 0xbb], 0x42
mov byte [ebp - 0xc8], 0x83
mov byte [ebp - 0xc7], 0xec
mov byte [ebp - 0xc6], 0xc
mov byte [ebp - 0xc5], 0x55
mov byte [ebp - 0xc4], 0x56
mov byte [ebp - 0xc3], 0x57
mov byte [ebp - 0x16c], 0x55
mov byte [ebp - 0x16b], 0x8b
mov byte [ebp - 0x16a], 0xec
mov byte [ebp - 0x169], 0x83
mov byte [ebp - 0x168], 0xe4
mov byte [ebp - 0x167], 0xf8
mov byte [ebp - 0x166], 0x53
mov byte [ebp - 0x165], 0x8b
mov byte [ebp - 0x164], 0x1d
mov byte [ebp - 0xb8], 0x55
mov byte [ebp - 0xb7], 0x8b
mov byte [ebp - 0xb6], 0xec
mov byte [ebp - 0xb5], 0xb9
mov byte [ebp - 0xb4], 0x1b
mov byte [ebp - 0xb3], bl
mov byte [ebp - 0xb2], bl
mov byte [ebp - 0x300], 0x56
mov byte [ebp - 0x2ff], bl
mov byte [ebp - 0x2fe], 0x42
mov byte [ebp - 0x2fd], bl
mov byte [ebp - 0x2fc], 0x6f
mov byte [ebp - 0x2fb], bl
mov byte [ebp - 0x2fa], 0x78
mov byte [ebp - 0x2f9], bl
mov byte [ebp - 0x2f8], 0x53
mov byte [ebp - 0x2f7], bl
mov byte [ebp - 0x2f6], al
mov byte [ebp - 0x2f5], bl
mov byte [ebp - 0x2f4], 0x72
mov byte [ebp - 0x2f3], bl
mov byte [ebp - 0x2f2], 0x76
mov byte [ebp - 0x2f1], bl
mov byte [ebp - 0x2f0], 0x69
mov byte [ebp - 0x2ef], bl
mov byte [ebp - 0x2ee], 0x63
mov byte [ebp - 0x2ed], bl
mov byte [ebp - 0x2ec], al
mov byte [ebp - 0x2eb], bl
mov byte [ebp - 0x2ea], 0x2e
mov byte [ebp - 0x2e9], bl
mov byte [ebp - 0x2e8], al
mov byte [ebp - 0x2e7], bl
mov byte [ebp - 0x2e6], 0x78
mov byte [ebp - 0x2e5], bl
mov byte [ebp - 0x2e4], al
mov byte [ebp - 0x2e3], bl
mov byte [ebp - 0x2e2], bl
mov byte [ebp - 0xe0], 0x55
mov byte [ebp - 0xdf], 0x8b
mov byte [ebp - 0xde], 0xec
mov byte [ebp - 0xdd], 0x81
mov byte [ebp - 0xdc], 0xec
mov byte [ebp - 0x324], 0x50
mov byte [ebp - 0x323], bl
mov byte [ebp - 0x322], 0x75
mov byte [ebp - 0x321], bl
mov byte [ebp - 0x320], 0x62
mov byte [ebp - 0x31f], bl
mov byte [ebp - 0x31e], 0x6c
mov byte [ebp - 0x31d], bl
mov byte [ebp - 0x31c], 0x69
mov byte [ebp - 0x31b], bl
mov byte [ebp - 0x31a], 0x63
mov byte [ebp - 0x319], bl
mov byte [ebp - 0x318], 0x5c
mov byte [ebp - 0x317], bl
mov byte [ebp - 0x316], 0x77
mov byte [ebp - 0x315], bl
mov byte [ebp - 0x314], 0x69
mov byte [ebp - 0x313], bl
mov byte [ebp - 0x312], 0x6e
mov byte [ebp - 0x311], bl
mov byte [ebp - 0x310], 0x64
mov byte [ebp - 0x30f], bl
mov byte [ebp - 0x30e], 0x6f
mov byte [ebp - 0x30d], bl
mov byte [ebp - 0x30c], 0x77
mov byte [ebp - 0x30b], bl
mov byte [ebp - 0x30a], 0x2e
mov byte [ebp - 0x309], bl
mov byte [ebp - 0x308], 0x62
mov byte [ebp - 0x307], bl
mov byte [ebp - 0x306], cl
mov byte [ebp - 0x305], bl
mov byte [ebp - 0x304], dl
mov byte [ebp - 0x60], 0x6a
mov byte [ebp - 0x5f], 0x60
mov byte [ebp - 0x5e], 0x68
mov byte [ebp - 0x5d], 0x70
mov byte [ebp - 0x5c], 0x71
mov byte [ebp - 0x5b], 0x40
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x1f8], 0x64
mov byte [ebp - 0x1f7], 0x77
mov byte [ebp - 0x1f6], 0x6f
mov byte [ebp - 0x1f5], 0x6b
mov byte [ebp - 0x1f4], 0x6e
mov byte [ebp - 0x1f3], 0x71
mov byte [ebp - 0x1f2], 0x64
mov byte [ebp - 0x1f1], 0x71
mov byte [ebp - 0x1f0], 0x2d
mov byte [ebp - 0x1ef], 0x64
mov byte [ebp - 0x1ee], 0x77
mov byte [ebp - 0x1ed], 0x64
mov byte [ebp - 0x178], 0x4d
mov byte [ebp - 0x177], 0x69
mov byte [ebp - 0x176], 0x63
mov byte [ebp - 0x175], 0x72
mov byte [ebp - 0x174], 0x6f
mov byte [ebp - 0x173], 0x73
mov byte [ebp - 0x172], 0x6f
mov byte [ebp - 0x171], 0x66
mov byte [ebp - 0x170], dl
mov byte [ebp - 0x14c], 0x3c
mov byte [ebp - 0x14b], 0x70
mov byte [ebp - 0x14a], 0x72
mov byte [ebp - 0x149], 0x6f
mov byte [ebp - 0x148], 0x67
mov byte [ebp - 0x147], 0x72
mov byte [ebp - 0x146], cl
mov byte [ebp - 0x145], 0x6d
mov byte [ebp - 0x70], 0x6a
mov byte [ebp - 0x6f], 0x60
mov byte [ebp - 0x6e], 0x68
mov byte [ebp - 0x6d], pe_nt_image_headers32
mov byte [ebp - 0x6c], 0xb7
mov byte [ebp - 0x6b], 0x42
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x250], dl
mov byte [ebp - 0x24f], 0x77
mov byte [ebp - 0x24e], 0x69
mov byte [ebp - 0x24d], dl
mov byte [ebp - 0x24c], dl
mov byte [ebp - 0x24b], al
mov byte [ebp - 0x24a], 0x72
mov byte [ebp - 0x249], bl
mov byte [ebp - 0x248], 0x73
mov byte [ebp - 0x247], 0x76
mov byte [ebp - 0x246], 0x63
mov byte [ebp - 0x245], 0x68
mov byte [ebp - 0x244], 0x6f
mov byte [ebp - 0x243], 0x73
mov byte [ebp - 0x242], dl
mov byte [ebp - 0x241], 0x2e
mov byte [ebp - 0x240], al
mov byte [ebp - 0x23f], 0x78
mov byte [ebp - 0x23e], al
mov byte [ebp - 0x1c8], 0x44
mov byte [ebp - 0x1c7], al
mov byte [ebp - 0x1c6], 0x73
mov byte [ebp - 0x1c5], 0x6b
mov byte [ebp - 0x1c4], dl
mov byte [ebp - 0x1c3], 0x6f
mov byte [ebp - 0x1c2], 0x70
mov byte [ebp - 0x1c1], bl
mov byte [ebp - 0x1c0], 0x2e
mov byte [ebp - 0x1bf], 0x73
mov byte [ebp - 0x1be], 0x63
mov byte [ebp - 0x1bd], 0x72
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x133], cl
mov byte [ebp - 0x132], 0x6b
mov byte [ebp - 0x131], al
mov byte [ebp - 0x130], 0x6f
mov byte [ebp - 0x12f], 0x77
mov byte [ebp - 0x12e], 0x6e
mov byte [ebp - 0xd8], 0x55
mov byte [ebp - 0xd7], 0x8b
mov byte [ebp - 0xd6], 0xec
mov byte [ebp - 0xd5], 0x83
mov byte [ebp - 0xd4], 0xc4
mov byte [ebp - 0x268], bl
mov byte [ebp - 0x267], bl
mov byte [ebp - 0x266], bl
mov byte [ebp - 0x265], 0x52
mov byte [ebp - 0x264], bl
mov byte [ebp - 0x263], al
mov byte [ebp - 0x262], bl
mov byte [ebp - 0x261], cl
mov byte [ebp - 0x260], bl
mov byte [ebp - 0x25f], 0x64
mov byte [ebp - 0x25e], bl
mov byte [ebp - 0x25d], 0x4d
mov byte [ebp - 0x25c], bl
mov byte [ebp - 0x25b], al
mov byte [ebp - 0x25a], bl
mov byte [ebp - 0x259], 0x2e
mov byte [ebp - 0x258], bl
mov byte [ebp - 0x257], 0x54
mov byte [ebp - 0x256], bl
mov byte [ebp - 0x255], 0x78
mov byte [ebp - 0x254], bl
mov byte [ebp - 0x253], 0x54
mov byte [ebp - 0xb0], 0xe9
mov byte [ebp - 0xaf], 0x6a
mov byte [ebp - 0xae], 0xe3
mov byte [ebp - 0xad], bl
mov byte [ebp - 0xac], bl
mov byte [ebp - 0xab], 0xe9
mov byte [ebp - 0xaa], 0xa5
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 0x41
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x79
mov byte [ebp - 0x80], 0x91
mov byte [ebp - 0x7f], 0x40
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x7d], 0xf
mov byte [ebp - 0x7c], 0x57
mov byte [ebp - 0x7b], 0xc0
mov byte [ebp - 0x7a], 0x66
mov byte [ebp - 0xa0], 0x8d
mov byte [ebp - 0x9f], 0x45
mov byte [ebp - 0x9e], 0xac
mov byte [ebp - 0x9d], 0x53
mov byte [ebp - 0x9c], 0x50
mov byte [ebp - 0x9b], 0xe8
mov byte [ebp - 0x9a], 0xfe
mov byte [ebp - 0x90], 0xb6
mov byte [ebp - 0x8f], 0xe9
mov byte [ebp - 0x8e], 0x33
mov byte [ebp - 0x8d], 0x34
mov byte [ebp - 0x8c], 0xad
mov byte [ebp - 0x8b], 0x40
mov byte [ebp - 0x8a], 0xb2
mov byte [ebp - 0x114], 0x47
mov byte [ebp - 0x113], bl
mov byte [ebp - 0x112], cl
mov byte [ebp - 0x111], bl
mov byte [ebp - 0x110], 0x6e
mov byte [ebp - 0x10f], bl
mov byte [ebp - 0x10e], 0x64
mov byte [ebp - 0x10d], bl
mov byte [ebp - 0x10c], 0x43
mov byte [ebp - 0x10b], bl
mov byte [ebp - 0x10a], 0x72
mov byte [ebp - 0x109], bl
mov byte [ebp - 0x108], cl
mov byte [ebp - 0x107], bl
mov byte [ebp - 0x106], 0x62
mov byte [ebp - 0x105], bl
mov byte [ebp - 0x104], 0x21
mov byte [ebp - 0x144], 0x47
mov byte [ebp - 0x143], bl
mov byte [ebp - 0x142], 0x41
mov byte [ebp - 0x141], bl
mov byte [ebp - 0x140], 0x4e
mov byte [ebp - 0x13f], bl
mov byte [ebp - 0x13e], 0x44
mov byte [ebp - 0x13d], bl
mov byte [ebp - 0x13c], 0x43
mov byte [ebp - 0x13b], bl
mov byte [ebp - 0x13a], 0x52
mov byte [ebp - 0x139], bl
mov byte [ebp - 0x138], 0x41
mov byte [ebp - 0x137], bl
mov byte [ebp - 0x136], 0x42
mov byte [ebp - 0x68], bl
mov byte [ebp - 0x67], bl
mov byte [ebp - 0x66], 0x10
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], dl
mov byte [ebp - 0x63], 0x4d
mov byte [ebp - 0x62], 0x83
mov byte [ebp - 0x78], 0x55
mov byte [ebp - 0x77], 0x8b
mov byte [ebp - 0x76], 0xec
mov byte [ebp - 0x75], 0x83
mov byte [ebp - 0x74], 0xec
mov byte [ebp - 0x73], 0x30
mov byte [ebp - 0x72], 0xc7
mov byte [ebp - 0x228], 0x73
mov byte [ebp - 0x227], bl
mov byte [ebp - 0x226], 0x68
mov byte [ebp - 0x225], bl
mov byte [ebp - 0x224], 0x75
mov byte [ebp - 0x223], bl
mov byte [ebp - 0x222], dl
mov byte [ebp - 0x221], bl
mov byte [ebp - 0x220], 0x64
mov byte [ebp - 0x21f], bl
mov byte [ebp - 0x21e], 0x6f
mov byte [ebp - 0x21d], bl
mov byte [ebp - 0x21c], 0x77
mov byte [ebp - 0x21b], bl
mov byte [ebp - 0x21a], 0x6e
mov byte [ebp - 0x48], 0x6a
mov byte [ebp - 0x47], 0x10
mov byte [ebp - 0x46], 0x68
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], 0xe8
mov byte [ebp - 0x42], 0x8d
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], 0x8b
mov byte [ebp - 0x3e], 0x7d
mov byte [ebp - 0x3d], 8
mov byte [ebp - 0x3c], 0x85
mov byte [ebp - 0x218], 0x46
mov byte [ebp - 0x217], 0x69
mov byte [ebp - 0x216], 0x6e
mov byte [ebp - 0x215], 0x64
mov byte [ebp - 0x214], 0x46
mov byte [ebp - 0x213], 0x69
mov byte [ebp - 0x212], 0x72
mov byte [ebp - 0x211], 0x73
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x20f], 0x46
mov byte [ebp - 0x20e], 0x69
mov byte [ebp - 0x20d], 0x6c
mov byte [ebp - 0x20c], al
mov byte [ebp - 0x20b], 0x57
mov byte [ebp - 0x208], 0x46
mov byte [ebp - 0x207], 0x69
mov byte [ebp - 0x206], 0x6e
mov byte [ebp - 0x205], 0x64
mov byte [ebp - 0x204], 0x4e
mov byte [ebp - 0x203], al
mov byte [ebp - 0x202], 0x78
mov byte [ebp - 0x201], dl
mov byte [ebp - 0x200], 0x46
mov byte [ebp - 0x1ff], 0x69
mov byte [ebp - 0x1fe], 0x6c
mov byte [ebp - 0x1fd], al
mov byte [ebp - 0x1fc], 0x57
mov byte [ebp - 0x184], 0x57
mov byte [ebp - 0x183], 0x72
mov byte [ebp - 0x182], 0x69
mov byte [ebp - 0x181], dl
mov byte [ebp - 0x180], al
mov byte [ebp - 0x17f], 0x46
mov byte [ebp - 0x17e], 0x69
mov byte [ebp - 0x17d], 0x6c
mov byte [ebp - 0x17c], al
mov byte [ebp - 0x2e0], 0xff
mov byte [ebp - 0x2df], 0x15
mov byte [ebp - 0x2de], 0xec
mov byte [ebp - 0x2dd], 1
mov byte [ebp - 0x2dc], 0x41
mov byte [ebp - 0x2db], bl
mov byte [ebp - 0x2da], 0x85
mov byte [ebp - 0x2d9], 0xc0
mov byte [ebp - 0x2d8], 0xf
mov byte [ebp - 0x2d7], 0x84
mov byte [ebp - 0x2d6], 0x28
mov byte [ebp - 0x2d5], 1
mov byte [ebp - 0x2d4], bl
mov byte [ebp - 0x2d3], bl
mov byte [ebp - 0x2d2], 0xb9
mov byte [ebp - 0x2d1], 0xc
mov byte [ebp - 0x2d0], 0xe
mov byte [ebp - 0x2cf], bl
mov byte [ebp - 0x2ce], bl
mov byte [ebp - 0x2cd], 0xe8
mov byte [ebp - 0x2cc], 0xb5
mov byte [ebp - 0x2cb], 0x36
mov byte [ebp - 0x2ca], bl
mov byte [ebp - 0x2c9], bl
mov byte [ebp - 0x2c8], 0x89
mov byte [ebp - 0x2c7], 0x45
mov byte [ebp - 0x2c6], 0xfc
mov byte [ebp - 0x2c5], 0x83
mov byte [ebp - 0x2c4], 0x7d
mov byte [ebp - 0x2c3], 0xfc
mov byte [ebp - 0x1d4], 0x78
mov byte [ebp - 0x1d3], 0x78
mov byte [ebp - 0x1d2], 0x78
mov byte [ebp - 0x1d1], cl
mov byte [ebp - 0x1d0], 0x72
mov byte [ebp - 0x1cf], dl
mov byte [ebp - 0x1ce], 0x2e
mov byte [ebp - 0x1cd], 0x70
mov byte [ebp - 0x1af], al
mov byte [ebp - 0x1ac], al
mov byte [ebp - 0x237], al
mov byte [ebp - 0x230], al
mov byte [ebp - 0x22c], al
mov byte [ebp - 0x1e4], al
mov eax, dword [esi + 4]
mov byte [ebp - 0x1cc], 0x70
mov byte [ebp - 0x1cb], 0x2e
mov byte [ebp - 0x1ca], 0x75
mov byte [ebp - 0x1c9], cl
mov byte [ebp - 0x1b0], 0x64
mov byte [ebp - 0x1ae], 0x6c
mov byte [ebp - 0x1ad], 0x73
mov byte [ebp - 0x1ab], 0x6c
mov byte [ebp - 0x1aa], 0x66
mov byte [ebp - 0x1a9], 0x2e
mov byte [ebp - 0x1a8], 0x62
mov byte [ebp - 0x1a7], cl
mov byte [ebp - 0x1a6], dl
mov byte [ebp - 0x1a4], 0x43
mov byte [ebp - 0x1a3], 0x52
mov byte [ebp - 0x1a2], 0x59
mov byte [ebp - 0x1a1], 0x50
mov byte [ebp - 0x1a0], 0x54
mov byte [ebp - 0x19f], 0x4f
mov byte [ebp - 0x19e], 0x47
mov byte [ebp - 0x19d], 0x41
mov byte [ebp - 0x19c], 0x4d
mov byte [ebp - 0x19b], 0x53
mov byte [ebp - 0x19a], 0x20
mov byte [ebp - 0x1bc], 0x44
mov byte [ebp - 0x1bb], 0x45
mov byte [ebp - 0x1ba], 0x41
mov byte [ebp - 0x1b9], 0x54
mov byte [ebp - 0x1b8], 0x48
mov byte [ebp - 0x1b7], 0x52
mov byte [ebp - 0x1b6], cl
mov byte [ebp - 0x1b5], 0x6e
mov byte [ebp - 0x1b4], 0x73
mov byte [ebp - 0x1b3], 0x6f
mov byte [ebp - 0x1b2], 0x6d
mov byte [ebp - 0x23c], 0x44
mov byte [ebp - 0x23b], 0x6f
mov byte [ebp - 0x23a], 0x63
mov byte [ebp - 0x239], 0x75
mov byte [ebp - 0x238], 0x6d
mov byte [ebp - 0x236], 0x6e
mov byte [ebp - 0x235], dl
mov byte [ebp - 0x234], 0x50
mov byte [ebp - 0x233], 0x72
mov byte [ebp - 0x232], 0x6f
mov byte [ebp - 0x231], 0x70
mov byte [ebp - 0x22f], 0x72
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], 0x69
mov byte [ebp - 0x22b], 0x73
mov byte [ebp - 0x12c], dl
mov byte [ebp - 0x12b], 0x72
mov byte [ebp - 0x12a], 0x75
mov byte [ebp - 0x129], 0x73
mov byte [ebp - 0x128], cl
mov byte [ebp - 0x127], 0x6a
mov byte [ebp - 0x126], 0x7c
mov byte [ebp - 0x1ec], 0x46
mov byte [ebp - 0x1eb], 0x79
mov byte [ebp - 0x1ea], 0x6c
mov byte [ebp - 0x1e9], 0x75
mov byte [ebp - 0x1e8], 0x5c
mov byte [ebp - 0x1e7], 0x6c
mov byte [ebp - 0x1e6], 0x7a
mov byte [ebp - 0x1e5], cl
mov byte [ebp - 0x1e3], cl
mov byte [ebp - 0x1e2], bl
mov byte [ebp - 0x1e1], bl
cmp eax, ebx
je 0x41dafd
cmp eax, 4
je 0x41dafd
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x470164], ebx
mov ecx, dword [esi]
push ecx
push ebx
mov edi, eax
push 0x1fffff
mov dword [ebp - 0x100b8], edi
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x100bc], eax
cmp edi, ebx
je 0x41b1cf
cmp eax, ebx
je 0x41daf6
mov edx, eax
push edx
call fcn.00407740
push 0x1c
lea ecx, [ebp - 0x100dc]
push ecx
push eax
mov dword [ebp - 0x100c4], ebx
push edi
mov dword [ebp - 0x100c0], eax
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x100dc], ebx
mov dword [ebp - 0x100d8], ebx
mov dword [ebp - 0x100d4], ebx
mov dword [ebp - 0x100d0], ebx
mov dword [ebp - 0x100cc], ebx
mov dword [ebp - 0x100c8], ebx
mov dword [ebp - 0x100c4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x100c4], 0x20000
jne 0x411ae8
cmp dword [ebp - 0x100d0], 0x30000
jb 0x411ae8
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x411ae8
cmp dword [ebp - 0x100d4], eax
jne 0x411ae8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 6
lea edx, [ebp - 0x434]
push str.CLASS
push edx
call fcn.0043016e
add esp, 0x20
test eax, eax
jne 0x411ae8
mov eax, dword [ebp - 0x100bc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
jmp 0x41dafd
cmp dword [ebp - 0x100d0], 0xe8000
jne 0x411f41
cmp dword [ebp - 0x100c8], 0x40
jne 0x412c61
cmp dword [ebp - 0x100d4], 0x80
jne 0x412c61
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x411f41
push str.0XE8000
call fcn.004073f0
mov eax, dword [ebp - 0x100c0]
add esp, 4
lea ecx, [ebp - 0x100b4]
push ecx
push 8
lea edx, [ebp - 0x49c]
push edx
push eax
push edi
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [ebp - 0xb0]
jne 0x411f41
mov eax, dword [ebp - 0x498]
cmp byte [ebp - 0xac], al
jne 0x411f41
cmp byte [ebp - 0xab], ah
jne 0x411f41
mov dl, byte [ebp - 0xaa]
cmp dl, byte [ebp - 0x496]
jne 0x411f41
mov edx, dword [ebp - 0x100c0]
lea eax, [ebp - 0x100b4]
push eax
push 0xf
lea ecx, [ebp - 0x514]
push ecx
add edx, 0xbcd9
push edx
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov dword [ebp - 0x50c], ebx
mov word [ebp - 0x508], bx
mov byte [ebp - 0x506], bl
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0xf
jne 0x411f41
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xf
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x514]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x411f41
push str.match_8_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9cb]
push ebx
push edx
mov byte [ebp - 0x9cc], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x9cc]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4RAPID.NPAV4.23012018
push str.NPAV4RAPID.NPAV4.23012018
lea edx, [ebp - 0x9cc]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x620f]
push ebx
push eax
mov byte [ebp - 0x6210], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6210]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x6210]
push str.WORM.RAPID.NPAV4.23012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4ce3]
push ebx
push edx
mov byte [ebp - 0x4ce4], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x169b]
push ebx
push eax
mov byte [ebp - 0x169c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x411de5
lea edx, [ebp - 0x169c]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x411d70
lea edx, [ebp - 0x169c]
push edx
lea eax, [ebp - 0x4ce4]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x4ce4]
push ecx
lea edx, [ebp - 0x169c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x411de5
lea eax, [ebp - 0x4ce4]
push eax
lea ecx, [ebp - 0x169c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x411dd8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x411de5
lea edx, [ebp - 0x169c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x411e7e
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6210]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x411e18
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x100b8]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x411efc
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x411ec0
cmp dword [0x470144], ebx
je 0x411ef0
lea edx, [ebp - 0x101e4]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x100d0], 0x13000
jne 0x4123a1
cmp dword [ebp - 0x100c8], 0x40
jne 0x412c61
cmp dword [ebp - 0x100d4], 0x80
jne 0x412c61
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x4123a1
push str.0X13000
call fcn.004073f0
mov edx, dword [ebp - 0x100c0]
add esp, 4
lea eax, [ebp - 0x100b4]
push eax
push 8
lea ecx, [ebp - 0x4b8]
push ecx
push edx
push edi
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x80]
jne 0x4123a1
mov eax, dword [ebp - 0x4b4]
cmp byte [ebp - 0x7c], al
jne 0x4123a1
cmp byte [ebp - 0x7b], ah
jne 0x4123a1
mov cl, byte [ebp - 0x7a]
cmp cl, byte [ebp - 0x4b2]
jne 0x4123a1
mov ecx, dword [ebp - 0x100c0]
lea edx, [ebp - 0x100b4]
push edx
push 0x16
lea eax, [ebp - 0x544]
push eax
add ecx, 0xb048
push ecx
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x53c], ebx
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], ebx
mov word [ebp - 0x530], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x16
jne 0x4123a1
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x544]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4123a1
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 2
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8fb]
push ebx
push edx
mov byte [ebp - 0x8fc], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8fc]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4GDCB.NPAV4.30012018.1
push str.NPAV4GDCB.NPAV4.30012018.1
lea edx, [ebp - 0x8fc]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x723b]
push ebx
push eax
mov byte [ebp - 0x723c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x723c]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x723c]
push str.WORM.GDCB.NPAV4.30012018.1
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4de3]
push ebx
push edx
mov byte [ebp - 0x4de4], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x2d9b]
push ebx
push eax
mov byte [ebp - 0x2d9c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x41224c
lea edx, [ebp - 0x2d9c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4121b7
lea edx, [ebp - 0x2d9c]
push edx
lea eax, [ebp - 0x4de4]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x4de4]
push ecx
lea edx, [ebp - 0x2d9c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41224c
lea eax, [ebp - 0x4de4]
push eax
lea ecx, [ebp - 0x2d9c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41223f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41224c
lea edx, [ebp - 0x2d9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4122db
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x723c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412280
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412350
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412320
cmp dword [0x470144], ebx
je 0x412350
lea edx, [ebp - 0x101b4]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x12000
jne 0x412801
cmp dword [ebp - 0x100c8], 0x40
jne 0x412c61
cmp dword [ebp - 0x100d4], 0x80
jne 0x412c61
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x412801
push str.0X12000
call fcn.004073f0
mov edx, dword [ebp - 0x100c0]
add esp, 4
lea eax, [ebp - 0x100b4]
push eax
push 8
lea ecx, [ebp - 0x48c]
push ecx
push edx
push edi
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0xa0]
jne 0x412801
mov eax, dword [ebp - 0x488]
cmp byte [ebp - 0x9c], al
jne 0x412801
cmp byte [ebp - 0x9b], ah
jne 0x412801
mov cl, byte [ebp - 0x9a]
cmp cl, byte [ebp - 0x486]
jne 0x412801
mov ecx, dword [ebp - 0x100c0]
lea edx, [ebp - 0x100b4]
push edx
push 0x16
lea eax, [ebp - 0x52c]
push eax
add ecx, 0x9d45
push ecx
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov word [ebp - 0x518], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x16
jne 0x412801
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x52c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412801
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 4
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8c7]
push ebx
push edx
mov byte [ebp - 0x8c8], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8c8]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4GDCB.NPAV4.30012018.2
push str.NPAV4GDCB.NPAV4.30012018.2
lea edx, [ebp - 0x8c8]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x6417]
push ebx
push eax
mov byte [ebp - 0x6418], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6418]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x6418]
push str.WORM.GDCB.NPAV4.30012018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x6823]
push ebx
push edx
mov byte [ebp - 0x6824], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x199b]
push ebx
push eax
mov byte [ebp - 0x199c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x4126ac
lea edx, [ebp - 0x199c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412623
lea edx, [ebp - 0x199c]
push edx
lea eax, [ebp - 0x6824]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x6824]
push ecx
lea edx, [ebp - 0x199c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4126ac
lea eax, [ebp - 0x6824]
push eax
lea ecx, [ebp - 0x199c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41269f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4126ac
lea edx, [ebp - 0x199c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41273b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6418]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4126e0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4127b0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412780
cmp dword [0x470144], ebx
je 0x4127b0
lea edx, [ebp - 0x10178]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x14000
jne 0x412c61
cmp dword [ebp - 0x100c8], 0x40
jne 0x412c61
cmp dword [ebp - 0x100d4], 0x80
jne 0x412c61
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x412c61
push str.0X14000
call fcn.004073f0
mov edx, dword [ebp - 0x100c0]
add esp, 4
lea eax, [ebp - 0x100b4]
push eax
push 8
lea ecx, [ebp - 0x4c0]
push ecx
push edx
push edi
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c0]
cmp eax, dword [ebp - 0x90]
jne 0x412c61
mov eax, dword [ebp - 0x4bc]
cmp byte [ebp - 0x8c], al
jne 0x412c61
cmp byte [ebp - 0x8b], ah
jne 0x412c61
mov cl, byte [ebp - 0x8a]
cmp cl, byte [ebp - 0x4ba]
jne 0x412c61
mov ecx, dword [ebp - 0x100c0]
lea edx, [ebp - 0x100b4]
push edx
push 0x16
lea eax, [ebp - 0x55c]
push eax
add ecx, 0xc1ee
push ecx
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x558], ebx
mov dword [ebp - 0x554], ebx
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x54c], ebx
mov word [ebp - 0x548], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x16
jne 0x412c61
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x55c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412c61
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 6
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb9f]
push ebx
push edx
mov byte [ebp - 0xba0], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xba0]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4GDCB.NPAV4.30012018.3
push str.NPAV4GDCB.NPAV4.30012018.3
lea edx, [ebp - 0xba0]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7a53]
push ebx
push eax
mov byte [ebp - 0x7a54], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7a54]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x7a54]
push str.WORM.GDCB.NPAV4.30012018.3
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4fe7]
push ebx
push edx
mov byte [ebp - 0x4fe8], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x259b]
push ebx
push eax
mov byte [ebp - 0x259c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x412b0c
lea edx, [ebp - 0x259c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412a83
lea edx, [ebp - 0x259c]
push edx
lea eax, [ebp - 0x4fe8]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x4fe8]
push ecx
lea edx, [ebp - 0x259c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412b0c
lea eax, [ebp - 0x4fe8]
push eax
lea ecx, [ebp - 0x259c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x412aff
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412b0c
lea edx, [ebp - 0x259c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x412b9b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7a54]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412b40
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412c10
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412be0
cmp dword [0x470144], ebx
je 0x412c10
lea edx, [ebp - 0x101d0]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100c4], 0x20000
jne 0x413421
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x413421
cmp dword [ebp - 0x100d4], eax
jne 0x413421
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0xab4c]
push ebx
push eax
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0x14
lea ecx, [ebp - 0x100b4]
push ecx
push 0x500
lea edx, [ebp - 0xab4c]
push edx
add eax, 0xa760
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x500
jne 0x413041
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xab4c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413041
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 8
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x92f]
push ebx
push edx
mov byte [ebp - 0x930], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x930]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4GRAB.NPAV4.0803018.4
push str.NPAV4GRAB.NPAV4.0803018.4
lea edx, [ebp - 0x930]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x661f]
push ebx
push eax
mov byte [ebp - 0x6620], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6620]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x6620]
push str.WORM.GRAB.NPAV4.0803018.4
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x7e5b]
push ebx
push edx
mov byte [ebp - 0x7e5c], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x1b9b]
push ebx
push eax
mov byte [ebp - 0x1b9c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x412eec
lea edx, [ebp - 0x1b9c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412e63
lea edx, [ebp - 0x1b9c]
push edx
lea eax, [ebp - 0x7e5c]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x7e5c]
push ecx
lea edx, [ebp - 0x1b9c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412eec
lea eax, [ebp - 0x7e5c]
push eax
lea ecx, [ebp - 0x1b9c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x412edf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412eec
lea edx, [ebp - 0x1b9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x412f7a
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6620]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412f20
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412ff0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412fc0
cmp dword [0x470144], ebx
je 0x412ff0
lea edx, [ebp - 0x10188]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100c4], 0x20000
jne 0x413421
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x413421
cmp dword [ebp - 0x100d4], eax
jne 0x413421
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x9f4c]
push ebx
push eax
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0x14
lea ecx, [ebp - 0x100b4]
push ecx
push 0x500
lea edx, [ebp - 0x9f4c]
push edx
add eax, 0xae30
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x500
jne 0x413421
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x9f4c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413421
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0xa
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x7c3]
push ebx
push edx
mov byte [ebp - 0x7c4], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7c4]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4GRAB.NPAV4.16052018.5
push str.NPAV4GRAB.NPAV4.16052018.5
lea edx, [ebp - 0x7c4]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x4be3]
push ebx
push eax
mov byte [ebp - 0x4be4], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4be4]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x4be4]
push str.WORM.GRAB.NPAV4.16052018.5
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x51eb]
push ebx
push edx
mov byte [ebp - 0x51ec], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x2b9b]
push ebx
push eax
mov byte [ebp - 0x2b9c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x4132cc
lea edx, [ebp - 0x2b9c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413243
lea edx, [ebp - 0x2b9c]
push edx
lea eax, [ebp - 0x51ec]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x51ec]
push ecx
lea edx, [ebp - 0x2b9c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4132cc
lea eax, [ebp - 0x51ec]
push eax
lea ecx, [ebp - 0x2b9c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4132bf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4132cc
lea edx, [ebp - 0x2b9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41335b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x4be4]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413300
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4133d0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4133a0
cmp dword [0x470144], ebx
je 0x4133d0
lea edx, [ebp - 0x101e0]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x16000
jne 0x413893
push str.mbi_._RegionSize__0X16000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x413893
cmp dword [ebp - 0x100d4], 0x80
jne 0x413893
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x413893
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X16000
call fcn.004073f0
mov edx, dword [ebp - 0x100c0]
add esp, 8
lea eax, [ebp - 0x100b4]
push eax
push 8
lea ecx, [ebp - 0x4c8]
push ecx
push edx
push edi
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4c4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x68]
jne 0x413893
mov eax, dword [ebp - 0x4c4]
cmp byte [ebp - 0x64], al
jne 0x413893
cmp byte [ebp - 0x63], ah
jne 0x413893
mov cl, byte [ebp - 0x62]
cmp cl, byte [ebp - 0x4c2]
jne 0x413893
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea edx, [ebp - 0xf80]
push ebx
push edx
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov edx, dword [ebp - 0x100c0]
add esp, 0x10
lea eax, [ebp - 0x100b4]
push eax
push 0x50
lea ecx, [ebp - 0xf80]
push ecx
add edx, 0x10bc0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x50
jne 0x413893
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0xf80]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413893
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0xc
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xd0b]
push ebx
push eax
mov byte [ebp - 0xd0c], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xd0c]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4KRAB.NPAV4.05072018.1
push str.NPAV4KRAB.NPAV4.05072018.1
lea eax, [ebp - 0xd0c]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x54
push 0x103
lea ecx, [ebp - 0x4adf]
push ebx
push ecx
mov byte [ebp - 0x4ae0], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4ae0]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x4ae0]
push str.WORM.KRAB.NPAV4.05072018.1
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x6a27]
push ebx
push eax
mov byte [ebp - 0x6a28], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x1d9b]
push ebx
push ecx
mov byte [ebp - 0x1d9c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x413739
lea edx, [ebp - 0x1d9c]
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4136b0
lea eax, [ebp - 0x1d9c]
push eax
lea ecx, [ebp - 0x6a28]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x6a28]
push edx
lea eax, [ebp - 0x1d9c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413739
lea ecx, [ebp - 0x6a28]
push ecx
lea edx, [ebp - 0x1d9c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41372c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413739
lea eax, [ebp - 0x1d9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4137cd
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x4ae0]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413770
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x413842
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413812
cmp dword [0x470144], ebx
je 0x413842
lea eax, [ebp - 0x10190]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x20000
jne 0x413ce1
push str.mbi_._RegionSize__0X20000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x413ce1
cmp dword [ebp - 0x100d4], 0x80
jne 0x413ce1
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x413ce1
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X20000
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xf30]
push ebx
push ecx
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100c0]
add esp, 0x18
lea edx, [ebp - 0x100b4]
push edx
push 0x50
lea eax, [ebp - 0xf30]
push eax
add ecx, 0x11b9d
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x50
jne 0x413ce1
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0xf30]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413ce1
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 0xe
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x6f3]
push ebx
push edx
mov byte [ebp - 0x6f4], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6f4]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4KRAB.NPAV4.10082018.2
push str.NPAV4KRAB.NPAV4.10082018.2
lea edx, [ebp - 0x6f4]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x54
push 0x103
lea eax, [ebp - 0x45d3]
push ebx
push eax
mov byte [ebp - 0x45d4], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x45d4]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x45d4]
push str.WORM.KRAB.NPAV4.10082018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x35a7]
push ebx
push edx
mov byte [ebp - 0x35a8], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x279b]
push ebx
push eax
mov byte [ebp - 0x279c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x413b49
lea edx, [ebp - 0x279c]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413ac0
lea edx, [ebp - 0x279c]
push edx
lea eax, [ebp - 0x35a8]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x35a8]
push ecx
lea edx, [ebp - 0x279c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413b49
lea eax, [ebp - 0x35a8]
push eax
lea ecx, [ebp - 0x279c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x413b3c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413b49
lea edx, [ebp - 0x279c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x413bdb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x45d4]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413b80
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x413c0f
push str.WORM.KRAB.NPAV4.10082018.2
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x35a8]
push edx
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x45d4]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x413c90
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x413c60
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413c60
cmp dword [0x470144], ebx
je 0x413c90
lea eax, [ebp - 0x101c0]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
mov ecx, dword [ebp - 0x100d0]
add ecx, 0xfffe5000
cmp ecx, 0xe000
ja 0x41413a
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x41413a
cmp dword [ebp - 0x100d4], 0x80
jne 0x41413a
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41413a
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
add esp, 8
lea edx, [ebp - 0x100b4]
push edx
push 0x20
lea eax, [ebp - 0x5bc]
push eax
push 0x4030df
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x5bc], ebx
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 0x5b4], ebx
mov dword [ebp - 0x5b0], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x20
jne 0x41413a
push str.read_successful_and_act_bytes_dwActualReadBytes__32
call fcn.004073f0
push 0x1e
push 0x20
lea ecx, [ebp - 0x2e0]
push ecx
lea edx, [ebp - 0x5bc]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41413a
push str.match_30_bytes
call fcn.004073f0
push str.match_KRAB_G_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 8
push eax
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x78f]
push ebx
push edx
mov byte [ebp - 0x790], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x790]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4KRAB.NPAV4.28082018.V3G
push str.NPAV4KRAB.NPAV4.28082018.V3G
lea edx, [ebp - 0x790]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x3dbb]
push ebx
push eax
mov byte [ebp - 0x3dbc], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x3dbc]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x3dbc]
push str.WORM.KRAB.NPAV4.28082018.V3G
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x3fbf]
push ebx
push edx
mov byte [ebp - 0x3fc0], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x1f9b]
push ebx
push eax
mov byte [ebp - 0x1f9c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x413fbc
lea edx, [ebp - 0x1f9c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413f33
lea edx, [ebp - 0x1f9c]
push edx
lea eax, [ebp - 0x3fc0]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x3fc0]
push ecx
lea edx, [ebp - 0x1f9c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413fbc
lea eax, [ebp - 0x3fc0]
push eax
lea ecx, [ebp - 0x1f9c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x413faf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413fbc
lea edx, [ebp - 0x1f9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414049
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x3dbc]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413ff0
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41407d
push str.WORM.KRAB.NPAV4.28082018.V3G
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x3fc0]
push edx
lea ecx, [ebp - 0x790]
push ecx
lea edx, [ebp - 0x3dbc]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x4140f8
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4140d0
cmp dword [0x470144], ebx
je 0x4140f8
lea eax, [ebp - 0x101ec]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x414127
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x29000
jne 0x414701
push str.mbi_._RegionSize__0X29000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x414701
cmp dword [ebp - 0x100d4], 0x80
jne 0x414701
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x414701
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X29000
call fcn.004073f0
mov eax, dword [ebp - 0x100c0]
add esp, 8
lea ecx, [ebp - 0x100b4]
push ecx
push 0x14
lea edx, [ebp - 0x4b0]
push edx
push eax
push edi
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x4a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b0]
cmp byte [ebp - 0x48], al
jne 0x414701
cmp byte [ebp - 0x47], ah
jne 0x414701
mov cl, byte [ebp - 0x46]
cmp cl, byte [ebp - 0x4ae]
jne 0x414701
push str.match_FIRST_Princes1_sig
call fcn.004073f0
mov dl, byte [ebp - 0x45]
add esp, 4
cmp dl, byte [ebp - 0x4ab]
jne 0x414701
mov al, byte [ebp - 0x44]
cmp al, byte [ebp - 0x4aa]
jne 0x414701
mov cl, byte [ebp - 0x43]
cmp cl, byte [ebp - 0x4a9]
jne 0x414701
push str.match_SECOND_Princes1_sig
call fcn.004073f0
mov edx, dword [ebp - 0x4a7]
add esp, 4
cmp edx, dword [ebp - 0x42]
jne 0x414701
mov al, byte [ebp - 0x3e]
cmp al, byte [ebp - 0x4a3]
jne 0x414701
mov cl, byte [ebp - 0x3d]
cmp cl, byte [ebp - 0x4a2]
jne 0x414701
mov dl, byte [ebp - 0x3c]
cmp dl, byte [ebp - 0x4a1]
jne 0x414701
push str.match_THIRD_Princes1_sig
call fcn.004073f0
push 0xd60
lea eax, [ebp - 0xe0ac]
push ebx
push eax
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0x10
lea ecx, [ebp - 0x100b4]
push ecx
push 0xd60
lea edx, [ebp - 0xe0ac]
push edx
add eax, 0x1e4c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0xd60
jne 0x414701
push str.read_successful_and_act_bytes_dwActualReadBytes__0XD60
call fcn.004073f0
push 0xe
push 0xd60
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0xe0ac]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x414701
push str.match_14_bytes
call fcn.004073f0
push str.match_Princes_Find1stFileW_sig
call fcn.004073f0
push 0xd
push 0xd60
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xe0a0]
push ecx
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x414701
push str.match_13_bytes
call fcn.004073f0
push str.match_Princes_Find2ndFileW_sig
call fcn.004073f0
push 9
push 0xd60
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0xe0a0]
push eax
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x414701
push str.match_9_bytes
call fcn.004073f0
push str.match_Princes_WriteFile_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 8
push ecx
mov dword [ebp - 4], 0x12
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x5ef]
push ebx
push eax
mov byte [ebp - 0x5f0], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x5f0]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4PRINCE.NPAV4.20082018
push str.NPAV4PRINCE.NPAV4.20082018
lea eax, [ebp - 0x5f0]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x33a3]
push ebx
push ecx
mov byte [ebp - 0x33a4], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x33a4]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x33a4]
push str.WORM.PRINCE.NPAV4.20082018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x53ef]
push ebx
push eax
mov byte [ebp - 0x53f0], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x2f9b]
push ebx
push ecx
mov byte [ebp - 0x2f9c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x414569
lea edx, [ebp - 0x2f9c]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4144e0
lea eax, [ebp - 0x2f9c]
push eax
lea ecx, [ebp - 0x53f0]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x53f0]
push edx
lea eax, [ebp - 0x2f9c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414569
lea ecx, [ebp - 0x53f0]
push ecx
lea edx, [ebp - 0x2f9c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41455c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414569
lea eax, [ebp - 0x2f9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4145fd
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x33a4]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4145a0
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41462f
push str.WORM.PRINCE.NPAV4.20082018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x5f0]
push ecx
lea edx, [ebp - 0x33a4]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x4146b0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x414680
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414680
cmp dword [0x470144], ebx
je 0x4146b0
lea eax, [ebp - 0x101e8]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100c4], 0x20000
jne 0x414af3
cmp dword [ebp - 0x100c8], 0x40
jne 0x414af3
cmp dword [ebp - 0x100d4], 0x40
jne 0x414af3
push str.REW_and_REW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x12000
jb 0x414af3
push str.0X12000
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xfd0]
push ebx
push ecx
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100c0]
add esp, 0x10
lea edx, [ebp - 0x100b4]
push edx
push 0x50
lea eax, [ebp - 0xfd0]
push eax
add ecx, 0x2350
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x50
jne 0x414af3
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0xfd0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x414af3
push str.match_15_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x14
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x997]
push ebx
push eax
mov byte [ebp - 0x998], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x998]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYPTON.NPAV4.21052018
push str.NPAV4CRYPTON.NPAV4.21052018
lea eax, [ebp - 0x998]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x58
push 0x103
lea ecx, [ebp - 0x4ee7]
push ebx
push ecx
mov byte [ebp - 0x4ee8], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4ee8]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x4ee8]
push str.WORM.CRYPTON.NPAV4.21052018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x7647]
push ebx
push eax
mov byte [ebp - 0x7648], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x219b]
push ebx
push ecx
mov byte [ebp - 0x219c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x414991
lea edx, [ebp - 0x219c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414908
lea eax, [ebp - 0x219c]
push eax
lea ecx, [ebp - 0x7648]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x7648]
push edx
lea eax, [ebp - 0x219c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414991
lea ecx, [ebp - 0x7648]
push ecx
lea edx, [ebp - 0x219c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x414984
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414991
lea eax, [ebp - 0x219c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x434]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
cmp dword [0x46f734], ebx
je 0x414a30
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x4ee8]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4149d8
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414aa2
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
push 0x104
push ebx
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414a72
cmp dword [0x470144], ebx
je 0x414aa2
lea ecx, [ebp - 0x10170]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x2000
jne 0x414f51
cmp dword [ebp - 0x100c8], 0x20
jne 0x41539d
cmp dword [ebp - 0x100d4], 0x80
jne 0x4153a6
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x414f51
push str.0X2000
call fcn.004073f0
mov ecx, dword [ebp - 0x100c0]
add esp, 4
lea edx, [ebp - 0x100b4]
push edx
push 6
lea eax, [ebp - 0x454]
push eax
push ecx
push edi
mov dword [ebp - 0x454], ebx
mov word [ebp - 0x450], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x454]
cmp edx, dword [ebp - 0xd8]
jne 0x414f51
mov al, byte [ebp - 0xd4]
cmp al, byte [ebp - 0x450]
jne 0x414f51
lea ecx, [ebp - 0x100b4]
push ecx
push 0x1e
lea edx, [ebp - 0x59c]
push edx
push 0x40cec0
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x59c], ebx
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x594], ebx
mov dword [ebp - 0x590], ebx
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x584], ebx
mov word [ebp - 0x580], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x1e
jne 0x414f51
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x16
push 0x1e
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x59c]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x414f51
push str.match_22_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x16
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xbd3]
push ebx
push edx
mov byte [ebp - 0xbd4], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xbd4]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4LOCK.NPAV4.16012018
push str.NPAV4LOCK.NPAV4.16012018
lea edx, [ebp - 0xbd4]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x50eb]
push ebx
push eax
mov byte [ebp - 0x50ec], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x50ec]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x50ec]
push str.WORM.LOCK.NPAV4.16012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x55f3]
push ebx
push edx
mov byte [ebp - 0x55f4], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x299b]
push ebx
push eax
mov byte [ebp - 0x299c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x414df9
lea edx, [ebp - 0x299c]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414d70
lea edx, [ebp - 0x299c]
push edx
lea eax, [ebp - 0x55f4]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x55f4]
push ecx
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414df9
lea eax, [ebp - 0x55f4]
push eax
lea ecx, [ebp - 0x299c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x414dec
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414df9
lea edx, [ebp - 0x299c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414e89
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x50ec]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414e30
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414f00
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414ed0
cmp dword [0x470144], ebx
je 0x414f00
lea edx, [ebp - 0x10168]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100d0], 0x3000
jne 0x41539d
cmp dword [ebp - 0x100c8], 0x20
jne 0x41539d
cmp dword [ebp - 0x100d4], 0x80
jne 0x4153a6
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41539d
push str.0X3000
call fcn.004073f0
mov edx, dword [ebp - 0x100c0]
add esp, 4
lea eax, [ebp - 0x100b4]
push eax
push 8
lea ecx, [ebp - 0x494]
push ecx
push edx
push edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x78]
jne 0x41539d
mov eax, dword [ebp - 0x490]
cmp byte [ebp - 0x74], al
jne 0x41539d
cmp byte [ebp - 0x73], ah
jne 0x41539d
mov cl, byte [ebp - 0x72]
cmp cl, byte [ebp - 0x48e]
jne 0x41539d
lea edx, [ebp - 0x100b4]
push edx
push 0xa
lea eax, [ebp - 0x4ec]
push eax
push 0x40d615
push edi
mov dword [ebp - 0x100b4], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov word [ebp - 0x4e4], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0xa
jne 0x41539d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xa
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x4ec]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41539d
push str.match_8_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x18
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9ff]
push ebx
push edx
mov byte [ebp - 0xa00], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa00]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4JAVA.NPAV4.08022018
push str.NPAV4JAVA.NPAV4.08022018
lea edx, [ebp - 0xa00]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x52ef]
push ebx
push eax
mov byte [ebp - 0x52f0], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x52f0]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x52f0]
push str.WORM.JAVA.NPAV4.08022018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x49db]
push ebx
push edx
mov byte [ebp - 0x49dc], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x149b]
push ebx
push eax
mov byte [ebp - 0x149c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x41523d
lea edx, [ebp - 0x149c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4151b4
lea edx, [ebp - 0x149c]
push edx
lea eax, [ebp - 0x49dc]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x49dc]
push ecx
lea edx, [ebp - 0x149c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41523d
lea eax, [ebp - 0x49dc]
push eax
lea ecx, [ebp - 0x149c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x415230
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41523d
lea edx, [ebp - 0x149c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4152c9
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x52f0]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x415270
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x415340
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x415310
cmp dword [0x470144], ebx
je 0x415340
lea edx, [ebp - 0x10164]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040eb30
push str.UmRdpService
call fcn.0040e8e0
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
cmp dword [ebp - 0x100c8], 0x40
je 0x4153c0
cmp dword [ebp - 0x100d4], 0x40
jne 0x41575a
cmp byte [0x46fec4], 1
je 0x41575a
mov ecx, dword [esi + 4]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x41575a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415402
sub eax, edx
je 0x41575a
lea edx, [ebp - 0x434]
push str.svchost.exe
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41575a
push 0x104
push ebx
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415452
sub eax, edx
je 0x41575a
push 0x12c
push ebx
push 0x46fba8
call fcn.0042e2e0
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4154b2
sub eax, edx
je 0x41575a
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41575a
push str.CryptoDefense:_Suspended_svchost.exe_Process
mov dword [0x470164], 1
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
call fcn.00408550
mov eax, dword [0x46ff94]
mov edx, dword [esi + 4]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45ca48
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [ebp - 0x34a8]
push ebx
push eax
call fcn.0042e2e0
add esp, 0x48
push 0x104
lea ecx, [ebp - 0x34a8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x34a8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415590
sub eax, edx
je 0x4155cd
lea eax, [ebp - 0x34a8]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4155a2
mov edx, dword [str._svchost.exe]
mov ecx, dword [0x45d900]
mov dword [eax], edx
mov edx, dword [0x45d904]
mov dword [eax + 4], ecx
mov cl, byte [0x45d908]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [ebp - 0x34a8]
push str.WORM.CRYPTO.05052014
push edx
call fcn.0040a000
add esp, 8
cmp dword [0x46f734], ebx
je 0x4156a1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x34a8]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415602
mov ecx, dword [0x45d8e8]
mov eax, dword [str.WORM.CRYPTO.05052014]
mov edx, dword [0x45d8ec]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d8f4]
mov dword [0x46a03e], eax
mov eax, dword [0x45d8f0]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a046], edx
mov dl, byte [0x45d8f8]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x100b8]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x41575a
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, dword [0x45d8ec]
mov edx, dword [str.WORM.CRYPTO.05052014]
mov eax, dword [0x45d8e8]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d8f0]
mov dword [0x46f73c], eax
mov eax, dword [0x45d8f4]
mov dword [0x46f740], ecx
mov cl, byte [0x45d8f8]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov byte [0x46f74c], cl
call fcn.0042e2e0
mov edx, dword [str.svchost.exe]
mov eax, dword [0x45d9a8]
mov ecx, dword [0x45d9ac]
add esp, 0x18
mov dword [0x46f978], edx
mov dword [0x46f97c], eax
mov dword [0x46f980], ecx
call fcn.00407a90
cmp dword [0x470144], ebx
je 0x41575a
lea edx, [ebp - 0x101a4]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x100c4], 0x40000
jne 0x415877
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x415783
cmp dword [ebp - 0x100d4], eax
jne 0x415a93
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x3000
jne 0x415877
push str.0x3000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x9658]
push ebx
push eax
mov dword [ebp - 0x10124], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0x10
lea ecx, [ebp - 0x10124]
push ecx
push 0x500
lea edx, [ebp - 0x9658]
push edx
add eax, 0x2100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x9658]
test ecx, ecx
je 0x415877
cmp dword [ebp - 0x10124], 0x500
jne 0x415877
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x9658]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415877
push 0x11
push 0x500
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x9658]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x415877
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [ebp - 0x100c4], 0x20000
jne 0x415a93
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x4158a0
cmp dword [ebp - 0x100d4], eax
jne 0x415a93
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x3000
jne 0x415a93
push str.0x3000
call fcn.004073f0
push 0x700
lea ecx, [ebp - 0xa64c]
push ebx
push ecx
mov dword [ebp - 0x10114], ebx
call fcn.0042e2e0
mov edx, dword [ebp - 0x100d0]
mov eax, dword [ebp - 0x100c0]
add esp, 0x10
lea ecx, [ebp - 0x10114]
push ecx
lea eax, [edx + eax - 0x700]
push 0x700
lea edx, [ebp - 0xa64c]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xa64c]
test eax, eax
je 0x415a93
cmp dword [ebp - 0x10114], 0x700
jne 0x415a93
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x700
lea ecx, [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0xa64c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415a93
push str.Sig_found_for_Ramnit_and_terminated_
call fcn.004073f0
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x100bc]
inc dword [0x470308]
add esp, 0x18
push ecx
mov dword [0x470304], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415a93
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415a93
cmp dword [0x470308], 2
jg 0x415bf3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x4159f0
mov edx, dword [str.Win32.Ramnit.13102015]
mov eax, dword [0x45d868]
mov ecx, dword [0x45d86c]
mov dword [0x46a03e], edx
mov edx, dword [0x45d870]
mov dword [0x46a042], eax
mov eax, dword [0x45d874]
mov dword [0x46a046], ecx
mov cx, word [0x45d878]
mov dword [0x46a04a], edx
mov edx, dword [str.NPAV4]
mov dword [0x46a04e], eax
mov ax, word [0x45d860]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov word [0x46a0a7], ax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x100b8]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470308], 2
jne 0x415bf3
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41650c
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x415ac9
cmp dword [ebp - 0x100d4], eax
jne 0x415c03
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x2000
jne 0x415bf3
mov ecx, dword [esi + 4]
cmp ecx, dword [0x470304]
jne 0x415bf3
mov edx, dword [ebp - 0x100bc]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415bf3
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415bf3
cmp dword [0x470308], 2
jne 0x415bf3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x415b50
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415b50
mov ecx, dword [0x45d868]
mov eax, dword [str.Win32.Ramnit.13102015]
mov edx, dword [0x45d86c]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d874]
mov dword [0x46a03e], eax
mov eax, dword [0x45d870]
mov dword [0x46a04e], ecx
mov cx, word [0x45d860]
mov dword [0x46a046], edx
mov dx, word [0x45d878]
mov dword [0x46a04a], eax
mov eax, dword [str.NPAV4]
mov word [0x46a0a7], cx
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x100b8]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41650c
mov edx, dword [esi]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x415f26
mov eax, 0x20
cmp dword [ebp - 0x100c8], eax
je 0x415c2f
cmp dword [ebp - 0x100d4], eax
jne 0x415f26
push 0x45d858
call fcn.004073f0
mov eax, dword [0x46ff2c]
add esp, 4
cmp eax, ebx
je 0x415f26
cmp eax, dword [esi + 4]
jne 0x415f26
mov eax, dword [ebp - 0x100d0]
add eax, 0xffffc000
cmp eax, 0x4000
ja 0x415f26
mov ecx, dword [ebp - 0x100bc]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [0x46ff94]
mov edx, dword [esi]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push str.cry_sz_matched
mov dword [0x46ff94], eax
call fcn.004073f0
push 0x103
lea eax, [ebp - 0x36ab]
push ebx
push eax
mov byte [ebp - 0x36ac], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x36ac]
push str.svchost.exe__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x36ac]
push str.WORM.CTB_LOCK.210115
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x415d95
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x36ac]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415d00
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d824]
mov eax, dword [0x45d828]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d82c]
mov dword [0x46a042], edx
mov edx, dword [0x45d830]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d834]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca1c]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov edx, dword [0x45d828]
mov eax, dword [str.WORM.CTB_LOCK.210115]
mov ecx, dword [0x45d824]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45d82c]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d830]
mov dword [0x46f740], edx
mov dl, byte [0x45d834]
push ebx
push 0x46f978
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x36ac]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x415e00
push 0x104
lea eax, [ebp - 0x54f4]
push ebx
push eax
call fcn.0042e2e0
push 0x104
lea ecx, [ebp - 0x56f8]
push ebx
push ecx
call fcn.0042e2e0
push 0x104
lea edx, [ebp - 0x38b0]
push ebx
push edx
call fcn.0042e2e0
push 0x104
lea eax, [ebp - 0xee0]
push ebx
push eax
call fcn.0042e2e0
mov ecx, 8
mov esi, str.c:windows_system32_svchost.exe
lea edi, [ebp - 0xee0]
add esp, 0x30
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x38b0], cl
inc eax
cmp cl, bl
jne 0x415e71
mov eax, dword [0x469868]
cmp eax, ebx
je 0x415ea5
push 0x104
lea ecx, [ebp - 0x56f8]
push ecx
lea edx, [ebp - 0x38b0]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
cmp eax, ebx
je 0x415ec1
lea ecx, [ebp - 0x54f4]
push ecx
lea edx, [ebp - 0x38b0]
push edx
call eax
add esp, 8
call fcn.00408eb0
push 0x45ca68
push 0x45ca68
push 0x45ca68
lea eax, [ebp - 0x54f4]
push eax
lea ecx, [ebp - 0x56f8]
push ecx
lea edx, [ebp - 0xee0]
push edx
push 0x45ca48
push str.WORM.CTB_LOCK.210115
call fcn.00407310
add esp, 0x20
cmp dword [0x470144], ebx
je 0x415f1a
lea eax, [ebp - 0x10180]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x100b0]
mov edi, dword [ebp - 0x100b8]
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x415f3f
cmp dword [ebp - 0x100d4], eax
jne 0x41650c
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x416078
cmp eax, 4
je 0x416078
cmp dword [0x467218], eax
je 0x416078
cmp dword [0x46721c], eax
je 0x416078
cmp dword [0x467220], eax
je 0x416078
cmp dword [0x467224], eax
je 0x416078
push str.Priv_rwe
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x2000
jne 0x416078
push str.0x2000
call fcn.004073f0
push 0x500
lea ecx, [ebp - 0x9658]
push ebx
push ecx
mov dword [ebp - 0x1011c], ebx
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100c0]
add esp, 0x10
lea edx, [ebp - 0x1011c]
push edx
push 0x500
lea eax, [ebp - 0x9658]
push eax
add ecx, 0xe00
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x9658]
test edx, edx
je 0x416078
cmp dword [ebp - 0x1011c], 0x500
jne 0x416078
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x9658]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x416078
push 0x11
push 0x500
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x9658]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x416078
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x470130], 0x1e
jl 0x4160ce
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4160ce
cmp eax, 4
je 0x4160ce
cmp dword [0x467218], eax
je 0x4160ce
cmp dword [0x46721c], eax
je 0x4160ce
mov ecx, 1
cmp dword [0x470294], ecx
je 0x4160d3
cmp dword [0x47013c], ebx
je 0x4160d3
mov dword [0x470128], ecx
jmp 0x4160d3
mov ecx, 1
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x8000
je 0x41648f
cmp eax, 0x9000
je 0x41648f
cmp eax, 0xe000
je 0x41648f
cmp eax, 0xf000
je 0x41648f
cmp eax, 0x27000
je 0x41648f
cmp eax, 0x28000
je 0x41648f
cmp eax, 0x32000
je 0x41648f
cmp eax, 0x33000
je 0x41648f
cmp eax, 0xd000
jne 0x4161a0
lea eax, [ebp - 0x10128]
push eax
xor edx, edx
push 8
lea ecx, [ebp - 0x38]
mov word [ebp - 0x38], dx
mov edx, dword [ebp - 0x100c0]
push ecx
push edx
push edi
mov dword [ebp - 0x10128], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x100f8], al
jne 0x416179
mov cl, byte [ebp - 0x100f7]
cmp cl, byte [ebp - 0x37]
je 0x416194
cmp byte [ebp - 0x100e0], al
jne 0x41650c
mov dl, byte [ebp - 0x37]
cmp byte [ebp - 0x100df], dl
jne 0x41650c
mov eax, dword [ebp - 0x100bc]
push eax
jmp 0x4164ef
cmp eax, 0x7000
jne 0x4161f8
mov eax, dword [ebp - 0x100c0]
lea ecx, [ebp - 0x1012c]
push ecx
push 8
lea edx, [ebp - 0x38]
push edx
push eax
push edi
mov dword [ebp - 0x1012c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x100f0]
cmp cl, byte [ebp - 0x38]
jne 0x41650c
mov dl, byte [ebp - 0x100ef]
cmp dl, byte [ebp - 0x37]
jne 0x41650c
mov eax, dword [ebp - 0x100bc]
push eax
jmp 0x4164ef
add eax, 0xff000000
cmp eax, 0x1000000
ja 0x4162d3
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41650c
cmp dword [ebp - 0x100c8], 0x40
jne 0x41650c
mov eax, dword [ebp - 0x100c0]
lea ecx, [ebp - 0x10130]
push ecx
push 5
lea edx, [ebp - 0x4d4]
push edx
push eax
push edi
mov dword [ebp - 0x10130], ebx
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4d0], ebx
mov word [ebp - 0x4cc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x100f4]
cmp cl, byte [ebp - 0x4d4]
jne 0x41650c
mov dl, byte [ebp - 0x100f3]
cmp dl, byte [ebp - 0x4d3]
jne 0x41650c
mov al, byte [ebp - 0x100f2]
cmp al, byte [ebp - 0x4d2]
jne 0x41650c
mov eax, 1
add dword [0x470120], eax
cmp dword [0x470124], eax
jne 0x4162bc
mov ecx, dword [ebp - 0x100bc]
push ecx
mov dword [0x470164], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x41650c
cmp dword [0x470120], 8
jl 0x41650c
mov dword [0x470124], eax
jmp 0x41650c
cmp dword [0x470124], ecx
jne 0x41650c
mov ecx, dword [ebp - 0x100c0]
lea edx, [ebp - 0x100b4]
push edx
push 0xa
lea eax, [ebp - 0x100]
push eax
push ecx
push edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov word [ebp - 0xf8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x100]
mov cl, byte [ebp - 0xfc]
cmp eax, dword [ebp - 0x88]
jne 0x41634c
cmp byte [ebp - 0x84], cl
jne 0x41634c
mov dl, byte [ebp - 0x83]
cmp dl, byte [ebp - 0xfb]
jne 0x41634c
mov dl, byte [ebp - 0x82]
cmp dl, byte [ebp - 0xfa]
je 0x4163a8
cmp eax, dword [ebp - 0x58]
jne 0x41636c
cmp byte [ebp - 0x54], cl
jne 0x41636c
mov dl, byte [ebp - 0xfb]
cmp byte [ebp - 0x53], dl
jne 0x41636c
mov dl, byte [ebp - 0x52]
cmp dl, byte [ebp - 0xfa]
je 0x4163a8
cmp eax, dword [ebp - 0x98]
jne 0x41650c
cmp byte [ebp - 0x94], cl
jne 0x41650c
mov al, byte [ebp - 0xfb]
cmp byte [ebp - 0x93], al
jne 0x41650c
mov cl, byte [ebp - 0xfa]
cmp byte [ebp - 0x92], cl
jne 0x41650c
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41650c
cmp dword [ebp - 0x100c8], 0x40
jne 0x41650c
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x1000
je 0x4163dd
cmp eax, 0x2000
jne 0x41650c
mov edx, dword [ebp - 0x100bc]
push edx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xca3]
push ebx
push edx
mov byte [ebp - 0xca4], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xca4]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4SALITY.22022012
push str.NPAV4SALITY.22022012
lea edx, [ebp - 0xca4]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
jmp 0x41650c
mov edx, dword [ebp - 0x100c0]
lea eax, [ebp - 0x10134]
push eax
push 8
lea ecx, [ebp - 0x38]
push ecx
push edx
push edi
mov dword [ebp - 0x10134], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x100ec], al
jne 0x4164d5
mov cl, byte [ebp - 0x100eb]
cmp cl, byte [ebp - 0x37]
jne 0x4164d5
mov edx, dword [ebp - 0x100bc]
push edx
jmp 0x4164ef
cmp byte [ebp - 0x100e0], al
jne 0x41650c
mov al, byte [ebp - 0x37]
cmp byte [ebp - 0x100df], al
jne 0x41650c
mov ecx, dword [ebp - 0x100bc]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [0x470150], ebx
jne 0x41650c
call fcn.00407f90
mov eax, dword [ebp - 0x100d0]
mov dword [ebp - 4], 0x1a
cmp eax, 0x6000
je 0x41652b
cmp eax, 0x9000
jne 0x41680b
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41680b
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41680b
cmp dword [ebp - 0x100d4], eax
jne 0x41680b
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416586
sub eax, edx
je 0x41680b
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41680b
push 0x104
push ebx
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4165d6
sub eax, edx
je 0x41680b
push 0x12c
push ebx
push 0x46fba8
call fcn.0042e2e0
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416636
sub eax, edx
je 0x41680b
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41680b
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41680b
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
mov edi, 1
push str.NPAV4GAMERU.19072016
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.19072016
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45ca48
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x58fb]
push ebx
push eax
mov byte [ebp - 0x58fc], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x58fc]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x58fc]
push str.WORM.GAMERU.19072016
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x41680b
cmp dword [0x46f734], ebx
je 0x41680b
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x58fc]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416772
mov ecx, dword [str.WORM.GAMERU.19072016]
mov edx, dword [0x45d730]
mov eax, dword [0x45d734]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d738]
mov dword [0x46a042], edx
mov edx, dword [0x45d73c]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d740]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca1c]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x41680b
cmp dword [ebp - 0x100d0], 0x30000
mov dword [ebp - 4], 0x1c
jbe 0x416a75
cmp dword [ebp - 0x100c4], 0x20000
jne 0x416a75
cmp dword [ebp - 0x100c8], 0x40
jne 0x416a75
cmp dword [ebp - 0x100d4], 0x40
jne 0x416a75
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416880
sub eax, edx
je 0x416a75
lea eax, [ebp - 0x434]
push str.POWERSHELL.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x416a75
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.POWERSHELL.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
push str.SMB:_Suspended_POWERSHELL.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 0x24
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416a75
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4WANNA.NPAV4.30072018
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4WANNA.NPAV4.30072018
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45ca48
push str.NPAV4POWERSHELL.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x3ab3]
push ebx
push eax
mov byte [ebp - 0x3ab4], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x3ab4]
push str.POWERSHELL.EXE__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x3ab4]
push str.WORM.WANNA.NPAV4.30072018
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x416a2e
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x3ab4]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4169d2
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.WANNA.NPAV4.30072018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push str.POWERSHELL.EXE
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x416a75
push str.WORM.WANNA.NPAV4.30072018
push 0x45c58c
push 0x45c58c
push 0x45c58c
push str.NPAV4POWERSHELL.EXE
lea ecx, [ebp - 0x3ab4]
push ecx
push 1
call eax
add esp, 0x1c
jmp 0x416a75
mov eax, dword [ebp - 0x100d0]
mov dword [ebp - 4], 0x1e
cmp eax, 0xc000
je 0x416a9b
cmp eax, 0x12000
je 0x416a9b
cmp eax, 0xd000
jne 0x416e09
cmp dword [ebp - 0x100c4], 0x20000
jne 0x416e09
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x416ac4
cmp dword [ebp - 0x100d4], eax
jne 0x416e09
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416af8
sub eax, edx
je 0x416e09
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x416e09
push 0x104
push ebx
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416b48
sub eax, edx
je 0x416e09
push 0x12c
push ebx
push 0x46fba8
call fcn.0042e2e0
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416ba8
sub eax, edx
je 0x416e09
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x416e09
mov eax, dword [ebp - 0x100c0]
lea ecx, [ebp - 0x100b4]
push ecx
mov ecx, dword [ebp - 0x100b8]
push 0xa
lea edx, [ebp - 0x440]
push edx
push eax
push ecx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov word [ebp - 0x438], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dl, byte [ebp - 0x100e8]
cmp dl, byte [ebp - 0x440]
jne 0x416c32
mov al, byte [ebp - 0x100e7]
cmp al, byte [ebp - 0x43f]
jne 0x416c32
mov cl, byte [ebp - 0x100e6]
cmp cl, byte [ebp - 0x43e]
je 0x416c56
mov edx, dword [ebp - 0x440]
cmp edx, dword [ebp - 0xe8]
jne 0x416e09
mov al, byte [ebp - 0xe4]
cmp al, byte [ebp - 0x43c]
jne 0x416e09
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416e09
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
mov edi, 1
push str.NPAV4GAMERU.16032017
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.16032017
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45ca48
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x5aff]
push ebx
push eax
mov byte [ebp - 0x5b00], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x5b00]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x5b00]
push str.WORM.GAMERU.16032017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x416e09
cmp dword [0x46f734], ebx
je 0x416e09
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x5b00]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416d70
mov ecx, dword [str.WORM.GAMERU.16032017]
mov edx, dword [0x45d640]
mov eax, dword [0x45d644]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d648]
mov dword [0x46a042], edx
mov edx, dword [0x45d64c]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d650]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca1c]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x416e09
cmp dword [ebp - 0x100c4], 0x20000
mov dword [ebp - 4], 0x20
jne 0x41720f
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x416e39
cmp dword [ebp - 0x100d4], eax
jne 0x41720f
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x2c000
jne 0x41720f
push str.0x2C000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x8d58]
push ebx
push eax
mov dword [ebp - 0x10110], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0x10
lea ecx, [ebp - 0x10110]
push ecx
mov ecx, dword [ebp - 0x100b8]
push 0x500
lea edx, [ebp - 0x8d58]
push edx
add eax, 0x2a11e
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8d58]
test edx, edx
je 0x41720f
cmp dword [ebp - 0x10110], 0x500
jne 0x41720f
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x8d58]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41720f
push str.match_87_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41720f
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xa67]
push ebx
push edx
mov byte [ebp - 0xa68], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa68]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CERBER.20092016.1
push str.NPAV4CERBER.20092016.1
lea edx, [ebp - 0xa68]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x5d03]
push ebx
push eax
mov byte [ebp - 0x5d04], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5d04]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x5d04]
push str.WORM.CERBER.20092016.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41708b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x5d04]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417030
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x4170d0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4170d0
cmp dword [0x470144], ebx
je 0x417100
lea ecx, [ebp - 0x10184]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x6c2b]
push ebx
push edx
mov byte [ebp - 0x6c2c], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x239b]
push ebx
push eax
mov byte [ebp - 0x239c], bl
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100b0]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4171d1
lea edx, [ebp - 0x239c]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417152
lea eax, [ebp - 0x239c]
push eax
lea ecx, [ebp - 0x6c2c]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x6c2c]
push edx
lea eax, [ebp - 0x239c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4171d1
lea ecx, [ebp - 0x6c2c]
push ecx
lea edx, [ebp - 0x239c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4171c4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4171d1
lea eax, [ebp - 0x239c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x100b8]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [ebp - 0x100c4], 0x20000
mov dword [ebp - 4], 0x22
jne 0x417615
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x41723f
cmp dword [ebp - 0x100d4], eax
jne 0x417615
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100d0], 0x26000
jne 0x417615
push str.0x26000
call fcn.004073f0
push 0x500
lea edx, [ebp - 0x8d58]
push ebx
push edx
mov dword [ebp - 0x10118], ebx
call fcn.0042e2e0
mov edx, dword [ebp - 0x100c0]
add esp, 0x10
lea eax, [ebp - 0x10118]
push eax
mov eax, dword [ebp - 0x100b8]
push 0x500
lea ecx, [ebp - 0x8d58]
push ecx
add edx, 0x2411e
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8d58]
test ecx, ecx
je 0x417615
cmp dword [ebp - 0x10118], 0x500
jne 0x417615
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x8d58]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x417615
push str.match_87_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417615
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x100b0]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xc3b]
push ebx
push eax
mov byte [ebp - 0xc3c], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xc3c]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CERBER.20092016.2
push str.NPAV4CERBER.20092016.2
lea eax, [ebp - 0xc3c]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x5f07]
push ebx
push ecx
mov byte [ebp - 0x5f08], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x5f08]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x5f08]
push str.WORM.CERBER.20092016.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41749c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x5f08]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417441
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x4174e0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4174e0
cmp dword [0x470144], ebx
je 0x417510
lea edx, [ebp - 0x101ac]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x57f7]
push ebx
push eax
mov byte [ebp - 0x57f8], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x159b]
push ebx
push ecx
mov byte [ebp - 0x159c], bl
call fcn.0042e2e0
mov edx, dword [ebp - 0x100b0]
mov eax, dword [edx + 4]
push eax
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4175e1
lea edx, [ebp - 0x159c]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417562
lea ecx, [ebp - 0x159c]
push ecx
lea edx, [ebp - 0x57f8]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0xc
push 1
lea eax, [ebp - 0x57f8]
push eax
lea ecx, [ebp - 0x159c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4175e1
lea edx, [ebp - 0x57f8]
push edx
lea eax, [ebp - 0x159c]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4175d4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4175e1
lea ecx, [ebp - 0x159c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x100b8]
push 9
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
mov eax, dword [ebp - 0x100c4]
mov dword [ebp - 4], 0x24
cmp eax, 0x20000
je 0x417634
cmp eax, 0x40000
jne 0x417a15
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x41764d
cmp dword [ebp - 0x100d4], eax
jne 0x417a15
push str.map_and_RWE
call fcn.004073f0
mov esi, dword [ebp - 0x100d0]
add esp, 4
cmp esi, 0x1e00
jb 0x417a15
push 0x500
lea eax, [ebp - 0x8d58]
push ebx
push eax
mov dword [ebp - 0x10120], ebx
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
add esp, 0xc
lea ecx, [ebp - 0x10120]
push ecx
push 0x500
lea edx, [ebp - 0x8d58]
push edx
mov edx, dword [ebp - 0x100b8]
lea ecx, [esi + eax - 0x1e00]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x8d58]
test eax, eax
je 0x417a15
cmp dword [ebp - 0x10120], 0x500
jne 0x417a15
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea ecx, [ebp - 0x2c0]
push ecx
lea edx, [ebp - 0x8d58]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x417a15
push str.match_87_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417a15
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x100b0]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xacf]
push ebx
push edx
mov byte [ebp - 0xad0], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xad0]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CERBER.20092016.3
push str.NPAV4CERBER.20092016.3
lea edx, [ebp - 0xad0]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x610b]
push ebx
push eax
mov byte [ebp - 0x610c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x610c]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x610c]
push str.WORM.CERBER.20092016.3
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x4178a3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x610c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417848
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4178e0
cmp dword [0x470144], ebx
je 0x417910
lea ecx, [ebp - 0x101cc]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x7c57]
push ebx
push edx
mov byte [ebp - 0x7c58], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x189b]
push ebx
push eax
mov byte [ebp - 0x189c], bl
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100b0]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4179e1
lea edx, [ebp - 0x189c]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417962
lea eax, [ebp - 0x189c]
push eax
lea ecx, [ebp - 0x7c58]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x7c58]
push edx
lea eax, [ebp - 0x189c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4179e1
lea ecx, [ebp - 0x7c58]
push ecx
lea edx, [ebp - 0x189c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4179d4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4179e1
lea eax, [ebp - 0x189c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x100b8]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x1c000
je 0x417a2d
cmp eax, 0x1e000
jne 0x417df9
cmp dword [ebp - 0x100c8], 0x40
je 0x417a46
cmp dword [ebp - 0x100d4], 0x80
jne 0x417df9
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x100c4]
add esp, 4
cmp eax, 0x1000000
je 0x417a6b
cmp eax, 0x20000
jne 0x417df9
push str.0X1C000
call fcn.004073f0
mov esi, dword [ebp - 0x100c0]
mov ecx, dword [ebp - 0x100b8]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 4
lea edx, [ebp - 0x10100]
push edx
push 0xa
lea eax, [ebp - 0x46c]
push eax
push esi
push ecx
mov dword [ebp - 0x10100], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x464], bx
call edi
mov edx, dword [ebp - 0x46c]
cmp edx, dword [ebp - 0xa8]
jne 0x417df9
mov al, byte [ebp - 0xa4]
cmp al, byte [ebp - 0x468]
jne 0x417df9
mov cl, byte [ebp - 0xa3]
cmp cl, byte [ebp - 0x467]
jne 0x417df9
mov dl, byte [ebp - 0xa2]
cmp dl, byte [ebp - 0x466]
jne 0x417df9
push str.match_7_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100b8]
add esp, 4
lea eax, [ebp - 0x10100]
push eax
push 0x200
lea ecx, [ebp - 0x8f58]
push ecx
add esi, 0xc300
push esi
push edx
call edi
lea eax, [ebp - 0x8f58]
test eax, eax
je 0x417df9
cmp dword [ebp - 0x10100], 0x200
jne 0x417df9
push str.read_successful_and_act_bytes
call fcn.004073f0
add esp, 4
mov ecx, 0x12
lea eax, [ebp - 0x198]
lea esi, [ebp - 0x8f0c]
jmp 0x417b70
mov edx, dword [esi]
cmp edx, dword [eax]
jne 0x417b99
sub ecx, 4
add eax, 4
add esi, 4
cmp ecx, 4
jae 0x417b70
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x417b99
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
jne 0x417b99
mov esi, 1
jmp 0x417bc2
push str.going_to_serach_not_match_first_condition
call fcn.004073f0
push 0x12
push 0x200
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x8f58]
push ecx
call fcn.00408390
add esp, 0x14
mov esi, eax
push str.match_1st_Condition
call fcn.004073f0
mov edi, 1
add esp, 4
cmp esi, edi
jne 0x417df9
push str.match_18_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x26
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417df9
push str.Sig_found_and_suspend_
call fcn.004073f0
add esp, 4
mov dword [0x470164], edi
cmp dword [0x470154], ebx
jne 0x417c4b
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10154]
push eax
push ebx
push ebx
push 0x40c550
push ebx
push ebx
call esi
lea ecx, [ebp - 0x101c8]
push ecx
push ebx
push ebx
push 0x40ef60
push ebx
push ebx
call esi
mov esi, dword [ebp - 0x100b0]
mov eax, dword [0x46ff94]
mov dword [0x470154], edi
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xb37]
push ebx
push eax
mov byte [ebp - 0xb38], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xb38]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4PIONEER.05102016
push str.NPAV4PIONEER.05102016
lea eax, [ebp - 0xb38]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x6313]
push ebx
push ecx
mov byte [ebp - 0x6314], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6314]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x6314]
push str.WORM.PIONEER.05102016
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x417dff
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6314]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x417d60
mov ecx, dword [0x45d4e0]
mov eax, dword [str.WORM.PIONEER.05102016]
mov edx, dword [0x45d4e4]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d4ec]
mov dword [0x46a03e], eax
mov eax, dword [0x45d4e8]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a046], edx
mov dx, word [0x45d4f0]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x417df9
mov esi, dword [ebp - 0x100b0]
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x11000
je 0x417e17
cmp eax, 0x10000
jne 0x418236
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x417e30
cmp dword [ebp - 0x100d4], eax
jne 0x418236
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x100c4]
add esp, 4
cmp eax, 0x20000
je 0x417e55
cmp eax, 0x1000000
jne 0x418236
push str.0X11000_0X10000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0xf0ac]
push ebx
push edx
call fcn.0042e2e0
mov edx, dword [ebp - 0x100c0]
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea eax, [ebp - 0x100b4]
push eax
push 0x1000
lea ecx, [ebp - 0xf0ac]
push ecx
add edx, 0x4000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x1000
jne 0x418236
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xf0ac]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418236
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0xf0ac]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418236
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x28
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x85f]
push ebx
push eax
mov byte [ebp - 0x860], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x860]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYSIS.09012017.1
push str.NPAV4CRYSIS.09012017.1
lea eax, [ebp - 0x860]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x59fb]
push ebx
push ecx
mov byte [ebp - 0x59fc], bl
call fcn.0042e2e0
push 0xff
lea edx, [ebp - 0x1a9b]
push ebx
push edx
mov byte [ebp - 0x1a9c], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x418085
mov ecx, eax
lea edx, [ebp - 0x1a9c]
jmp 0x418010
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418010
lea ecx, [ebp - 0x1a9c]
push ecx
lea edx, [ebp - 0x59fc]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0xc
push 1
lea eax, [ebp - 0x59fc]
push eax
lea ecx, [ebp - 0x1a9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418085
lea edx, [ebp - 0x59fc]
push edx
lea eax, [ebp - 0x1a9c]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x418078
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418085
lea ecx, [ebp - 0x1a9c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x651b]
push ebx
push edx
mov byte [ebp - 0x651c], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x651c]
push str._s__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x651c]
push str.WORM.CRYSIS.09012017.1
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41815d
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x651c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418100
mov dl, byte [0x45ca1c]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4181d8
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x4181b0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4181b0
cmp dword [0x470144], ebx
je 0x4181d8
lea eax, [ebp - 0x1015c]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040eb30
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x41820b
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
mov esi, dword [ebp - 0x100b0]
cmp dword [ebp - 0x100d0], 0x3000
jne 0x418666
cmp dword [ebp - 0x100c8], 0x20
je 0x41825f
cmp dword [ebp - 0x100d4], 0x80
jne 0x418ea9
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x418666
push str.0X3000
call fcn.004073f0
push 0x100
lea edx, [ebp - 0x8504]
push ebx
push edx
call fcn.0042e2e0
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea eax, [ebp - 0x100b4]
push eax
push 0x100
lea ecx, [ebp - 0x8504]
push ecx
push 0x40d500
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x100
jne 0x418666
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x100
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x8504]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418666
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x100
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0x8504]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418666
push str.match_12_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2a
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x893]
push ebx
push edx
mov byte [ebp - 0x894], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x894]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYSIS.09012017.2
push str.NPAV4CRYSIS.09012017.2
lea edx, [ebp - 0x894]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x6e2f]
push ebx
push eax
mov byte [ebp - 0x6e30], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x1c9b]
push ebx
push ecx
mov byte [ebp - 0x1c9c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4184b2
mov ecx, eax
lea edx, [ebp - 0x1c9c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418430
lea eax, [ebp - 0x1c9c]
push eax
lea ecx, [ebp - 0x6e30]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x6e30]
push edx
lea eax, [ebp - 0x1c9c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4184b2
lea ecx, [ebp - 0x6e30]
push ecx
lea edx, [ebp - 0x1c9c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4184a5
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4184b2
lea eax, [ebp - 0x1c9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x6723]
push ebx
push ecx
mov byte [ebp - 0x6724], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6724]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x6724]
push str.WORM.CRYSIS.09012017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41858b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6724]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418530
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418608
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4185e0
cmp dword [0x470144], ebx
je 0x418608
lea edx, [ebp - 0x101a8]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040eb30
mov eax, dword [0x470178]
add esp, 4
cmp eax, ebx
je 0x418622
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x100b0]
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x136000
je 0x418685
cmp eax, 0x134000
je 0x418685
cmp eax, 0x135000
jne 0x418a87
cmp dword [ebp - 0x100c8], 0x40
jne 0x418a87
cmp dword [ebp - 0x100d4], 0x80
jne 0x418a87
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x418a87
push str.0X136000
call fcn.004073f0
push 0x32
lea ecx, [ebp - 0xda8]
push ebx
push ecx
call fcn.0042e2e0
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea edx, [ebp - 0x100b4]
push edx
push 0x32
lea eax, [ebp - 0xda8]
push eax
push 0x406020
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x32
jne 0x418a87
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0xda8]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418a87
push str.match_11_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2c
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x68b]
push ebx
push edx
mov byte [ebp - 0x68c], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x68c]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4STOPRANSOM.NPAV4.18112019
push str.NPAV4STOPRANSOM.NPAV4.18112019
lea edx, [ebp - 0x68c]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x37ab]
push ebx
push eax
mov byte [ebp - 0x37ac], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x1e9b]
push ebx
push ecx
mov byte [ebp - 0x1e9c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4188b6
mov ecx, eax
lea edx, [ebp - 0x1e9c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418834
lea eax, [ebp - 0x1e9c]
push eax
lea ecx, [ebp - 0x37ac]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x37ac]
push edx
lea eax, [ebp - 0x1e9c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4188b6
lea ecx, [ebp - 0x37ac]
push ecx
lea edx, [ebp - 0x1e9c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4188a9
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4188b6
lea eax, [ebp - 0x1e9c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3cb7]
push ebx
push ecx
mov byte [ebp - 0x3cb8], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3cb8]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x3cb8]
push str.WORM.STOPRANSOM.NPAV4.18112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41898c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x3cb8]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418931
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418a08
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4189e0
cmp dword [0x470144], ebx
je 0x418a08
lea edx, [ebp - 0x101bc]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418a41
push str.WORM.STOPRANSOM.NPAV4.18112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x37ac]
push ecx
lea edx, [ebp - 0x68c]
push edx
lea ecx, [ebp - 0x3cb8]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418a65
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.STOPRANSOM.18112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x100b0]
cmp dword [ebp - 0x100d0], 0xd000
jne 0x418e8d
cmp dword [ebp - 0x100c8], 0x40
jne 0x419716
cmp dword [ebp - 0x100d4], 0x80
jne 0x419716
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x418e8d
push str.0XD000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xddc]
push ebx
push eax
call fcn.0042e2e0
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea ecx, [ebp - 0x100b4]
push ecx
push 0x32
lea edx, [ebp - 0xddc]
push edx
push 0x40d3e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x32
jne 0x418e8d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0xddc]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418e8d
push str.match_11_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
push ebx
push edx
mov dword [ebp - 4], 0x2e
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x75b]
push ebx
push edx
mov byte [ebp - 0x75c], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x75c]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4DEATHRANSOM.NPAV4.22112019
push str.NPAV4DEATHRANSOM.NPAV4.22112019
lea edx, [ebp - 0x75c]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x329f]
push ebx
push eax
mov byte [ebp - 0x32a0], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x209b]
push ebx
push ecx
mov byte [ebp - 0x209c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x418cc8
mov ecx, eax
lea edx, [ebp - 0x209c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418c46
lea eax, [ebp - 0x209c]
push eax
lea ecx, [ebp - 0x32a0]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x32a0]
push edx
lea eax, [ebp - 0x209c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418cc8
lea ecx, [ebp - 0x32a0]
push ecx
lea edx, [ebp - 0x209c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x418cbb
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418cc8
lea eax, [ebp - 0x209c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3ebf]
push ebx
push ecx
mov byte [ebp - 0x3ec0], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3ec0]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x3ec0]
push str.WORM.DEATHRANSOM.NPAV4.22112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x418d9b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x3ec0]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418d43
mov eax, dword [str.NPA4]
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418e0e
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
push 0x104
push ebx
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418de6
cmp dword [0x470144], ebx
je 0x418e0e
lea edx, [ebp - 0x1014c]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418e47
push str.WORM.DEATHRANSOM.NPAV4.22112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x32a0]
push ecx
lea edx, [ebp - 0x75c]
push edx
lea ecx, [ebp - 0x3ec0]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418e6b
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.DEATHRANSOM.22112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x100b0]
cmp dword [ebp - 0x100d0], 0x2000
je 0x418ea9
cmp dword [ebp - 0x100d0], 0x3000
jne 0x4192b7
cmp dword [ebp - 0x100c8], 0x40
jne 0x4192b7
cmp dword [ebp - 0x100d4], 0x80
jne 0x4192b7
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x4192b7
push str.0X2000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xd74]
push ebx
push eax
call fcn.0042e2e0
mov eax, dword [ebp - 0x100c0]
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea ecx, [ebp - 0x100b4]
push ecx
push 0x32
lea edx, [ebp - 0xd74]
push edx
add eax, 0x11c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x32
jne 0x4192b7
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x12
push 0x32
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0xd74]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4192b7
push str.match_18_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x30
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x623]
push ebx
push edx
mov byte [ebp - 0x624], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x624]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4SIFRELENDI.NPAV4.19122019
push str.NPAV4SIFRELENDI.NPAV4.19122019
lea edx, [ebp - 0x624]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x47d7]
push ebx
push eax
mov byte [ebp - 0x47d8], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x229b]
push ebx
push ecx
mov byte [ebp - 0x229c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x4190e2
mov ecx, eax
lea edx, [ebp - 0x229c]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419060
lea eax, [ebp - 0x229c]
push eax
lea ecx, [ebp - 0x47d8]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x47d8]
push edx
lea eax, [ebp - 0x229c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4190e2
lea ecx, [ebp - 0x47d8]
push ecx
lea edx, [ebp - 0x229c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x4190d5
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4190e2
lea eax, [ebp - 0x229c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x40c3]
push ebx
push ecx
mov byte [ebp - 0x40c4], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x40c4]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x40c4]
push str.WORM.SIFRELENDI.NPAV4.19122019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x4191bb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x40c4]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419160
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x419238
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419210
cmp dword [0x470144], ebx
je 0x419238
lea edx, [ebp - 0x101d8]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x419271
push str.WORM.SIFRELENDI.NPAV4.19122019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x47d8]
push ecx
lea edx, [ebp - 0x624]
push edx
lea ecx, [ebp - 0x40c4]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x419295
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.SIFRELENDI.19122019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x100b0]
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x1d000
je 0x4192d6
cmp eax, 0x1c000
je 0x4192d6
cmp eax, 0x22000
jne 0x419716
cmp dword [ebp - 0x100c4], 0x20000
jne 0x419716
push str.MEM_PRIVATE
call fcn.004073f0
mov eax, 0x40
add esp, 4
cmp dword [ebp - 0x100c8], eax
je 0x41930c
cmp dword [ebp - 0x100d4], eax
jne 0x419716
push str.PAGE_EXECUTE_READWRITE
call fcn.004073f0
push 0x200
lea eax, [ebp - 0x9158]
push ebx
push eax
call fcn.0042e2e0
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea ecx, [ebp - 0x100b4]
push ecx
push 0x200
lea edx, [ebp - 0x9158]
push edx
push 0x40c400
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x200
jne 0x419716
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x200
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x9158]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x419716
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x200
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0x9158]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x419716
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x32
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x82b]
push ebx
push eax
mov byte [ebp - 0x82c], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x82c]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYSIS.06022017.3
push str.NPAV4CRYSIS.06022017.3
lea eax, [ebp - 0x82c]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x8707]
push ebx
push ecx
mov byte [ebp - 0x8708], bl
call fcn.0042e2e0
push 0xff
lea edx, [ebp - 0x249b]
push ebx
push edx
mov byte [ebp - 0x249c], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41956a
mov ecx, eax
lea edx, [ebp - 0x249c]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4194c0
lea ecx, [ebp - 0x249c]
push ecx
lea edx, [ebp - 0x8708]
push str._s.np4
push edx
call fcn.0042e476
lea eax, [ebp - 0x8708]
push eax
lea ecx, [ebp - 0x249c]
push ecx
call fcn.004300bd
add esp, 0x14
test eax, eax
jne 0x41951b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41956a
push 0x1f2
lea eax, [ebp - 0x984a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x984c], dx
call fcn.0042e2e0
lea ecx, [ebp - 0x249c]
push 0x5c
push ecx
call fcn.0042e810
add esp, 0x14
cmp eax, ebx
je 0x41954d
mov byte [eax], bl
lea edx, [ebp - 0x984c]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x249c]
push ecx
call fcn.0040a680
add esp, 0xc
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x6927]
push ebx
push edx
mov byte [ebp - 0x6928], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6928]
push str._s__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x6928]
push str.WORM.CRYSIS.06022017.3
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x419642
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6928]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4195e5
mov dl, byte [0x45ca1c]
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4196b8
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419690
cmp dword [0x470144], ebx
je 0x4196b8
lea eax, [ebp - 0x101a0]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040eb30
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x4196eb
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
mov esi, dword [ebp - 0x100b0]
mov eax, dword [ebp - 0x100d0]
mov dword [ebp - 4], 0x34
cmp eax, 0x38000
je 0x419751
cmp eax, 0x3a000
je 0x419751
cmp eax, 0x34000
je 0x419751
cmp eax, 0x3b000
je 0x419751
cmp eax, 0x91000
je 0x419751
cmp eax, 0x39000
jne 0x419af8
cmp dword [ebp - 0x100c4], 0x20000
jne 0x419af8
mov ecx, 0x40
cmp dword [ebp - 0x100c8], ecx
je 0x41977a
cmp dword [ebp - 0x100d4], ecx
jne 0x419af8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4197a8
sub eax, edx
je 0x419af2
lea edx, [ebp - 0x434]
push str.EXPLORER.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x41981b
lea eax, [ebp - 0x434]
push str.CHROME.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x41981b
lea ecx, [ebp - 0x434]
push str.IEXPLORE.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x41981b
lea edx, [ebp - 0x434]
push str.FIREFOX.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x419af2
mov edx, dword [ebp - 0x100c0]
lea eax, [ebp - 0x100b4]
push eax
mov eax, dword [ebp - 0x100b8]
push 0xa
lea ecx, [ebp - 0x330]
push ecx
push edx
push eax
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov word [ebp - 0x328], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x330]
mov cl, byte [ebp - 0x32c]
cmp eax, dword [ebp - 0x30]
jne 0x419873
cmp byte [ebp - 0x2c], cl
jne 0x419873
mov dl, byte [ebp - 0x2b]
cmp dl, byte [ebp - 0x32b]
je 0x4198bb
cmp eax, dword [ebp - 0xd0]
jne 0x419891
cmp byte [ebp - 0xcc], cl
jne 0x419891
mov dl, byte [ebp - 0xcb]
cmp dl, byte [ebp - 0x32b]
je 0x4198bb
cmp eax, dword [ebp - 0xc0]
jne 0x419af2
cmp byte [ebp - 0xbc], cl
jne 0x419af2
mov al, byte [ebp - 0x32b]
cmp byte [ebp - 0xbb], al
jne 0x419af2
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419af2
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45ca48
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6b2b]
push ebx
push eax
mov byte [ebp - 0x6b2c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6b2c]
push str.AR8__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x6b2c]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419a49
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6b2c]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4199c0
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d240]
mov eax, dword [0x45d244]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d248]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a042], edx
mov dx, word [0x45d24c]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419af2
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov eax, dword [0x45d240]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d244]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d248]
mov dword [0x46f73c], eax
mov ax, word [0x45d24c]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042e2e0
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d238]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419af2
lea eax, [ebp - 0x10150]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x100d0]
mov dword [ebp - 4], 0x36
cmp eax, 0x96000
je 0x419b18
cmp eax, 0x93000
je 0x419b18
cmp eax, 0x94000
jne 0x419dfa
cmp dword [ebp - 0x100c4], 0x20000
jne 0x419dfa
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x419b41
cmp dword [ebp - 0x100d4], eax
jne 0x419dfa
mov eax, dword [ebp - 0x100c0]
lea ecx, [ebp - 0x100b4]
push ecx
mov ecx, dword [ebp - 0x100b8]
push 0xa
lea edx, [ebp - 0x44c]
push edx
push eax
push ecx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov word [ebp - 0x444], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x30]
jne 0x419b99
mov dl, byte [ebp - 0x2c]
cmp dl, byte [ebp - 0x448]
jne 0x419b99
mov cl, byte [ebp - 0x2b]
cmp cl, byte [ebp - 0x447]
je 0x419bc9
cmp eax, dword [ebp - 0xc8]
jne 0x419dfa
mov dl, byte [ebp - 0x448]
cmp byte [ebp - 0xc4], dl
jne 0x419dfa
mov al, byte [ebp - 0x447]
cmp byte [ebp - 0xc3], al
jne 0x419dfa
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419dfa
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45ca48
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6d2f]
push ebx
push eax
mov byte [ebp - 0x6d30], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6d30]
push str.AR8__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x6d30]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419d51
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6d30]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419cc8
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d240]
mov eax, dword [0x45d244]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d248]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a042], edx
mov dx, word [0x45d24c]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419dfa
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov eax, dword [0x45d240]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d244]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d248]
mov dword [0x46f73c], eax
mov ax, word [0x45d24c]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042e2e0
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d238]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419dfa
lea eax, [ebp - 0x10160]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x100c4], 0x20000
mov dword [ebp - 4], 0x38
jne 0x41a290
mov eax, dword [ebp - 0x100d0]
cmp eax, 0x14000
je 0x419e29
cmp eax, 0x13000
jne 0x41a290
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41a290
cmp dword [ebp - 0x100d4], eax
jne 0x41a290
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042e2e0
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419e74
sub eax, edx
je 0x41a290
lea ecx, [ebp - 0x434]
push str.CacheMgr.exe
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x419eb7
lea edx, [ebp - 0x434]
push str.dwm22.exe
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41a290
mov edx, dword [ebp - 0x100c0]
lea eax, [ebp - 0x100b4]
push eax
mov eax, dword [ebp - 0x100b8]
push 0xa
lea ecx, [ebp - 0x4f8]
push ecx
push edx
push eax
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov word [ebp - 0x4f0], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, 9
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x4f8]
nop
cmp edx, 4
jb 0x419f4d
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x41a290
sub edx, 4
add eax, 4
add ecx, 4
jmp 0x419f00
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a290
push str.FAEDEVOUR:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a290
mov eax, dword [0x46ff94]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4FAEDEVOUR.22022017
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push str.NPAV4FAEDEVOUR.22022017
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45ca48
push str.NPAV4
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea edx, [ebp - 0x6f33]
push ebx
push edx
mov byte [ebp - 0x6f34], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
lea edx, [ebp - 0x6f34]
push str._s__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x6f34]
push str.WORM.FAEDEVOUR.22022017
push eax
call fcn.0040a000
add esp, 0x44
cmp dword [0x46f734], ebx
je 0x41a0f3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x6f34]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a060
mov ecx, dword [str.WORM.FAEDEVOUR.22022017]
mov edx, dword [0x45d1c8]
mov eax, dword [0x45d1cc]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d1d0]
mov dword [0x46a042], edx
mov edx, dword [0x45d1d4]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov eax, dword [0x45d1d8]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca1c]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a052], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
push 0xff
lea eax, [ebp - 0x5bff]
push ebx
push eax
mov byte [ebp - 0x5c00], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x269b]
push ebx
push ecx
mov byte [ebp - 0x269c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41a1c8
lea edx, [ebp - 0x269c]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41a140
lea eax, [ebp - 0x269c]
push eax
lea ecx, [ebp - 0x5c00]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x5c00]
push edx
lea eax, [ebp - 0x269c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a1c8
lea ecx, [ebp - 0x5c00]
push ecx
lea edx, [ebp - 0x269c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41a1bb
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a1c8
lea eax, [ebp - 0x269c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x100b8]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x470160], ebx
jne 0x41a290
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov edx, dword [str.WORM.FAEDEVOUR.22022017]
mov eax, dword [0x45d1c8]
mov ecx, dword [0x45d1cc]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d1d0]
mov dword [0x46f73c], eax
mov eax, dword [0x45d1d4]
mov dword [0x46f740], ecx
mov ecx, dword [0x45d1d8]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41a260
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a260
cmp dword [0x470144], ebx
je 0x41a290
lea edx, [ebp - 0x101b0]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x100d0], 0x3000
mov dword [ebp - 4], 0x3a
jne 0x41a793
cmp dword [ebp - 0x100c8], 0x20
je 0x41a2bd
cmp dword [ebp - 0x100d4], 0x40
jne 0x41a793
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41a793
push str.0x3000
call fcn.004073f0
mov edi, dword [ebp - 0x100c0]
mov edx, dword [ebp - 0x100b8]
add esp, 4
lea eax, [ebp - 0x10104]
push eax
push 0xa
lea ecx, [ebp - 0x460]
push ecx
push edi
push edx
mov dword [ebp - 0x10104], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov word [ebp - 0x458], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0xb8]
jne 0x41a793
mov cl, byte [ebp - 0xb4]
cmp cl, byte [ebp - 0x45c]
jne 0x41a793
mov dl, byte [ebp - 0xb3]
cmp dl, byte [ebp - 0x45b]
jne 0x41a793
mov al, byte [ebp - 0xb2]
cmp al, byte [ebp - 0x45a]
jne 0x41a793
push 0x200
lea ecx, [ebp - 0x9a4c]
push ebx
push ecx
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100b8]
add esp, 0xc
lea edx, [ebp - 0x10104]
push edx
push 0x200
lea eax, [ebp - 0x9a4c]
push eax
add edi, 0x900
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x10104], 0x200
jne 0x41a793
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x1f
push 0x200
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x9a4c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41a793
push str.match_31_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 8
push str.Program_files
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x41a793
mov edx, dword [ebp - 0x100bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a793
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x963]
push ebx
push edx
mov byte [ebp - 0x964], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x964]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4BTCWARE.12042017.1
push str.NPAV4BTCWARE.12042017.1
lea edx, [ebp - 0x964]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7137]
push ebx
push eax
mov byte [ebp - 0x7138], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7138]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x7138]
push str.WORM.BTCWARE.12042017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41a5d1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7138]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a540
mov edx, dword [str.WORM.BTCWARE.12042017.1]
mov eax, dword [0x45d174]
mov ecx, dword [0x45d178]
mov dword [0x46a03e], edx
mov edx, dword [0x45d17c]
mov dword [0x46a042], eax
mov eax, dword [0x45d180]
mov dword [0x46a046], ecx
mov ecx, dword [0x45d184]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca1c]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41a680
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, dword [str.WORM.BTCWARE.12042017.1]
mov edx, dword [0x45d174]
mov eax, dword [0x45d178]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d17c]
mov dword [0x46f73c], edx
mov edx, dword [0x45d180]
mov dword [0x46f740], eax
mov eax, dword [0x45d184]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov dword [0x46f74c], eax
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a650
cmp dword [0x470144], ebx
je 0x41a680
lea ecx, [ebp - 0x101c4]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x784b]
push ebx
push edx
mov byte [ebp - 0x784c], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x289b]
push ebx
push eax
mov byte [ebp - 0x289c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41a755
lea edx, [ebp - 0x289c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41a6d0
lea edx, [ebp - 0x289c]
push edx
lea eax, [ebp - 0x784c]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x784c]
push ecx
lea edx, [ebp - 0x289c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a755
lea eax, [ebp - 0x784c]
push eax
lea ecx, [ebp - 0x289c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41a748
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a755
lea edx, [ebp - 0x289c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x100b8]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [ebp - 0x100c4], 0x20000
mov dword [ebp - 4], 0x3c
jne 0x41ab81
cmp dword [ebp - 0x100d0], 0x11000
jb 0x41ab81
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41ab81
cmp dword [ebp - 0x100d4], eax
jne 0x41ab81
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042e2e0
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41a805
sub eax, edx
je 0x41ab81
lea ecx, [ebp - 0x434]
push str.SVCHOST.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x41a848
lea edx, [ebp - 0x434]
push str.SPOOLSV.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41ab81
push str.Chengdu:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41ab81
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x7f7]
push ebx
push edx
mov byte [ebp - 0x7f8], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7f8]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4Chengdu.22032022
push str.NPAV4Chengdu.22032022
lea edx, [ebp - 0x7f8]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x42c7]
push ebx
push eax
mov byte [ebp - 0x42c8], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x42c8]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x42c8]
push str.WORM.CHENGDU.22032022
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41aa35
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x42c8]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a9a2
mov edx, dword [str.WORM.CHENGDU.22032022]
mov eax, dword [0x45d118]
mov ecx, dword [0x45d11c]
mov dword [0x46a03e], edx
mov edx, dword [0x45d120]
mov dword [0x46a042], eax
mov eax, dword [0x45d124]
mov dword [0x46a046], ecx
mov cx, word [0x45d128]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca1c]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41ab5d
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov eax, dword [0x45d104]
mov ecx, dword [str.WORM.CHENGDU.25052017]
mov edx, dword [0x45d100]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d108]
mov dword [0x46f73c], edx
mov edx, dword [0x45d10c]
mov dword [0x46f740], eax
mov ax, word [0x45d110]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41aac0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41aac0
push 0x44
lea ecx, [ebp - 0x10230]
push ebx
push ecx
call fcn.0042e2e0
add esp, 0xc
lea edx, [ebp - 0x10148]
push edx
lea eax, [ebp - 0x10230]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.IPSEC_STATIC_DELETE_POLICY_NAMEQIANYE
push str.C:WINDOWSSYSTEM32NETSH.EXE
mov dword [ebp - 0x10230], 0x44
mov dword [ebp - 0x10148], ebx
mov dword [ebp - 0x10144], ebx
mov dword [ebp - 0x10140], ebx
mov dword [ebp - 0x1013c], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41ab5d
push 0x46f738
call fcn.00407460
add esp, 4
test eax, eax
jne 0x41ab5d
cmp dword [0x470144], ebx
je 0x41ab5d
lea ecx, [ebp - 0x1016c]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea edx, [ebp - 0x42c8]
push str.WORM.CHENGDU.NPAV4.25052017
push edx
call fcn.0040a000
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x100c4], 0x40000
mov dword [ebp - 4], 0x3e
jne 0x41ae66
cmp dword [ebp - 0x100d0], 0x2ee0
jb 0x41ae66
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41ae66
cmp dword [ebp - 0x100d4], eax
jne 0x41ae66
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042e2e0
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41abf3
sub eax, edx
je 0x41ae66
lea ecx, [ebp - 0x434]
push str.EXPLORER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41ae66
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x20]
push str.pid_d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x20]
push ecx
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41ae60
mov dword [0x470164], 1
call fcn.0040c260
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [ebp - 0x733f]
push ebx
push edx
mov byte [ebp - 0x7340], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x7340]
push str._s__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x7340]
push str.WORM.DOFOIL.NPAV4.23032018
push eax
call fcn.0040a000
add esp, 0x38
cmp dword [0x470160], ebx
jne 0x41ae60
push 0x31
lea ecx, [ebp - 0xa33]
push ebx
push ecx
mov byte [ebp - 0xa34], bl
call fcn.0042e2e0
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0xa34]
push str.NPAV4_s
push eax
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4DOFOIL.NPAV4.23032018
push str.NPAV4DOFOIL.NPAV4.23032018
lea ecx, [ebp - 0xa34]
push 0x45ca48
push ecx
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41adeb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7340]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41ad90
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41ae30
cmp dword [0x470144], ebx
je 0x41ae60
lea ecx, [ebp - 0x10198]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x100b0]
cmp dword [ebp - 0x100c4], 0x40000
mov eax, 0x40
mov dword [ebp - 4], eax
jne 0x41b15a
cmp dword [ebp - 0x100d0], 0x55f0
jb 0x41b15a
cmp dword [ebp - 0x100c8], eax
jne 0x41b15a
cmp dword [ebp - 0x100d4], eax
jne 0x41b15a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41aed4
sub eax, edx
je 0x41b15a
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41b15a
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b15a
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042e2e0
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x7547]
push ebx
push ecx
mov byte [ebp - 0x7548], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7548]
push str._s__d
push ecx
call fcn.0042e476
add esp, 0x30
cmp dword [0x470160], ebx
jne 0x41b130
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x31
mov dword [0x46ff94], eax
lea eax, [ebp - 0xa9b]
push ebx
push eax
mov byte [ebp - 0xa9c], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xa9c]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
lea eax, [ebp - 0xa9c]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41b0b1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7548]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b054
mov dl, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41b100
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b100
cmp dword [0x470144], ebx
je 0x41b130
lea eax, [ebp - 0x10158]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea ecx, [ebp - 0x7548]
push str.WORM.CRY_MSIEXC.NPAV4.06032019
push ecx
call fcn.0040a000
mov esi, dword [ebp - 0x100b0]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x100c4], 0x20000
mov dword [ebp - 4], 0x42
jne 0x41b623
cmp dword [ebp - 0x100d0], 0x9000
jne 0x41b623
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41b623
cmp dword [ebp - 0x100d4], eax
jne 0x41b623
mov eax, dword [esi + 4]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
jne 0x41b210
mov eax, dword [ebp - 0x100bc]
cmp eax, ebx
je 0x41b1c9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x100b8]
cmp eax, ebx
je 0x41dafd
push eax
jmp 0x41daf7
push 0x104
lea ecx, [ebp - 0xee0]
push ebx
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0xee0]
push edx
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xee0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41b248
sub eax, edx
je 0x41b623
lea eax, [ebp - 0xee0]
push eax
call fcn.0042fb5a
lea ecx, [ebp - 0xee0]
push str.APPDATAROAMINGMICROSOFT_
push ecx
call fcn.0042e840
add esp, 0xc
test eax, eax
jne 0x41b297
lea edx, [ebp - 0xee0]
push str.APPLICATION_DATAMICROSOFT_
push edx
call fcn.0042e840
add esp, 8
test eax, eax
je 0x41b623
push str.HRM:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b623
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb03]
push ebx
push edx
mov byte [ebp - 0xb04], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb04]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4HRM.02112017.1
push str.NPAV4HRM.02112017.1
lea edx, [ebp - 0xb04]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x774b]
push ebx
push eax
mov byte [ebp - 0x774c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x774c]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x774c]
push str.WORM.HRM.02112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41b478
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x774c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b3f1
mov edx, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45cf9c]
mov eax, dword [0x45cf98]
mov dword [0x46a03e], edx
mov edx, dword [0x45cfa0]
mov dword [0x46a046], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a042], eax
mov eax, dword [0x45cfa4]
mov dword [0x46a04a], edx
mov dl, byte [0x45ca1c]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a04e], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41b520
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov eax, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45cf98]
mov edx, dword [0x45cf9c]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45cfa0]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45cfa4]
push ebx
push 0x46f978
mov dword [0x46f740], edx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41b4f0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b4f0
cmp dword [0x470144], ebx
je 0x41b520
lea edx, [ebp - 0x10174]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x5e03]
push ebx
push eax
mov byte [ebp - 0x5e04], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x2a9b]
push ebx
push ecx
mov byte [ebp - 0x2a9c], bl
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41b560
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x2a9c], cl
inc eax
cmp cl, bl
jne 0x41b560
lea edx, [ebp - 0x2a9c]
push edx
lea eax, [ebp - 0x5e04]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x5e04]
push ecx
lea edx, [ebp - 0x2a9c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41b5ee
lea eax, [ebp - 0x5e04]
push eax
lea ecx, [ebp - 0x2a9c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41b5e1
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41b5ee
lea edx, [ebp - 0x2a9c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e8e0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [ebp - 0x100d0], 0x1000
mov dword [ebp - 4], 0x44
jne 0x41baea
cmp dword [ebp - 0x100c8], 0x20
jne 0x41baea
cmp dword [ebp - 0x100d4], 0x80
jne 0x41baea
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41baea
push str.0x1000
call fcn.004073f0
push 0x150
lea ecx, [ebp - 0x8858]
push ebx
push ecx
mov dword [ebp - 0x1010c], ebx
call fcn.0042e2e0
mov edi, dword [ebp - 0x100c0]
mov ecx, dword [ebp - 0x100b8]
add esp, 0x10
lea edx, [ebp - 0x1010c]
push edx
push 7
lea eax, [ebp - 0x4e0]
push eax
push edi
push ecx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], ebx
mov word [ebp - 0x4d8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x4e0]
cmp edx, dword [ebp - 0xe0]
jne 0x41baea
mov al, byte [ebp - 0xdc]
cmp al, byte [ebp - 0x4dc]
jne 0x41baea
push str.match_5_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x100b8]
add esp, 4
lea ecx, [ebp - 0x1010c]
push ecx
push 0x150
lea edx, [ebp - 0x8858]
push edx
add edi, 0xbb0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8858]
test ecx, ecx
je 0x41baea
cmp dword [ebp - 0x1010c], 0x150
jne 0x41baea
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x21
push 0x150
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8858]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41baea
push str.match_33_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41baea
push str.Sig_found_and_suspend_
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xc07]
push ebx
push eax
mov byte [ebp - 0xc08], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xc08]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4HRM.02112017.2
push str.NPAV4HRM.02112017.2
lea eax, [ebp - 0xc08]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x794f]
push ebx
push ecx
mov byte [ebp - 0x7950], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7950]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x7950]
push str.WORM.HRM.02112017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41b935
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7950]
mov edx, 0x469f12
jmp 0x41b8b0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b8b0
mov eax, dword [str.WORM.HRM.02112017.2]
mov ecx, dword [0x45cf44]
mov edx, dword [0x45cf48]
mov dword [0x46a03e], eax
mov eax, dword [0x45cf4c]
mov dword [0x46a042], ecx
mov ecx, dword [0x45cf50]
mov dword [0x46a046], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04a], eax
mov al, byte [0x45ca1c]
mov dword [0x46a04e], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x100b0]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41b9e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, dword [str.WORM.HRM.02112017.2]
mov edx, dword [0x45cf44]
mov eax, dword [0x45cf48]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45cf4c]
mov dword [0x46f73c], edx
mov edx, dword [0x45cf50]
push ebx
push 0x46f978
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b9b0
cmp dword [0x470144], ebx
je 0x41b9e0
lea eax, [ebp - 0x1017c]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [ebp - 0x7033]
push ebx
push ecx
mov byte [ebp - 0x7034], bl
call fcn.0042e2e0
push 0xff
lea edx, [ebp - 0x2c9b]
push ebx
push edx
mov byte [ebp - 0x2c9c], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41bab5
lea edx, [ebp - 0x2c9c]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41ba30
lea ecx, [ebp - 0x2c9c]
push ecx
lea edx, [ebp - 0x7034]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0xc
push 1
lea eax, [ebp - 0x7034]
push eax
lea ecx, [ebp - 0x2c9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41bab5
lea edx, [ebp - 0x7034]
push edx
lea eax, [ebp - 0x2c9c]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41baa8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41bab5
lea ecx, [ebp - 0x2c9c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e8e0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [ebp - 0x100d0], 0x5000
mov dword [ebp - 4], 0x46
jne 0x41bfa2
cmp dword [ebp - 0x100c8], 0x20
jne 0x41bfa2
cmp dword [ebp - 0x100d4], 0x80
jne 0x41bfa2
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41bfa2
push str.0x5000
call fcn.004073f0
push 0x150
lea eax, [ebp - 0x8404]
push ebx
push eax
mov dword [ebp - 0x10108], ebx
call fcn.0042e2e0
mov edi, dword [ebp - 0x100c0]
mov eax, dword [ebp - 0x100b8]
add esp, 0x10
lea ecx, [ebp - 0x10108]
push ecx
push 9
lea edx, [ebp - 0x478]
push edx
push edi
push eax
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov word [ebp - 0x470], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp - 0x60]
jne 0x41bfa2
mov dl, byte [ebp - 0x5c]
cmp dl, byte [ebp - 0x474]
jne 0x41bfa2
mov al, byte [ebp - 0x5b]
cmp al, byte [ebp - 0x473]
jne 0x41bfa2
mov cl, byte [ebp - 0x5a]
cmp cl, byte [ebp - 0x472]
jne 0x41bfa2
push str.match_7_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x100b8]
add esp, 4
lea edx, [ebp - 0x10108]
push edx
push 0x150
lea eax, [ebp - 0x8404]
push eax
add edi, 0x48b0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8404]
test edx, edx
je 0x41bfa2
cmp dword [ebp - 0x10108], 0x150
jne 0x41bfa2
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x150
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x8404]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41bfa2
push 9
push 0x150
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x83fa]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41bfa2
push 8
push 0x150
lea ecx, [ebp - 0x14c]
push ecx
lea edx, [ebp - 0x83f4]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41bfa2
push str.match_33_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41bfa2
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc6f]
push ebx
push edx
mov byte [ebp - 0xc70], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc70]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4ZEPFOD.NPAV4.29112017.1
push str.NPAV4ZEPFOD.NPAV4.29112017.1
lea edx, [ebp - 0xc70]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7b57]
push ebx
push eax
mov byte [ebp - 0x7b58], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7b58]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x7b58]
push str.WORM.ZEPFOD.NPAV4.29112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41be2f
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7b58]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41bdd6
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41beb0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41be80
cmp dword [0x470144], ebx
je 0x41beb0
lea ecx, [ebp - 0x101d4]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x6007]
push ebx
push edx
mov byte [ebp - 0x6008], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x11d3]
push ebx
push eax
mov byte [ebp - 0x11d4], bl
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41bf94
lea edx, [ebp - 0x11d4]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41bf02
lea edx, [ebp - 0x11d4]
push edx
lea eax, [ebp - 0x6008]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x6008]
push ecx
lea edx, [ebp - 0x11d4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41bf87
lea eax, [ebp - 0x6008]
push eax
lea ecx, [ebp - 0x11d4]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41bf7a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41bf87
lea edx, [ebp - 0x11d4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x11d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
cmp dword [ebp - 0x100d0], 0x8000
mov dword [ebp - 4], 0x48
jne 0x41c463
cmp dword [ebp - 0x100c8], 0x20
jne 0x41c463
cmp dword [ebp - 0x100d4], 0x80
jne 0x41c463
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41c463
push str.0x8000
call fcn.004073f0
push 0x150
lea edx, [ebp - 0x82b4]
push ebx
push edx
mov dword [ebp - 0x100fc], ebx
call fcn.0042e2e0
mov edi, dword [ebp - 0x100c0]
mov edx, dword [ebp - 0x100b8]
add esp, 0x10
lea eax, [ebp - 0x100fc]
push eax
push 9
lea ecx, [ebp - 0x484]
push ecx
push edi
push edx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
mov word [ebp - 0x47c], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x70]
jne 0x41c463
mov cl, byte [ebp - 0x6c]
cmp cl, byte [ebp - 0x480]
jne 0x41c463
mov dl, byte [ebp - 0x6b]
cmp dl, byte [ebp - 0x47f]
jne 0x41c463
mov al, byte [ebp - 0x6a]
cmp al, byte [ebp - 0x47e]
jne 0x41c463
push str.match_7_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x100b8]
add esp, 4
lea ecx, [ebp - 0x100fc]
push ecx
push 0x150
lea edx, [ebp - 0x82b4]
push edx
add edi, 0x7bc0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x82b4]
test ecx, ecx
je 0x41c463
cmp dword [ebp - 0x100fc], 0x150
jne 0x41c463
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x13
push 0x150
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x82b4]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c463
push 0xc
push 0x150
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x82a1]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c463
push 7
push 0x150
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x829b]
push ecx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c463
push str.match_33_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x100bc]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41c463
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xcd7]
push ebx
push edx
mov byte [ebp - 0xcd8], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xcd8]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4ZEPFOD.NPAV4.29112017.2
push str.NPAV4ZEPFOD.NPAV4.29112017.2
lea edx, [ebp - 0xcd8]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7d5b]
push ebx
push eax
mov byte [ebp - 0x7d5c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7d5c]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x7d5c]
push str.WORM.ZEPFOD.NPAV4.29112017.2
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c2e9
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x7d5c]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c290
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41c370
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x41c340
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41c340
cmp dword [0x470144], ebx
je 0x41c370
lea ecx, [ebp - 0x101dc]
push ecx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x805f]
push ebx
push edx
mov byte [ebp - 0x8060], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x12d3]
push ebx
push eax
mov byte [ebp - 0x12d4], bl
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41c455
lea edx, [ebp - 0x12d4]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41c3c2
lea edx, [ebp - 0x12d4]
push edx
lea eax, [ebp - 0x8060]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x8060]
push ecx
lea edx, [ebp - 0x12d4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c448
lea eax, [ebp - 0x8060]
push eax
lea ecx, [ebp - 0x12d4]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41c43b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c448
lea edx, [ebp - 0x12d4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x12d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x100d0], 0x3d000
mov esi, dword [ebp - 0x100b0]
jb 0x41c8d4
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
jne 0x41c8d4
cmp dword [ebp - 0x100d4], eax
jne 0x41c8d4
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41ced4
push str.0X3D000_0X3E000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0x100ac]
push ebx
push edx
call fcn.0042e2e0
mov edx, dword [ebp - 0x100c0]
mov edi, dword [ebp - 0x100b8]
add esp, 0x10
lea eax, [ebp - 0x100b4]
push eax
push 0x1000
lea ecx, [ebp - 0x100ac]
push ecx
add edx, 0x3d30
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x100b4], 0x1000
jne 0x41c8d4
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x100ac]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c8d4
mov edx, dword [ebp - 0x100bc]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x100ac]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c8d4
push str.match_12_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0x4a
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x657]
push ebx
push eax
mov byte [ebp - 0x658], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x658]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4COMBO.NPAV4.21092018
push 0x45ce68
lea eax, [ebp - 0x658]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x50
push 0xff
lea ecx, [ebp - 0x39af]
push ebx
push ecx
mov byte [ebp - 0x39b0], bl
call fcn.0042e2e0
push 0xff
lea edx, [ebp - 0x2e9b]
push ebx
push edx
mov byte [ebp - 0x2e9c], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
call fcn.0040e750
add esp, 0x1c
cmp eax, ebx
je 0x41c6e8
mov ecx, eax
lea edx, [ebp - 0x2e9c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c673
lea ecx, [ebp - 0x2e9c]
push ecx
lea edx, [ebp - 0x39b0]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0xc
push 1
lea eax, [ebp - 0x39b0]
push eax
lea ecx, [ebp - 0x2e9c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c6e8
lea edx, [ebp - 0x39b0]
push edx
lea eax, [ebp - 0x2e9c]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41c6db
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c6e8
lea ecx, [ebp - 0x2e9c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x44cf]
push ebx
push edx
mov byte [ebp - 0x44d0], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x44d0]
push str._s__d
push edx
call fcn.0042e476
lea eax, [ebp - 0x44d0]
push str.WORM.COMBO.NPAV4.21092018
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c7c0
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x44d0]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c763
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.COMBO.NPAV4.21092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x41c838
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, 0x45ce30
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c810
cmp dword [0x470144], ebx
je 0x41c838
lea eax, [ebp - 0x101b8]
push eax
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
lea ecx, [ebp - 0x434]
mov esi, 1
push ecx
mov dword [0x470154], esi
mov dword [0x470164], esi
call fcn.0040eb30
mov eax, dword [0x470174]
add esp, 8
cmp eax, ebx
je 0x41c875
push 0xd3d
call eax
add esp, 4
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x41c8cd
push 0x45ce30
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x39b0]
push edx
lea ecx, [ebp - 0x658]
push ecx
lea edx, [ebp - 0x44d0]
push edx
push esi
call eax
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x100c4], 0x20000
jne 0x41ced4
cmp dword [ebp - 0x100d0], 0x50000
jb 0x41ced4
push str.RWE_AND_RW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x41ced4
cmp dword [ebp - 0x100d4], 4
jne 0x41ced4
push 0x1000
lea eax, [ebp - 0xd34c]
push ebx
push eax
mov byte [ebp - 0x100e1], bl
call fcn.0042e2e0
mov esi, dword [ebp - 0x100c0]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
lea ecx, [ebp - 0x100b4]
push ecx
mov ecx, dword [ebp - 0x100b8]
push 0x1000
lea edx, [ebp - 0xd34c]
push edx
lea eax, [esi + 0x58d00]
push eax
push ecx
call edi
jmp 0x41c970
cmp dword [ebp - 0x100b4], 0x1000
jne 0x41c9d1
push 7
push 0x1000
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0xd34c]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c9d1
mov ecx, dword [ebp - 0x100bc]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xc
push 0x1000
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0xd34c]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
je 0x41ca35
cmp byte [ebp - 0x100e1], bl
jne 0x41ced4
push 0x1000
lea ecx, [ebp - 0xd34c]
push ebx
push ecx
call fcn.0042e2e0
add esp, 0xc
lea edx, [ebp - 0x100b4]
push edx
mov edx, dword [ebp - 0x100b8]
push 0x1000
lea eax, [ebp - 0xd34c]
push eax
lea ecx, [esi + 0x51500]
push ecx
push edx
call edi
mov byte [ebp - 0x100e1], 1
jmp 0x41c970
mov eax, dword [ebp - 0x100bc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41ced4
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x46d7]
push ebx
push ecx
mov byte [ebp - 0x46d8], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x46d8]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x46d8]
push edx
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x31
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0xd3f]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
mov byte [ebp - 0xd40], bl
call fcn.0042e2e0
add esp, 0x40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xd40]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4MAYDAY.NPAV4.25082022
push str.NPAV4MAYDAY.NPAV4.25082022
lea edx, [ebp - 0xd40]
push 0x45ca48
push edx
call fcn.00407310
lea eax, [ebp - 0x46d8]
push str.WORM.MAYDAY.NPAV4.25082022
push eax
call fcn.0040a000
add esp, 0x34
cmp dword [0x46f734], ebx
je 0x41cbd5
push str.PFNADDENTRY_FOUND
call fcn.004073f0
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0x46d8]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41cb70
mov dl, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41cc10
push 0x103
lea eax, [ebp - 0x8607]
push ebx
push eax
mov byte [ebp - 0x8608], bl
call fcn.0042e2e0
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x8608]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x8608]
push ecx
call fcn.004073f0
push 0x103
lea edx, [ebp - 0x7f5f]
push ebx
push edx
mov byte [ebp - 0x7f60], bl
call fcn.0042e2e0
push 0x103
lea eax, [ebp - 0x8163]
push ebx
push eax
mov byte [ebp - 0x8164], bl
call fcn.0042e2e0
push 0x103
lea ecx, [ebp - 0x10d3]
push ebx
push ecx
mov byte [ebp - 0x10d4], bl
call fcn.0042e2e0
add esp, 0x44
push 0x103
lea edx, [ebp - 0x319f]
push ebx
push edx
mov byte [ebp - 0x31a0], bl
call fcn.0042e2e0
mov eax, dword [esi + 4]
push eax
call fcn.0040e750
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x41ce97
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41cea4
lea edx, [ebp - 0x7f60]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41cd00
lea ecx, [ebp - 0x7f60]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x10d4]
push edx
call fcn.004075a0
lea eax, [ebp - 0x10d4]
push str.ZVSCAN
push eax
call fcn.0042e840
lea eax, [ebp - 0x10d4]
add esp, 0x10
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x41cd40
mov ecx, dword [str.ECLNR.EXE]
mov edx, dword [0x45cdd0]
mov dword [eax], ecx
mov cx, word [0x45cdd4]
mov dword [eax + 4], edx
mov dl, byte [0x45cdd6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x10d4]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x7f60]
push ecx
lea edx, [ebp - 0x10d4]
push edx
push str._s__F___s_
lea eax, [ebp - 0x8164]
push 0x104
push eax
call fcn.0042e50f
lea ecx, [ebp - 0x8164]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x8164]
push edx
call fcn.00408230
mov eax, dword [0x470008]
add esp, 0x20
or eax, dword [0x47000c]
jne 0x41ce02
lea ecx, [ebp - 0x10d4]
push ecx
push str._s__A
lea edx, [ebp - 0x31a0]
push 0x104
push edx
call fcn.0042e50f
lea eax, [ebp - 0x31a0]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x31a0]
push ecx
call fcn.00408230
add esp, 0x18
jmp 0x41ce84
call fcn.004300f0
cdq
mov dword [0x470010], eax
sub eax, dword [0x470008]
push ebx
mov dword [0x470014], edx
sbb edx, dword [0x47000c]
push 0x3e8
push edx
push eax
call fcn.00430260
push ebx
push 0x3c
push edx
push eax
call fcn.00430260
push ebx
push 0x3c
push edx
push eax
call fcn.00430260
mov dword [0x470000], eax
mov dword [0x470004], edx
cmp eax, 3
jne 0x41cea4
cmp edx, ebx
jne 0x41cea4
lea edx, [ebp - 0x10d4]
push edx
push str._s__A
lea eax, [ebp - 0x31a0]
push 0x104
push eax
call fcn.0042e50f
lea ecx, [ebp - 0x31a0]
push ecx
call fcn.00408230
add esp, 0x14
call fcn.004300f0
cdq
mov dword [0x470008], eax
mov dword [0x47000c], edx
jmp 0x41cea4
push str.PATH_NOT_FOUND_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470160], ebx
jne 0x41ced4
mov dword [0x470160], 1
cmp dword [0x470144], ebx
je 0x41ced4
lea edx, [ebp - 0x1018c]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x100d0]
add eax, 0xfffe2000
cmp eax, 0xa000
ja 0x41d67e
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c8], 0x40
jne 0x41d67e
cmp dword [ebp - 0x100d4], 0x80
jne 0x41d67e
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x100c4], 0x1000000
jne 0x41d67e
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
mov edi, 0x64
push edi
lea ecx, [ebp - 0x139c]
push ebx
push ecx
mov dword [ebp - 0x100b4], ebx
call fcn.0042e2e0
mov ecx, dword [ebp - 0x100b8]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0x14
lea edx, [ebp - 0x100b4]
push edx
push edi
lea eax, [ebp - 0x139c]
push eax
push 0x40e530
push ecx
call esi
cmp dword [ebp - 0x100b4], edi
jne 0x41d67e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xc
push edi
lea edx, [ebp - 0x1d4]
push edx
lea eax, [ebp - 0x139c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d2ce
push str.match_12_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x100bc]
add esp, 8
push ecx
mov dword [ebp - 4], 0x4c
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x100b0]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x6bf]
push ebx
push eax
mov byte [ebp - 0x6c0], bl
call fcn.0042e2e0
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6c0]
push str.NPAV4_s
push edx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea eax, [ebp - 0x6c0]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x48db]
push ebx
push ecx
mov byte [ebp - 0x48dc], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x48dc]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [ebp - 0x48dc]
push str.WORM.SAVEFILES.NPAV4.26092018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x41c3]
push ebx
push eax
mov byte [ebp - 0x41c4], bl
call fcn.0042e2e0
push 0xff
lea ecx, [ebp - 0x309b]
push ebx
push ecx
mov byte [ebp - 0x309c], bl
call fcn.0042e2e0
mov edx, dword [esi + 4]
push edx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x41d187
lea edx, [ebp - 0x309c]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d112
lea eax, [ebp - 0x309c]
push eax
lea ecx, [ebp - 0x41c4]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [ebp - 0x41c4]
push edx
lea eax, [ebp - 0x309c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d187
lea ecx, [ebp - 0x41c4]
push ecx
lea edx, [ebp - 0x309c]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41d17a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d187
lea eax, [ebp - 0x309c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x100b8]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d21a
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x48dc]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d1c0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d24e
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x41c4]
push ecx
lea edx, [ebp - 0x6c0]
push edx
lea ecx, [ebp - 0x48dc]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d648
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x41d2a0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d2a0
cmp dword [0x470144], ebx
je 0x41d648
lea edx, [ebp - 0x10194]
jmp 0x41d638
push edi
lea eax, [ebp - 0x1338]
push ebx
push eax
call fcn.0042e2e0
mov eax, dword [ebp - 0x100b8]
add esp, 0xc
lea ecx, [ebp - 0x100b4]
push ecx
push edi
lea edx, [ebp - 0x1338]
push edx
push 0x40f3b5
push eax
call esi
cmp dword [ebp - 0x100b4], edi
jne 0x41d67e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xb
push edi
lea ecx, [ebp - 0x1b0]
push ecx
lea edx, [ebp - 0x1338]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d67e
push str.match_11_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x100bc]
add esp, 8
push eax
mov dword [ebp - 4], 0x4e
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x100b0]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042e2e0
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x727]
push ebx
push edx
mov byte [ebp - 0x728], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x728]
push str.NPAV4_s
push ecx
call fcn.0042e476
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea edx, [ebp - 0x728]
push 0x45ca48
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x43cb]
push ebx
push eax
mov byte [ebp - 0x43cc], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x43cc]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [ebp - 0x43cc]
push str.WORM.SAVEFILES.NPAV4.26092018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x3bb3]
push ebx
push edx
mov byte [ebp - 0x3bb4], bl
call fcn.0042e2e0
push 0xff
lea eax, [ebp - 0x179b]
push ebx
push eax
mov byte [ebp - 0x179c], bl
call fcn.0042e2e0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e750
add esp, 0x40
cmp eax, ebx
je 0x41d505
lea edx, [ebp - 0x179c]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d490
lea edx, [ebp - 0x179c]
push edx
lea eax, [ebp - 0x3bb4]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [ebp - 0x3bb4]
push ecx
lea edx, [ebp - 0x179c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d505
lea eax, [ebp - 0x3bb4]
push eax
lea ecx, [ebp - 0x179c]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x41d4f8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d505
lea edx, [ebp - 0x179c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x100b8]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d59c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
lea ecx, [ebp - 0x43cc]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d540
mov dl, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d5d0
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3bb4]
push ecx
lea edx, [ebp - 0x728]
push edx
lea ecx, [ebp - 0x43cc]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d648
push 0x104
push ebx
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d620
cmp dword [0x470144], ebx
je 0x41d648
lea edx, [ebp - 0x1019c]
push edx
push ebx
push ebx
push 0x40e710
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x41d677
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x100c4], 0x40000
jne 0x41d987
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x41d6a7
cmp dword [ebp - 0x100d4], eax
jne 0x41d987
cmp dword [ebp - 0x100d0], 0x2000
jb 0x41d987
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042e2e0
mov edi, dword [ebp - 0x100b0]
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
jmp 0x41d6f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41d6f0
sub eax, edx
je 0x41d98d
lea eax, [ebp - 0x434]
push str.RUNDLL32.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x41d733
lea ecx, [ebp - 0x434]
push str.SVCHOST.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x41d98d
push 0x7ff
lea edx, [ebp - 0xb34b]
push ebx
push edx
mov byte [ebp - 0xb34c], bl
call fcn.0042e2e0
push 0x7ff
lea eax, [ebp - 0xbb4b]
push ebx
push eax
mov byte [ebp - 0xbb4c], bl
call fcn.0042e2e0
push 0x7ff
lea ecx, [ebp - 0xc34b]
push ebx
push ecx
mov byte [ebp - 0xc34c], bl
call fcn.0042e2e0
mov edx, dword [edi + 4]
add esp, 0x24
push edx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x41d7b7
lea eax, [ebp - 0xb34c]
push eax
push esi
call fcn.0040f8b0
add esp, 8
push 0x200
lea ecx, [ebp - 0xc34c]
push ecx
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea edx, [ebp - 0xb34c]
push edx
lea eax, [ebp - 0xbb4c]
push 0x800
push eax
call fcn.00430055
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [edi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042e476
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [0x470164], 1
call fcn.0042e2e0
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x103
lea eax, [ebp - 0x7443]
push ebx
push eax
mov byte [ebp - 0x7444], bl
call fcn.0042e2e0
mov ecx, dword [edi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7444]
push str._s__d
push eax
call fcn.0042e476
mov ecx, dword [edi + 4]
mov eax, dword [0x46ff94]
add esp, 0x48
push 0x31
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0xb6b]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
mov byte [ebp - 0xb6c], bl
call fcn.0042e2e0
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb6c]
push str.NPAV4_s
push ecx
call fcn.0042e476
add esp, 0x18
cmp dword [0x470158], ebx
jne 0x41d98d
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d8d5
push str.AUD.RUND_SVCH.NPAV4.22122022
lea edx, [ebp - 0xbb4c]
push edx
push 0x45c58c
lea ecx, [ebp - 0xc34c]
push ecx
lea edx, [ebp - 0xb6c]
push edx
lea ecx, [ebp - 0x7444]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x46f734], ebx
je 0x41d967
push 0x1e0
push ebx
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x41d900
mov cl, byte [ebp + eax - 0x7444]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41d900
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.AUD.RUND_SVCH.NPAV4.22122022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x100b0]
add esp, 0x1e0
mov dword [0x470158], 1
jmp 0x41d98d
mov edi, dword [ebp - 0x100b0]
cmp dword [0x470164], ebx
jne 0x41dacc
mov eax, 0x40
cmp dword [ebp - 0x100c8], eax
je 0x41d9b2
cmp dword [ebp - 0x100d4], eax
jne 0x41dacc
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41dacc
cmp eax, 4
je 0x41dacc
cmp dword [0x467218], eax
je 0x41dacc
cmp dword [0x46721c], eax
je 0x41dacc
cmp dword [0x467220], eax
je 0x41dacc
cmp dword [0x467224], eax
je 0x41dacc
cmp dword [0x470140], 1
jne 0x41dacc
cmp dword [0x47012c], ebx
jne 0x41dacc
mov eax, dword [ebp - 0x100c0]
mov esi, dword [ebp - 0x100b8]
lea ecx, [ebp - 0x100b4]
push ecx
push 0xa
lea edx, [ebp - 0x504]
push edx
push eax
push esi
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x500], ebx
mov word [ebp - 0x4fc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 0x504], bl
je 0x41dad2
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x564], ebx
mov word [ebp - 0x560], bx
mov ecx, dword [edi + 4]
push ecx
lea edx, [ebp - 0x57c]
push str.pid__d_
push edx
call fcn.0042e476
push str.Orange_thread_found_in_process__n
call fcn.004073f0
lea eax, [ebp - 0x57c]
push eax
call fcn.004073f0
push str.Calling_td.exe...
call fcn.004073f0
add esp, 0x18
call fcn.00408150
mov dword [0x47012c], 1
jmp 0x41dad2
mov esi, dword [ebp - 0x100b8]
mov eax, dword [ebp - 0x100bc]
cmp eax, ebx
je 0x41dae3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x41daee
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10138]
jmp 0x41daff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042e2c5
mov esp, ebp
pop ebp
ret