Function at 0x632454a0
Capabilities:
Create thread
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x118], ecx
mov eax, 1
test eax, eax
je 0x632454c4
jmp 0x632454d1
push str.StartXGuard___START
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 1
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
test ecx, ecx
je 0x632454ee
jmp 0x632454fb
push str.Check_Bypass
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce40
call fcn.6323a150
push 0x6324e8a4
push 0x87
push 0x6324e8ac
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242320
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.6320feb0
add esp, 0xc
push str.npxgb.zip
push 0x6325ce40
push 0x6324e8c4
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.6320fb38
add esp, 0x14
push 0x6324b953
push 0x6325ce40
lea ecx, [ebp - 0x110]
push ecx
mov ecx, 0x6325ce40
call fcn.63239d20
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x632455ad
push 4
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x6325cf44
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63243d90
cmp eax, 1
je 0x63245600
mov ecx, 1
test ecx, ecx
je 0x632455d3
jmp 0x632455e0
push str._ERROR_:_NPXGERROR_APP_DETACHFILEINFO_FAIL
call fcn.63201050
add esp, 4
mov ecx, 0x6325d9e8
call fcn.63237e90
push 0x6325cf44
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63243d90
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242da0
push 0x6325d8b4
call fcn.63238d20
mov ecx, eax
call fcn.63238bf0
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx], 0
push 0x6324b95e
call fcn.63238d20
mov eax, dword [eax]
add eax, 4
push eax
call fcn.6320fabd
add esp, 8
push 0x6324b95f
call fcn.63238d20
mov ecx, dword [eax]
add ecx, 0x10c
push ecx
call fcn.6320fabd
add esp, 8
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx + 0x108], 0x1001
push 0x6325d8b4
mov ecx, 0x6325ce40
call fcn.63239e00
push 0x6325d8b4
mov ecx, 0x6325ce40
call fcn.63239890
mov ecx, 0x6325ce40
call fcn.63239580
cmp eax, 1
jne 0x632456ac
push 1
mov ecx, 0x6325ce40
call fcn.63239380
mov ecx, 0x6325d9c0
call fcn.632385e0
test eax, eax
jne 0x632456f8
mov eax, 1
test eax, eax
je 0x632456c5
jmp 0x632456d2
push str.Begine_Thread_UpdateModules
call fcn.63201050
add esp, 4
push 0
push 0
push 0x6325d9e8
push 0x63238080
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xe6c], eax
mov ecx, 0x6325ce40
call fcn.632393e0
test eax, eax
jne 0x63245748
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63244670
cmp eax, 1
je 0x63245748
mov edx, 1
test edx, edx
je 0x63245727
jmp 0x63245734
push str._ERROR_:_NPXGERROR_APP_VERIFYFILE_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 0x104
jmp 0x63245b5a
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x780]
push ecx
push 0x6325cf44
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242d00
cmp eax, 1
je 0x6324579c
mov edx, 1
test edx, edx
je 0x6324577b
jmp 0x63245788
push str._ERROR_:_NPXGERROR_APP_DETACHCLIENT_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], pe_nt_image_headers32
jmp 0x63245b5a
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242490
cmp eax, 3
jne 0x632457d6
mov eax, 1
test eax, eax
je 0x632457bd
jmp 0x632457ca
push str.Execute_File
call fcn.63201050
add esp, 4
push 1
mov ecx, 0x6325ce40
call fcn.63239380
mov ecx, 0x6325ce40
call fcn.63239100
cmp eax, 1
jne 0x63245812
mov ecx, 1
test ecx, ecx
je 0x632457f0
jmp 0x632457fd
push str.GetCheckUpdateMode_:_TRUE
call fcn.63201050
add esp, 4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xe6c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x6325d8b4
mov ecx, 0x6325ce40
call fcn.63239060
mov ecx, 0x6325ce40
call fcn.632395d0
test eax, eax
jne 0x632458dc
mov ecx, 0x6325ce40
call fcn.632393c0
test eax, eax
jne 0x632458dc
call fcn.63201040
mov ecx, dword [eax + 0x48]
push ecx
push 0x6325cf44
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x780]
push eax
mov ecx, dword [ebp - 0x118]
add ecx, 0xe5c
call fcn.63241f50
cmp eax, 1
je 0x632458a2
mov ecx, 1
test ecx, ecx
je 0x63245881
jmp 0x6324588e
push str._ERROR_:_NPXGERROR_APP_DYNAMICFORKING_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 0x101
jmp 0x63245b5a
push 0x1f4
mov edx, dword [0x6325d494]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x632458dc
mov eax, 1
test eax, eax
je 0x632458c3
jmp 0x632458d0
push str._ERROR_WaitForSingleObject_WAIT_OBJECT_0
call fcn.63201050
add esp, 4
push 1
mov ecx, 0x6325ce40
call fcn.63239380
mov ecx, 0x6325ce40
call fcn.632395d0
cmp eax, 1
je 0x632458fe
mov ecx, 0x6325ce40
call fcn.632393c0
cmp eax, 1
jne 0x632459f3
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x780]
push edx
mov ecx, dword [ebp - 0x118]
add ecx, 0xe5c
call fcn.63242140
cmp eax, 1
je 0x63245985
mov eax, 1
test eax, eax
je 0x6324592c
jmp 0x63245939
push str._ERROR_:_NPXGERROR_DF_WIN98_FAIL
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce40
call fcn.63239160
cmp eax, 1
jne 0x6324597b
push 0
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x780]
push edx
mov ecx, dword [ebp - 0x118]
add ecx, 0xe5c
call fcn.632411a0
cmp eax, 0x301
je 0x63245979
mov dword [ebp - 0x114], 0x300
jmp 0x63245985
mov dword [ebp - 0x114], 0x300
push 0x1f4
mov eax, dword [0x6325d494]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x632459f3
mov ecx, 1
test ecx, ecx
je 0x632459a5
jmp 0x632459b2
push str._Update_Execute_File
call fcn.63201050
add esp, 4
push 0
push str.nProtect_X_Guard
push 0x6325d7b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x6325d8b4
mov ecx, 0x6325ce40
call fcn.632396d0
mov ecx, 0x6325d9e8
call fcn.63237c70
mov dword [ebp - 0x114], 0x302
jmp 0x63245b5a
mov edx, 1
test edx, edx
je 0x632459fe
jmp 0x63245a0b
push str.Begine_Thread_Check_Process_invalide
call fcn.63201050
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x118]
push eax
push 0x632450a0
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xe70], eax
mov edx, 1
test edx, edx
je 0x63245a3e
jmp 0x63245a4b
push str.Begine_Thread_Check_Process
call fcn.63201050
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x118]
add eax, 0xe5c
push eax
push fcn.63240ff0
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x784], eax
mov ecx, 0x6325ce40
call fcn.632395d0
test eax, eax
jne 0x63245b5a
mov ecx, 0x6325ce40
call fcn.632393a0
test eax, eax
jne 0x63245b49
mov edx, 1
test edx, edx
je 0x63245aa7
jmp 0x63245ab4
push str.MemGuard_Start
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce40
call fcn.63239100
test eax, eax
jne 0x63245aef
mov eax, 1
test eax, eax
je 0x63245acd
jmp 0x63245ada
push str.GetCheckUpdateMode_:_FLASE
call fcn.63201050
add esp, 4
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0xe6c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x6325d9c0
call fcn.632388e0
mov ecx, 0x6325d9c0
call fcn.632387c0
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.632430f0
mov ecx, 0x6325d9c0
call fcn.63238550
cmp eax, 1
jne 0x63245b36
call fcn.63238d20
mov eax, dword [eax]
mov dword [eax + 0x108], 0x1002
jmp 0x63245b47
call fcn.63238d20
mov ecx, dword [eax]
mov dword [ecx + 0x108], 0x1000
jmp 0x63245b5a
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx + 0x108], 0x1003
mov eax, 1
test eax, eax
je 0x63245b65
jmp 0x63245b72
push str.StartXGuard___END
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret