Function at 0x4108d0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Get common file path
Move file
Set registry value
Suspend thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459df0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10388
call fcn.00430990
mov eax, dword [0x468004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x555b]
push ebx
push eax
mov dword [ebp - 0x10218], esi
mov dword [ebp - 0x1029c], ebx
mov byte [ebp - 0x555c], bl
call fcn.0042ea40
push 0x103
lea ecx, [ebp - 0x575f]
push ebx
push ecx
mov byte [ebp - 0x5760], bl
call fcn.0042ea40
push 0x103
lea edx, [ebp - 0xedf]
push ebx
push edx
mov byte [ebp - 0xee0], bl
call fcn.0042ea40
push 0x103
lea eax, [ebp - 0x3813]
push ebx
push eax
mov byte [ebp - 0x3814], bl
call fcn.0042ea40
mov al, 0x5d
mov dl, 0x74
mov cl, 0x61
add esp, 0x30
mov byte [ebp - 0x10250], 0x55
mov byte [ebp - 0x1024f], 0x89
mov byte [ebp - 0x1024c], 0x55
mov byte [ebp - 0x1024b], 0x8b
mov byte [ebp - 0x1025c], 0x51
mov byte [ebp - 0x1025b], 0x83
mov byte [ebp - 0x10260], 0x6a
mov byte [ebp - 0x1025f], bl
mov byte [ebp - 0x1e0], 0x72
mov byte [ebp - 0x1df], 0x6d
mov byte [ebp - 0x1de], 0x6e
mov byte [ebp - 0x1dd], 0x73
mov byte [ebp - 0x1dc], 0x6f
mov byte [ebp - 0x1db], 0x66
mov byte [ebp - 0x1da], dl
mov byte [ebp - 0x1d9], 0x2e
mov byte [ebp - 0x1d8], 0x64
mov byte [ebp - 0x1d7], 0x6c
mov byte [ebp - 0x1d6], 0x6c
mov byte [ebp - 0x1d5], bl
mov byte [ebp - 0x88], 0xe8
mov byte [ebp - 0x87], bl
mov byte [ebp - 0x86], bl
mov byte [ebp - 0x85], bl
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], al
mov byte [ebp - 0x82], 0x81
mov byte [ebp - 0x58], 0xe8
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x8b
mov byte [ebp - 0x98], 0xc8
mov byte [ebp - 0x97], bl
mov byte [ebp - 0x96], bl
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x94], 0x8b
mov byte [ebp - 0x93], 0x6d
mov byte [ebp - 0x92], 8
mov byte [ebp - 0x10254], 0x55
mov byte [ebp - 0x10253], 0x8b
mov byte [ebp - 0x10252], 0xec
mov byte [ebp - 0x124], cl
mov byte [ebp - 0x123], bl
mov byte [ebp - 0x122], 0x76
mov byte [ebp - 0x121], bl
mov byte [ebp - 0x120], 0x70
mov al, 0x65
mov byte [ebp - 0x11f], bl
mov byte [ebp - 0x11e], 0x2e
mov byte [ebp - 0x11d], bl
mov byte [ebp - 0x11c], al
mov byte [ebp - 0x11b], bl
mov byte [ebp - 0x11a], 0x78
mov byte [ebp - 0x119], bl
mov byte [ebp - 0x118], al
mov byte [ebp - 0x160], cl
mov byte [ebp - 0x15f], bl
mov byte [ebp - 0x15e], 0x76
mov byte [ebp - 0x15d], bl
mov byte [ebp - 0x15c], 0x69
mov byte [ebp - 0x15b], bl
mov byte [ebp - 0x15a], 0x72
mov byte [ebp - 0x159], bl
mov byte [ebp - 0x158], cl
mov byte [ebp - 0x157], bl
mov byte [ebp - 0x156], 0x2e
mov byte [ebp - 0x155], bl
mov byte [ebp - 0x154], 0x63
mov byte [ebp - 0x153], bl
mov byte [ebp - 0x152], 0x6f
mov byte [ebp - 0x151], bl
mov byte [ebp - 0x150], 0x6d
mov byte [ebp - 0x10258], 0x55
mov byte [ebp - 0x10257], 0x8b
mov byte [ebp - 0x10256], 0xec
mov byte [ebp - 0xe8], 0x8b
mov byte [ebp - 0xe7], 0xff
mov byte [ebp - 0xe6], 0x55
mov byte [ebp - 0xe5], 0x8b
mov byte [ebp - 0xe4], 0xec
mov byte [ebp - 0x2c0], 0x73
mov byte [ebp - 0x2bf], bl
mov byte [ebp - 0x2be], 0x68
mov byte [ebp - 0x2bd], bl
mov byte [ebp - 0x2bc], al
mov byte [ebp - 0x2bb], bl
mov byte [ebp - 0x2ba], 0x6c
mov byte [ebp - 0x2b9], bl
mov byte [ebp - 0x2b8], 0x6c
mov byte [ebp - 0x2b7], bl
mov byte [ebp - 0x2b6], 0x2e
mov byte [ebp - 0x2b5], bl
mov byte [ebp - 0x2b4], 0x7b
mov byte [ebp - 0x2b3], bl
mov byte [ebp - 0x2b2], 0x31
mov byte [ebp - 0x2b1], bl
mov byte [ebp - 0x2b0], 0x37
mov byte [ebp - 0x2af], bl
mov byte [ebp - 0x2ae], 0x45
mov byte [ebp - 0x2ad], bl
mov byte [ebp - 0x2ac], 0x33
mov byte [ebp - 0x2ab], bl
mov byte [ebp - 0x2aa], 0x30
mov byte [ebp - 0x2a9], bl
mov byte [ebp - 0x2a8], 0x31
mov byte [ebp - 0x2a7], bl
mov byte [ebp - 0x2a6], 0x46
mov byte [ebp - 0x2a5], bl
mov byte [ebp - 0x2a4], 0x35
mov byte [ebp - 0x2a3], bl
mov byte [ebp - 0x2a2], 0x2d
mov byte [ebp - 0x2a1], bl
mov byte [ebp - 0x2a0], 0x32
mov byte [ebp - 0x29f], bl
mov byte [ebp - 0x29e], 0x33
mov byte [ebp - 0x29d], bl
mov byte [ebp - 0x29c], 0x43
mov byte [ebp - 0x29b], bl
mov byte [ebp - 0x29a], 0x35
mov byte [ebp - 0x299], bl
mov byte [ebp - 0x298], 0x2d
mov byte [ebp - 0x297], bl
mov byte [ebp - 0x296], 0x43
mov byte [ebp - 0x295], bl
mov byte [ebp - 0x294], 0x45
mov byte [ebp - 0x293], bl
mov byte [ebp - 0x292], 0x30
mov byte [ebp - 0x291], bl
mov byte [ebp - 0x290], 0x30
mov byte [ebp - 0x28f], bl
mov byte [ebp - 0x28e], 0x2d
mov byte [ebp - 0x28d], bl
mov byte [ebp - 0x28c], 0x41
mov byte [ebp - 0x28b], bl
mov byte [ebp - 0x28a], 0x36
mov byte [ebp - 0x289], bl
mov byte [ebp - 0x288], 0x38
mov byte [ebp - 0x287], bl
mov byte [ebp - 0x286], 0x43
mov byte [ebp - 0x285], bl
mov byte [ebp - 0x284], 0x2d
mov byte [ebp - 0x283], bl
mov byte [ebp - 0x282], 0x36
mov byte [ebp - 0x281], bl
mov byte [ebp - 0x280], 0x46
mov byte [ebp - 0x27f], bl
mov byte [ebp - 0x27e], 0x39
mov byte [ebp - 0x27d], bl
mov byte [ebp - 0x27c], 0x34
mov byte [ebp - 0x27b], bl
mov byte [ebp - 0x27a], 0x41
mov byte [ebp - 0x279], bl
mov byte [ebp - 0x278], 0x41
mov byte [ebp - 0x277], bl
mov byte [ebp - 0x276], 0x36
mov byte [ebp - 0x275], bl
mov byte [ebp - 0x274], 0x38
mov byte [ebp - 0x273], bl
mov byte [ebp - 0x272], 0x35
mov byte [ebp - 0x271], bl
mov byte [ebp - 0x270], 0x32
mov byte [ebp - 0x26f], bl
mov byte [ebp - 0x26e], 0x35
mov byte [ebp - 0x26d], bl
mov byte [ebp - 0x26c], 0x44
mov byte [ebp - 0x26b], bl
mov byte [ebp - 0x26a], 0x7d
mov byte [ebp - 0xa8], 0x55
mov byte [ebp - 0xa7], 0x8b
mov byte [ebp - 0xa6], 0xec
mov byte [ebp - 0xa5], 0x6a
mov byte [ebp - 0xa4], 0xff
mov byte [ebp - 0xa3], 0x68
mov byte [ebp - 0xa2], 0xb0
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x6c
mov byte [ebp - 0x196], 0x6f
mov byte [ebp - 0x195], 0x62
mov byte [ebp - 0x194], cl
mov byte [ebp - 0x193], 0x6c
mov byte [ebp - 0x192], 0x5c
mov byte [ebp - 0x191], 0x53
mov byte [ebp - 0x190], 0x59
mov byte [ebp - 0x18f], 0x53
mov byte [ebp - 0x18e], 0x5f
mov byte [ebp - 0x18d], 0x45
mov byte [ebp - 0x18c], 0x30
mov byte [ebp - 0x18b], 0x41
mov byte [ebp - 0x18a], 0x39
mov byte [ebp - 0x189], 0x31
mov byte [ebp - 0x188], 0x33
mov byte [ebp - 0x187], 0x38
mov byte [ebp - 0x50], 0x5c
mov byte [ebp - 0x4f], 0x63
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x79
mov byte [ebp - 0x4c], 0x73
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x5c
mov byte [ebp - 0xf4], 0x5c
mov byte [ebp - 0xf3], 0x70
mov byte [ebp - 0xf2], cl
mov byte [ebp - 0xf1], 0x79
mov byte [ebp - 0xf0], 0x6c
mov byte [ebp - 0xef], 0x6f
mov byte [ebp - 0xee], cl
mov byte [ebp - 0xed], 0x64
mov byte [ebp - 0xec], 0x2e
mov byte [ebp - 0xeb], 0x70
mov byte [ebp - 0xea], 0x64
mov byte [ebp - 0xe9], 0x62
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x8b
mov byte [ebp - 0x2e], 0xec
mov byte [ebp - 0x2d], 0x83
mov byte [ebp - 0x2c], 0xe4
mov byte [ebp - 0x2b], 0xf8
mov byte [ebp - 0xd0], 0x81
mov byte [ebp - 0xcf], 0xec
mov byte [ebp - 0xce], 0x4c
mov byte [ebp - 0xcd], 1
mov byte [ebp - 0xcc], bl
mov byte [ebp - 0xcb], bl
mov byte [ebp - 0xc0], 0x8b
mov byte [ebp - 0xbf], 0x54
mov byte [ebp - 0xbe], 0x24
mov byte [ebp - 0xbd], 4
mov byte [ebp - 0xbc], 0x8b
mov byte [ebp - 0xbb], 0x42
mov byte [ebp - 0xc8], 0x83
mov byte [ebp - 0xc7], 0xec
mov byte [ebp - 0xc6], 0xc
mov byte [ebp - 0xc5], 0x55
mov byte [ebp - 0xc4], 0x56
mov byte [ebp - 0xc3], 0x57
mov byte [ebp - 0x16c], 0x55
mov byte [ebp - 0x16b], 0x8b
mov byte [ebp - 0x16a], 0xec
mov byte [ebp - 0x169], 0x83
mov byte [ebp - 0x168], 0xe4
mov byte [ebp - 0x167], 0xf8
mov byte [ebp - 0x166], 0x53
mov byte [ebp - 0x165], 0x8b
mov byte [ebp - 0x164], 0x1d
mov byte [ebp - 0xb8], 0x55
mov byte [ebp - 0xb7], 0x8b
mov byte [ebp - 0xb6], 0xec
mov byte [ebp - 0xb5], 0xb9
mov byte [ebp - 0xb4], 0x1b
mov byte [ebp - 0xb3], bl
mov byte [ebp - 0xb2], bl
mov byte [ebp - 0x300], 0x56
mov byte [ebp - 0x2ff], bl
mov byte [ebp - 0x2fe], 0x42
mov byte [ebp - 0x2fd], bl
mov byte [ebp - 0x2fc], 0x6f
mov byte [ebp - 0x2fb], bl
mov byte [ebp - 0x2fa], 0x78
mov byte [ebp - 0x2f9], bl
mov byte [ebp - 0x2f8], 0x53
mov byte [ebp - 0x2f7], bl
mov byte [ebp - 0x2f6], al
mov byte [ebp - 0x2f5], bl
mov byte [ebp - 0x2f4], 0x72
mov byte [ebp - 0x2f3], bl
mov byte [ebp - 0x2f2], 0x76
mov byte [ebp - 0x2f1], bl
mov byte [ebp - 0x2f0], 0x69
mov byte [ebp - 0x2ef], bl
mov byte [ebp - 0x2ee], 0x63
mov byte [ebp - 0x2ed], bl
mov byte [ebp - 0x2ec], al
mov byte [ebp - 0x2eb], bl
mov byte [ebp - 0x2ea], 0x2e
mov byte [ebp - 0x2e9], bl
mov byte [ebp - 0x2e8], al
mov byte [ebp - 0x2e7], bl
mov byte [ebp - 0x2e6], 0x78
mov byte [ebp - 0x2e5], bl
mov byte [ebp - 0x2e4], al
mov byte [ebp - 0x2e3], bl
mov byte [ebp - 0x2e2], bl
mov byte [ebp - 0xe0], 0x55
mov byte [ebp - 0xdf], 0x8b
mov byte [ebp - 0xde], 0xec
mov byte [ebp - 0xdd], 0x81
mov byte [ebp - 0xdc], 0xec
mov byte [ebp - 0x324], 0x50
mov byte [ebp - 0x323], bl
mov byte [ebp - 0x322], 0x75
mov byte [ebp - 0x321], bl
mov byte [ebp - 0x320], 0x62
mov byte [ebp - 0x31f], bl
mov byte [ebp - 0x31e], 0x6c
mov byte [ebp - 0x31d], bl
mov byte [ebp - 0x31c], 0x69
mov byte [ebp - 0x31b], bl
mov byte [ebp - 0x31a], 0x63
mov byte [ebp - 0x319], bl
mov byte [ebp - 0x318], 0x5c
mov byte [ebp - 0x317], bl
mov byte [ebp - 0x316], 0x77
mov byte [ebp - 0x315], bl
mov byte [ebp - 0x314], 0x69
mov byte [ebp - 0x313], bl
mov byte [ebp - 0x312], 0x6e
mov byte [ebp - 0x311], bl
mov byte [ebp - 0x310], 0x64
mov byte [ebp - 0x30f], bl
mov byte [ebp - 0x30e], 0x6f
mov byte [ebp - 0x30d], bl
mov byte [ebp - 0x30c], 0x77
mov byte [ebp - 0x30b], bl
mov byte [ebp - 0x30a], 0x2e
mov byte [ebp - 0x309], bl
mov byte [ebp - 0x308], 0x62
mov byte [ebp - 0x307], bl
mov byte [ebp - 0x306], cl
mov byte [ebp - 0x305], bl
mov byte [ebp - 0x304], dl
mov byte [ebp - 0x60], 0x6a
mov byte [ebp - 0x5f], 0x60
mov byte [ebp - 0x5e], 0x68
mov byte [ebp - 0x5d], 0x70
mov byte [ebp - 0x5c], 0x71
mov byte [ebp - 0x5b], 0x40
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x1f8], 0x64
mov byte [ebp - 0x1f7], 0x77
mov byte [ebp - 0x1f6], 0x6f
mov byte [ebp - 0x1f5], 0x6b
mov byte [ebp - 0x1f4], 0x6e
mov byte [ebp - 0x1f3], 0x71
mov byte [ebp - 0x1f2], 0x64
mov byte [ebp - 0x1f1], 0x71
mov byte [ebp - 0x1f0], 0x2d
mov byte [ebp - 0x1ef], 0x64
mov byte [ebp - 0x1ee], 0x77
mov byte [ebp - 0x1ed], 0x64
mov byte [ebp - 0x178], 0x4d
mov byte [ebp - 0x177], 0x69
mov byte [ebp - 0x176], 0x63
mov byte [ebp - 0x175], 0x72
mov byte [ebp - 0x174], 0x6f
mov byte [ebp - 0x173], 0x73
mov byte [ebp - 0x172], 0x6f
mov byte [ebp - 0x171], 0x66
mov byte [ebp - 0x170], dl
mov byte [ebp - 0x14c], 0x3c
mov byte [ebp - 0x14b], 0x70
mov byte [ebp - 0x14a], 0x72
mov byte [ebp - 0x149], 0x6f
mov byte [ebp - 0x148], 0x67
mov byte [ebp - 0x147], 0x72
mov byte [ebp - 0x146], cl
mov byte [ebp - 0x145], 0x6d
mov byte [ebp - 0x70], 0x6a
mov byte [ebp - 0x6f], 0x60
mov byte [ebp - 0x6e], 0x68
mov byte [ebp - 0x6d], pe_nt_image_headers32
mov byte [ebp - 0x6c], 0xb7
mov byte [ebp - 0x6b], 0x42
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x250], dl
mov byte [ebp - 0x24f], 0x77
mov byte [ebp - 0x24e], 0x69
mov byte [ebp - 0x24d], dl
mov byte [ebp - 0x24c], dl
mov byte [ebp - 0x24b], al
mov byte [ebp - 0x24a], 0x72
mov byte [ebp - 0x249], bl
mov byte [ebp - 0x248], 0x73
mov byte [ebp - 0x247], 0x76
mov byte [ebp - 0x246], 0x63
mov byte [ebp - 0x245], 0x68
mov byte [ebp - 0x244], 0x6f
mov byte [ebp - 0x243], 0x73
mov byte [ebp - 0x242], dl
mov byte [ebp - 0x241], 0x2e
mov byte [ebp - 0x240], al
mov byte [ebp - 0x23f], 0x78
mov byte [ebp - 0x23e], al
mov byte [ebp - 0x1c8], 0x44
mov byte [ebp - 0x1c7], al
mov byte [ebp - 0x1c6], 0x73
mov byte [ebp - 0x1c5], 0x6b
mov byte [ebp - 0x1c4], dl
mov byte [ebp - 0x1c3], 0x6f
mov byte [ebp - 0x1c2], 0x70
mov byte [ebp - 0x1c1], bl
mov byte [ebp - 0x1c0], 0x2e
mov byte [ebp - 0x1bf], 0x73
mov byte [ebp - 0x1be], 0x63
mov byte [ebp - 0x1bd], 0x72
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x133], cl
mov byte [ebp - 0x132], 0x6b
mov byte [ebp - 0x131], al
mov byte [ebp - 0x130], 0x6f
mov byte [ebp - 0x12f], 0x77
mov byte [ebp - 0x12e], 0x6e
mov byte [ebp - 0xd8], 0x55
mov byte [ebp - 0xd7], 0x8b
mov byte [ebp - 0xd6], 0xec
mov byte [ebp - 0xd5], 0x83
mov byte [ebp - 0xd4], 0xc4
mov byte [ebp - 0x268], bl
mov byte [ebp - 0x267], bl
mov byte [ebp - 0x266], bl
mov byte [ebp - 0x265], 0x52
mov byte [ebp - 0x264], bl
mov byte [ebp - 0x263], al
mov byte [ebp - 0x262], bl
mov byte [ebp - 0x261], cl
mov byte [ebp - 0x260], bl
mov byte [ebp - 0x25f], 0x64
mov byte [ebp - 0x25e], bl
mov byte [ebp - 0x25d], 0x4d
mov byte [ebp - 0x25c], bl
mov byte [ebp - 0x25b], al
mov byte [ebp - 0x25a], bl
mov byte [ebp - 0x259], 0x2e
mov byte [ebp - 0x258], bl
mov byte [ebp - 0x257], 0x54
mov byte [ebp - 0x256], bl
mov byte [ebp - 0x255], 0x78
mov byte [ebp - 0x254], bl
mov byte [ebp - 0x253], 0x54
mov byte [ebp - 0xb0], 0xe9
mov byte [ebp - 0xaf], 0x6a
mov byte [ebp - 0xae], 0xe3
mov byte [ebp - 0xad], bl
mov byte [ebp - 0xac], bl
mov byte [ebp - 0xab], 0xe9
mov byte [ebp - 0xaa], 0xa5
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 0x41
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x79
mov byte [ebp - 0x80], 0x91
mov byte [ebp - 0x7f], 0x40
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x7d], 0xf
mov byte [ebp - 0x7c], 0x57
mov byte [ebp - 0x7b], 0xc0
mov byte [ebp - 0x7a], 0x66
mov byte [ebp - 0xa0], 0x8d
mov byte [ebp - 0x9f], 0x45
mov byte [ebp - 0x9e], 0xac
mov byte [ebp - 0x9d], 0x53
mov byte [ebp - 0x9c], 0x50
mov byte [ebp - 0x9b], 0xe8
mov byte [ebp - 0x9a], 0xfe
mov byte [ebp - 0x90], 0xb6
mov byte [ebp - 0x8f], 0xe9
mov byte [ebp - 0x8e], 0x33
mov byte [ebp - 0x8d], 0x34
mov byte [ebp - 0x8c], 0xad
mov byte [ebp - 0x8b], 0x40
mov byte [ebp - 0x8a], 0xb2
mov byte [ebp - 0x114], 0x47
mov byte [ebp - 0x113], bl
mov byte [ebp - 0x112], cl
mov byte [ebp - 0x111], bl
mov byte [ebp - 0x110], 0x6e
mov byte [ebp - 0x10f], bl
mov byte [ebp - 0x10e], 0x64
mov byte [ebp - 0x10d], bl
mov byte [ebp - 0x10c], 0x43
mov byte [ebp - 0x10b], bl
mov byte [ebp - 0x10a], 0x72
mov byte [ebp - 0x109], bl
mov byte [ebp - 0x108], cl
mov byte [ebp - 0x107], bl
mov byte [ebp - 0x106], 0x62
mov byte [ebp - 0x105], bl
mov byte [ebp - 0x104], 0x21
mov byte [ebp - 0x144], 0x47
mov byte [ebp - 0x143], bl
mov byte [ebp - 0x142], 0x41
mov byte [ebp - 0x141], bl
mov byte [ebp - 0x140], 0x4e
mov byte [ebp - 0x13f], bl
mov byte [ebp - 0x13e], 0x44
mov byte [ebp - 0x13d], bl
mov byte [ebp - 0x13c], 0x43
mov byte [ebp - 0x13b], bl
mov byte [ebp - 0x13a], 0x52
mov byte [ebp - 0x139], bl
mov byte [ebp - 0x138], 0x41
mov byte [ebp - 0x137], bl
mov byte [ebp - 0x136], 0x42
mov byte [ebp - 0x68], bl
mov byte [ebp - 0x67], bl
mov byte [ebp - 0x66], 0x10
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], dl
mov byte [ebp - 0x63], 0x4d
mov byte [ebp - 0x62], 0x83
mov byte [ebp - 0x78], 0x55
mov byte [ebp - 0x77], 0x8b
mov byte [ebp - 0x76], 0xec
mov byte [ebp - 0x75], 0x83
mov byte [ebp - 0x74], 0xec
mov byte [ebp - 0x73], 0x30
mov byte [ebp - 0x72], 0xc7
mov byte [ebp - 0x228], 0x73
mov byte [ebp - 0x227], bl
mov byte [ebp - 0x226], 0x68
mov byte [ebp - 0x225], bl
mov byte [ebp - 0x224], 0x75
mov byte [ebp - 0x223], bl
mov byte [ebp - 0x222], dl
mov byte [ebp - 0x221], bl
mov byte [ebp - 0x220], 0x64
mov byte [ebp - 0x21f], bl
mov byte [ebp - 0x21e], 0x6f
mov byte [ebp - 0x21d], bl
mov byte [ebp - 0x21c], 0x77
mov byte [ebp - 0x21b], bl
mov byte [ebp - 0x21a], 0x6e
mov byte [ebp - 0x48], 0x6a
mov byte [ebp - 0x47], 0x10
mov byte [ebp - 0x46], 0x68
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], 0xe8
mov byte [ebp - 0x42], 0x8d
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], 0x8b
mov byte [ebp - 0x3e], 0x7d
mov byte [ebp - 0x3d], 8
mov byte [ebp - 0x3c], 0x85
mov byte [ebp - 0x218], 0x46
mov byte [ebp - 0x217], 0x69
mov byte [ebp - 0x216], 0x6e
mov byte [ebp - 0x215], 0x64
mov byte [ebp - 0x214], 0x46
mov byte [ebp - 0x213], 0x69
mov byte [ebp - 0x212], 0x72
mov byte [ebp - 0x211], 0x73
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x20f], 0x46
mov byte [ebp - 0x20e], 0x69
mov byte [ebp - 0x20d], 0x6c
mov byte [ebp - 0x20c], al
mov byte [ebp - 0x20b], 0x57
mov byte [ebp - 0x208], 0x46
mov byte [ebp - 0x207], 0x69
mov byte [ebp - 0x206], 0x6e
mov byte [ebp - 0x205], 0x64
mov byte [ebp - 0x204], 0x4e
mov byte [ebp - 0x203], al
mov byte [ebp - 0x202], 0x78
mov byte [ebp - 0x201], dl
mov byte [ebp - 0x200], 0x46
mov byte [ebp - 0x1ff], 0x69
mov byte [ebp - 0x1fe], 0x6c
mov byte [ebp - 0x1fd], al
mov byte [ebp - 0x1fc], 0x57
mov byte [ebp - 0x184], 0x57
mov byte [ebp - 0x183], 0x72
mov byte [ebp - 0x182], 0x69
mov byte [ebp - 0x181], dl
mov byte [ebp - 0x180], al
mov byte [ebp - 0x17f], 0x46
mov byte [ebp - 0x17e], 0x69
mov byte [ebp - 0x17d], 0x6c
mov byte [ebp - 0x17c], al
mov byte [ebp - 0x2e0], 0xff
mov byte [ebp - 0x2df], 0x15
mov byte [ebp - 0x2de], 0xec
mov byte [ebp - 0x2dd], 1
mov byte [ebp - 0x2dc], 0x41
mov byte [ebp - 0x2db], bl
mov byte [ebp - 0x2da], 0x85
mov byte [ebp - 0x2d9], 0xc0
mov byte [ebp - 0x2d8], 0xf
mov byte [ebp - 0x2d7], 0x84
mov byte [ebp - 0x2d6], 0x28
mov byte [ebp - 0x2d5], 1
mov byte [ebp - 0x2d4], bl
mov byte [ebp - 0x2d3], bl
mov byte [ebp - 0x2d2], 0xb9
mov byte [ebp - 0x2d1], 0xc
mov byte [ebp - 0x2d0], 0xe
mov byte [ebp - 0x2cf], bl
mov byte [ebp - 0x2ce], bl
mov byte [ebp - 0x2cd], 0xe8
mov byte [ebp - 0x2cc], 0xb5
mov byte [ebp - 0x2cb], 0x36
mov byte [ebp - 0x2ca], bl
mov byte [ebp - 0x2c9], bl
mov byte [ebp - 0x2c8], 0x89
mov byte [ebp - 0x2c7], 0x45
mov byte [ebp - 0x2c6], 0xfc
mov byte [ebp - 0x2c5], 0x83
mov byte [ebp - 0x2c4], 0x7d
mov byte [ebp - 0x2c3], 0xfc
mov byte [ebp - 0x1d4], 0x78
mov byte [ebp - 0x1d3], 0x78
mov byte [ebp - 0x1d2], 0x78
mov byte [ebp - 0x1d1], cl
mov byte [ebp - 0x1d0], 0x72
mov byte [ebp - 0x1cf], dl
mov byte [ebp - 0x1ce], 0x2e
mov byte [ebp - 0x1cd], 0x70
mov byte [ebp - 0x1af], al
mov byte [ebp - 0x1ac], al
mov byte [ebp - 0x237], al
mov byte [ebp - 0x230], al
mov byte [ebp - 0x22c], al
mov byte [ebp - 0x1e4], al
mov eax, dword [esi + 4]
mov byte [ebp - 0x1cc], 0x70
mov byte [ebp - 0x1cb], 0x2e
mov byte [ebp - 0x1ca], 0x75
mov byte [ebp - 0x1c9], cl
mov byte [ebp - 0x1b0], 0x64
mov byte [ebp - 0x1ae], 0x6c
mov byte [ebp - 0x1ad], 0x73
mov byte [ebp - 0x1ab], 0x6c
mov byte [ebp - 0x1aa], 0x66
mov byte [ebp - 0x1a9], 0x2e
mov byte [ebp - 0x1a8], 0x62
mov byte [ebp - 0x1a7], cl
mov byte [ebp - 0x1a6], dl
mov byte [ebp - 0x1a4], 0x43
mov byte [ebp - 0x1a3], 0x52
mov byte [ebp - 0x1a2], 0x59
mov byte [ebp - 0x1a1], 0x50
mov byte [ebp - 0x1a0], 0x54
mov byte [ebp - 0x19f], 0x4f
mov byte [ebp - 0x19e], 0x47
mov byte [ebp - 0x19d], 0x41
mov byte [ebp - 0x19c], 0x4d
mov byte [ebp - 0x19b], 0x53
mov byte [ebp - 0x19a], 0x20
mov byte [ebp - 0x1bc], 0x44
mov byte [ebp - 0x1bb], 0x45
mov byte [ebp - 0x1ba], 0x41
mov byte [ebp - 0x1b9], 0x54
mov byte [ebp - 0x1b8], 0x48
mov byte [ebp - 0x1b7], 0x52
mov byte [ebp - 0x1b6], cl
mov byte [ebp - 0x1b5], 0x6e
mov byte [ebp - 0x1b4], 0x73
mov byte [ebp - 0x1b3], 0x6f
mov byte [ebp - 0x1b2], 0x6d
mov byte [ebp - 0x23c], 0x44
mov byte [ebp - 0x23b], 0x6f
mov byte [ebp - 0x23a], 0x63
mov byte [ebp - 0x239], 0x75
mov byte [ebp - 0x238], 0x6d
mov byte [ebp - 0x236], 0x6e
mov byte [ebp - 0x235], dl
mov byte [ebp - 0x234], 0x50
mov byte [ebp - 0x233], 0x72
mov byte [ebp - 0x232], 0x6f
mov byte [ebp - 0x231], 0x70
mov byte [ebp - 0x22f], 0x72
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], 0x69
mov byte [ebp - 0x22b], 0x73
mov byte [ebp - 0x12c], dl
mov byte [ebp - 0x12b], 0x72
mov byte [ebp - 0x12a], 0x75
mov byte [ebp - 0x129], 0x73
mov byte [ebp - 0x128], cl
mov byte [ebp - 0x127], 0x6a
mov byte [ebp - 0x126], 0x7c
mov byte [ebp - 0x1ec], 0x46
mov byte [ebp - 0x1eb], 0x79
mov byte [ebp - 0x1ea], 0x6c
mov byte [ebp - 0x1e9], 0x75
mov byte [ebp - 0x1e8], 0x5c
mov byte [ebp - 0x1e7], 0x6c
mov byte [ebp - 0x1e6], 0x7a
mov byte [ebp - 0x1e5], cl
mov byte [ebp - 0x1e3], cl
mov byte [ebp - 0x1e2], bl
mov byte [ebp - 0x1e1], bl
cmp eax, ebx
je 0x41dcc9
cmp eax, 4
je 0x41dcc9
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x470164], ebx
mov ecx, dword [esi]
push ecx
push ebx
mov edi, eax
push 0x1fffff
mov dword [ebp - 0x10220], edi
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x10224], eax
cmp edi, ebx
je 0x41b29f
cmp eax, ebx
je 0x41dcc2
mov edx, eax
push edx
call fcn.00407740
push 0x1c
lea ecx, [ebp - 0x10244]
push ecx
push eax
mov dword [ebp - 0x1022c], ebx
push edi
mov dword [ebp - 0x10228], eax
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x10244], ebx
mov dword [ebp - 0x10240], ebx
mov dword [ebp - 0x1023c], ebx
mov dword [ebp - 0x10238], ebx
mov dword [ebp - 0x10234], ebx
mov dword [ebp - 0x10230], ebx
mov dword [ebp - 0x1022c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x411bb8
cmp dword [ebp - 0x10238], 0x30000
jb 0x411bb8
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x411bb8
cmp dword [ebp - 0x1023c], eax
jne 0x411bb8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 6
lea edx, [ebp - 0x434]
push str.CLASS
push edx
call fcn.004308ce
add esp, 0x20
test eax, eax
jne 0x411bb8
mov eax, dword [ebp - 0x10224]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
jmp 0x41dcc9
cmp dword [ebp - 0x10238], 0xe8000
jne 0x412011
cmp dword [ebp - 0x10230], 0x40
jne 0x412d31
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d31
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412011
push str.0XE8000
call fcn.004073f0
mov eax, dword [ebp - 0x10228]
add esp, 4
lea ecx, [ebp - 0x1021c]
push ecx
push 8
lea edx, [ebp - 0x49c]
push edx
push eax
push edi
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [ebp - 0xb0]
jne 0x412011
mov eax, dword [ebp - 0x498]
cmp byte [ebp - 0xac], al
jne 0x412011
cmp byte [ebp - 0xab], ah
jne 0x412011
mov dl, byte [ebp - 0xaa]
cmp dl, byte [ebp - 0x496]
jne 0x412011
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
push 0xf
lea ecx, [ebp - 0x514]
push ecx
add edx, 0xbcd9
push edx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov dword [ebp - 0x50c], ebx
mov word [ebp - 0x508], bx
mov byte [ebp - 0x506], bl
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xf
jne 0x412011
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xf
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x514]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412011
push str.match_8_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x85f]
push ebx
push edx
mov byte [ebp - 0x860], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x860]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RAPID.NPAV4.23012018
push str.NPAV4RAPID.NPAV4.23012018
lea edx, [ebp - 0x860]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x7ab3]
push ebx
push eax
mov byte [ebp - 0x7ab4], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7ab4]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x7ab4]
push str.WORM.RAPID.NPAV4.23012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4e4b]
push ebx
push edx
mov byte [ebp - 0x4e4c], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x16ff]
push ebx
push eax
mov byte [ebp - 0x1700], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x411eb5
lea edx, [ebp - 0x1700]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x411e40
lea edx, [ebp - 0x1700]
push edx
lea eax, [ebp - 0x4e4c]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4e4c]
push ecx
lea edx, [ebp - 0x1700]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x411eb5
lea eax, [ebp - 0x4e4c]
push eax
lea ecx, [ebp - 0x1700]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x411ea8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x411eb5
lea edx, [ebp - 0x1700]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x411f4e
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x7ab4]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x411ee8
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x411fcc
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x411f90
cmp dword [0x470144], ebx
je 0x411fc0
lea edx, [ebp - 0x10344]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10238], 0x13000
jne 0x412471
cmp dword [ebp - 0x10230], 0x40
jne 0x412d31
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d31
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412471
push str.0X13000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4b8]
push ecx
push edx
push edi
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x80]
jne 0x412471
mov eax, dword [ebp - 0x4b4]
cmp byte [ebp - 0x7c], al
jne 0x412471
cmp byte [ebp - 0x7b], ah
jne 0x412471
mov cl, byte [ebp - 0x7a]
cmp cl, byte [ebp - 0x4b2]
jne 0x412471
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x544]
push eax
add ecx, 0xb048
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x53c], ebx
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], ebx
mov word [ebp - 0x530], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x412471
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x544]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412471
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 2
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc07]
push ebx
push edx
mov byte [ebp - 0xc08], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc08]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.1
push str.NPAV4GDCB.NPAV4.30012018.1
lea edx, [ebp - 0xc08]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x647b]
push ebx
push eax
mov byte [ebp - 0x647c], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x647c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x647c]
push str.WORM.GDCB.NPAV4.30012018.1
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x698b]
push ebx
push edx
mov byte [ebp - 0x698c], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x2dff]
push ebx
push eax
mov byte [ebp - 0x2e00], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41231c
lea edx, [ebp - 0x2e00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412287
lea edx, [ebp - 0x2e00]
push edx
lea eax, [ebp - 0x698c]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x698c]
push ecx
lea edx, [ebp - 0x2e00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41231c
lea eax, [ebp - 0x698c]
push eax
lea ecx, [ebp - 0x2e00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41230f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41231c
lea edx, [ebp - 0x2e00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4123ab
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x647c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412350
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412420
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4123f0
cmp dword [0x470144], ebx
je 0x412420
lea edx, [ebp - 0x102f8]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x12000
jne 0x4128d1
cmp dword [ebp - 0x10230], 0x40
jne 0x412d31
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d31
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x4128d1
push str.0X12000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x48c]
push ecx
push edx
push edi
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0xa0]
jne 0x4128d1
mov eax, dword [ebp - 0x488]
cmp byte [ebp - 0x9c], al
jne 0x4128d1
cmp byte [ebp - 0x9b], ah
jne 0x4128d1
mov cl, byte [ebp - 0x9a]
cmp cl, byte [ebp - 0x486]
jne 0x4128d1
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x52c]
push eax
add ecx, 0x9d45
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov word [ebp - 0x518], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x4128d1
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x52c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4128d1
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 4
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8c7]
push ebx
push edx
mov byte [ebp - 0x8c8], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8c8]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.2
push str.NPAV4GDCB.NPAV4.30012018.2
lea edx, [ebp - 0x8c8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x74a3]
push ebx
push eax
mov byte [ebp - 0x74a4], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x74a4]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x74a4]
push str.WORM.GDCB.NPAV4.30012018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x504f]
push ebx
push edx
mov byte [ebp - 0x5050], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x19ff]
push ebx
push eax
mov byte [ebp - 0x1a00], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41277c
lea edx, [ebp - 0x1a00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4126f3
lea edx, [ebp - 0x1a00]
push edx
lea eax, [ebp - 0x5050]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5050]
push ecx
lea edx, [ebp - 0x1a00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41277c
lea eax, [ebp - 0x5050]
push eax
lea ecx, [ebp - 0x1a00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41276f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41277c
lea edx, [ebp - 0x1a00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41280b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x74a4]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4127b0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412880
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412850
cmp dword [0x470144], ebx
je 0x412880
lea edx, [ebp - 0x102b8]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x14000
jne 0x412d31
cmp dword [ebp - 0x10230], 0x40
jne 0x412d31
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d31
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412d31
push str.0X14000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4c0]
push ecx
push edx
push edi
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c0]
cmp eax, dword [ebp - 0x90]
jne 0x412d31
mov eax, dword [ebp - 0x4bc]
cmp byte [ebp - 0x8c], al
jne 0x412d31
cmp byte [ebp - 0x8b], ah
jne 0x412d31
mov cl, byte [ebp - 0x8a]
cmp cl, byte [ebp - 0x4ba]
jne 0x412d31
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x55c]
push eax
add ecx, 0xc1ee
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x558], ebx
mov dword [ebp - 0x554], ebx
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x54c], ebx
mov word [ebp - 0x548], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x412d31
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x55c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412d31
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 6
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb03]
push ebx
push edx
mov byte [ebp - 0xb04], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb04]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.3
push str.NPAV4GDCB.NPAV4.30012018.3
lea edx, [ebp - 0xb04]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x6683]
push ebx
push eax
mov byte [ebp - 0x6684], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6684]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x6684]
push str.WORM.GDCB.NPAV4.30012018.3
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x6a8b]
push ebx
push edx
mov byte [ebp - 0x6a8c], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x25ff]
push ebx
push eax
mov byte [ebp - 0x2600], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x412bdc
lea edx, [ebp - 0x2600]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412b53
lea edx, [ebp - 0x2600]
push edx
lea eax, [ebp - 0x6a8c]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x6a8c]
push ecx
lea edx, [ebp - 0x2600]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412bdc
lea eax, [ebp - 0x6a8c]
push eax
lea ecx, [ebp - 0x2600]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x412bcf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412bdc
lea edx, [ebp - 0x2600]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x412c6b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6684]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412c10
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412ce0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412cb0
cmp dword [0x470144], ebx
je 0x412ce0
lea edx, [ebp - 0x102dc]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4134f1
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x4134f1
cmp dword [ebp - 0x1023c], eax
jne 0x4134f1
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0xa8b4]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0x14
lea ecx, [ebp - 0x1021c]
push ecx
push 0x500
lea edx, [ebp - 0xa8b4]
push edx
add eax, 0xa760
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x500
jne 0x413111
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xa8b4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413111
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 8
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x92f]
push ebx
push edx
mov byte [ebp - 0x930], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x930]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GRAB.NPAV4.0803018.4
push str.NPAV4GRAB.NPAV4.0803018.4
lea edx, [ebp - 0x930]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x688b]
push ebx
push eax
mov byte [ebp - 0x688c], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x688c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x688c]
push str.WORM.GRAB.NPAV4.0803018.4
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x5253]
push ebx
push edx
mov byte [ebp - 0x5254], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x1bff]
push ebx
push eax
mov byte [ebp - 0x1c00], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x412fbc
lea edx, [ebp - 0x1c00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412f33
lea edx, [ebp - 0x1c00]
push edx
lea eax, [ebp - 0x5254]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5254]
push ecx
lea edx, [ebp - 0x1c00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412fbc
lea eax, [ebp - 0x5254]
push eax
lea ecx, [ebp - 0x1c00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x412faf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412fbc
lea edx, [ebp - 0x1c00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41304a
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x688c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412ff0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4130c0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413090
cmp dword [0x470144], ebx
je 0x4130c0
lea edx, [ebp - 0x1031c]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4134f1
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x4134f1
cmp dword [ebp - 0x1023c], eax
jne 0x4134f1
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0xbcb4]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0x14
lea ecx, [ebp - 0x1021c]
push ecx
push 0x500
lea edx, [ebp - 0xbcb4]
push edx
add eax, 0xae30
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x500
jne 0x4134f1
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xbcb4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4134f1
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0xa
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb6b]
push ebx
push edx
mov byte [ebp - 0xb6c], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb6c]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GRAB.NPAV4.16052018.5
push str.NPAV4GRAB.NPAV4.16052018.5
lea edx, [ebp - 0xb6c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x4c47]
push ebx
push eax
mov byte [ebp - 0x4c48], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4c48]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x4c48]
push str.WORM.GRAB.NPAV4.16052018.5
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x76a7]
push ebx
push edx
mov byte [ebp - 0x76a8], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x2bff]
push ebx
push eax
mov byte [ebp - 0x2c00], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41339c
lea edx, [ebp - 0x2c00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413313
lea edx, [ebp - 0x2c00]
push edx
lea eax, [ebp - 0x76a8]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x76a8]
push ecx
lea edx, [ebp - 0x2c00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41339c
lea eax, [ebp - 0x76a8]
push eax
lea ecx, [ebp - 0x2c00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41338f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41339c
lea edx, [ebp - 0x2c00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41342b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4c48]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4133d0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4134a0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413470
cmp dword [0x470144], ebx
je 0x4134a0
lea edx, [ebp - 0x102b4]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x16000
jne 0x413963
push str.mbi_._RegionSize__0X16000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x413963
cmp dword [ebp - 0x1023c], 0x80
jne 0x413963
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x413963
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X16000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 8
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4c8]
push ecx
push edx
push edi
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4c4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x68]
jne 0x413963
mov eax, dword [ebp - 0x4c4]
cmp byte [ebp - 0x64], al
jne 0x413963
cmp byte [ebp - 0x63], ah
jne 0x413963
mov cl, byte [ebp - 0x62]
cmp cl, byte [ebp - 0x4c2]
jne 0x413963
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea edx, [ebp - 0x1034]
push ebx
push edx
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov edx, dword [ebp - 0x10228]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x50
lea ecx, [ebp - 0x1034]
push ecx
add edx, 0x10bc0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x413963
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1034]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413963
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0xc
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x7c3]
push ebx
push eax
mov byte [ebp - 0x7c4], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x7c4]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.05072018.1
push str.NPAV4KRAB.NPAV4.05072018.1
lea eax, [ebp - 0x7c4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x54
push 0x103
lea ecx, [ebp - 0x4d4b]
push ebx
push ecx
mov byte [ebp - 0x4d4c], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4d4c]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x4d4c]
push str.WORM.KRAB.NPAV4.05072018.1
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x5457]
push ebx
push eax
mov byte [ebp - 0x5458], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x1dff]
push ebx
push ecx
mov byte [ebp - 0x1e00], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x413809
lea edx, [ebp - 0x1e00]
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413780
lea eax, [ebp - 0x1e00]
push eax
lea ecx, [ebp - 0x5458]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x5458]
push edx
lea eax, [ebp - 0x1e00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413809
lea ecx, [ebp - 0x5458]
push ecx
lea edx, [ebp - 0x1e00]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x4137fc
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413809
lea eax, [ebp - 0x1e00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41389d
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4d4c]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413840
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x413912
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4138e2
cmp dword [0x470144], ebx
je 0x413912
lea eax, [ebp - 0x10324]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x20000
jne 0x413db1
push str.mbi_._RegionSize__0X20000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x413db1
cmp dword [ebp - 0x1023c], 0x80
jne 0x413db1
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x413db1
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X20000
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xfe4]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov ecx, dword [ebp - 0x10228]
add esp, 0x18
lea edx, [ebp - 0x1021c]
push edx
push 0x50
lea eax, [ebp - 0xfe4]
push eax
add ecx, 0x11b9d
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x413db1
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0xfe4]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413db1
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 0xe
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x6f3]
push ebx
push edx
mov byte [ebp - 0x6f4], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6f4]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.10082018.2
push str.NPAV4KRAB.NPAV4.10082018.2
lea edx, [ebp - 0x6f4]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x54
push 0x103
lea eax, [ebp - 0x3d1f]
push ebx
push eax
mov byte [ebp - 0x3d20], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x3d20]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x3d20]
push str.WORM.KRAB.NPAV4.10082018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4533]
push ebx
push edx
mov byte [ebp - 0x4534], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x27ff]
push ebx
push eax
mov byte [ebp - 0x2800], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x413c19
lea edx, [ebp - 0x2800]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413b90
lea edx, [ebp - 0x2800]
push edx
lea eax, [ebp - 0x4534]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4534]
push ecx
lea edx, [ebp - 0x2800]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413c19
lea eax, [ebp - 0x4534]
push eax
lea ecx, [ebp - 0x2800]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x413c0c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413c19
lea edx, [ebp - 0x2800]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x413cab
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x3d20]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413c50
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x413cdf
push str.WORM.KRAB.NPAV4.10082018.2
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x4534]
push edx
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x3d20]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x413d60
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x413d30
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413d30
cmp dword [0x470144], ebx
je 0x413d60
lea eax, [ebp - 0x102f4]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
mov ecx, dword [ebp - 0x10238]
add ecx, 0xfffe5000
cmp ecx, 0xe000
ja 0x41420a
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41420a
cmp dword [ebp - 0x1023c], 0x80
jne 0x41420a
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41420a
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
add esp, 8
lea edx, [ebp - 0x1021c]
push edx
push 0x20
lea eax, [ebp - 0x5bc]
push eax
push 0x4030df
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x5bc], ebx
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 0x5b4], ebx
mov dword [ebp - 0x5b0], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x20
jne 0x41420a
push str.read_successful_and_act_bytes_dwActualReadBytes__32
call fcn.004073f0
push 0x1e
push 0x20
lea ecx, [ebp - 0x2e0]
push ecx
lea edx, [ebp - 0x5bc]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41420a
push str.match_30_bytes
call fcn.004073f0
push str.match_KRAB_G_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 8
push eax
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x78f]
push ebx
push edx
mov byte [ebp - 0x790], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x790]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.28082018.V3G
push str.NPAV4KRAB.NPAV4.28082018.V3G
lea edx, [ebp - 0x790]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x473b]
push ebx
push eax
mov byte [ebp - 0x473c], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x473c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x473c]
push str.WORM.KRAB.NPAV4.28082018.V3G
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x370f]
push ebx
push edx
mov byte [ebp - 0x3710], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x1fff]
push ebx
push eax
mov byte [ebp - 0x2000], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41408c
lea edx, [ebp - 0x2000]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414003
lea edx, [ebp - 0x2000]
push edx
lea eax, [ebp - 0x3710]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x3710]
push ecx
lea edx, [ebp - 0x2000]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41408c
lea eax, [ebp - 0x3710]
push eax
lea ecx, [ebp - 0x2000]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41407f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41408c
lea edx, [ebp - 0x2000]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414119
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x473c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4140c0
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41414d
push str.WORM.KRAB.NPAV4.28082018.V3G
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x3710]
push edx
lea ecx, [ebp - 0x790]
push ecx
lea edx, [ebp - 0x473c]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x4141c8
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4141a0
cmp dword [0x470144], ebx
je 0x4141c8
lea eax, [ebp - 0x10350]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x4141f7
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x29000
jne 0x4147d1
push str.mbi_._RegionSize__0X29000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x4147d1
cmp dword [ebp - 0x1023c], 0x80
jne 0x4147d1
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x4147d1
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X29000
call fcn.004073f0
mov eax, dword [ebp - 0x10228]
add esp, 8
lea ecx, [ebp - 0x1021c]
push ecx
push 0x14
lea edx, [ebp - 0x4b0]
push edx
push eax
push edi
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x4a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b0]
cmp byte [ebp - 0x48], al
jne 0x4147d1
cmp byte [ebp - 0x47], ah
jne 0x4147d1
mov cl, byte [ebp - 0x46]
cmp cl, byte [ebp - 0x4ae]
jne 0x4147d1
push str.match_FIRST_Princes1_sig
call fcn.004073f0
mov dl, byte [ebp - 0x45]
add esp, 4
cmp dl, byte [ebp - 0x4ab]
jne 0x4147d1
mov al, byte [ebp - 0x44]
cmp al, byte [ebp - 0x4aa]
jne 0x4147d1
mov cl, byte [ebp - 0x43]
cmp cl, byte [ebp - 0x4a9]
jne 0x4147d1
push str.match_SECOND_Princes1_sig
call fcn.004073f0
mov edx, dword [ebp - 0x4a7]
add esp, 4
cmp edx, dword [ebp - 0x42]
jne 0x4147d1
mov al, byte [ebp - 0x3e]
cmp al, byte [ebp - 0x4a3]
jne 0x4147d1
mov cl, byte [ebp - 0x3d]
cmp cl, byte [ebp - 0x4a2]
jne 0x4147d1
mov dl, byte [ebp - 0x3c]
cmp dl, byte [ebp - 0x4a1]
jne 0x4147d1
push str.match_THIRD_Princes1_sig
call fcn.004073f0
push 0xd60
lea eax, [ebp - 0xe214]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0xd60
lea edx, [ebp - 0xe214]
push edx
add eax, 0x1e4c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xd60
jne 0x4147d1
push str.read_successful_and_act_bytes_dwActualReadBytes__0XD60
call fcn.004073f0
push 0xe
push 0xd60
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0xe214]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4147d1
push str.match_14_bytes
call fcn.004073f0
push str.match_Princes_Find1stFileW_sig
call fcn.004073f0
push 0xd
push 0xd60
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xe208]
push ecx
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x4147d1
push str.match_13_bytes
call fcn.004073f0
push str.match_Princes_Find2ndFileW_sig
call fcn.004073f0
push 9
push 0xd60
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0xe208]
push eax
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x4147d1
push str.match_9_bytes
call fcn.004073f0
push str.match_Princes_WriteFile_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 8
push ecx
mov dword [ebp - 4], 0x12
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x5ef]
push ebx
push eax
mov byte [ebp - 0x5f0], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x5f0]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PRINCE.NPAV4.20082018
push str.NPAV4PRINCE.NPAV4.20082018
lea eax, [ebp - 0x5f0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x3f27]
push ebx
push ecx
mov byte [ebp - 0x3f28], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3f28]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x3f28]
push str.WORM.PRINCE.NPAV4.20082018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x6c8f]
push ebx
push eax
mov byte [ebp - 0x6c90], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x2fff]
push ebx
push ecx
mov byte [ebp - 0x3000], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x414639
lea edx, [ebp - 0x3000]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4145b0
lea eax, [ebp - 0x3000]
push eax
lea ecx, [ebp - 0x6c90]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x6c90]
push edx
lea eax, [ebp - 0x3000]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414639
lea ecx, [ebp - 0x6c90]
push ecx
lea edx, [ebp - 0x3000]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41462c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414639
lea eax, [ebp - 0x3000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4146cd
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x3f28]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414670
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x4146ff
push str.WORM.PRINCE.NPAV4.20082018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x5f0]
push ecx
lea edx, [ebp - 0x3f28]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x414780
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x414750
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414750
cmp dword [0x470144], ebx
je 0x414780
lea eax, [ebp - 0x10300]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x414bc3
cmp dword [ebp - 0x10230], 0x40
jne 0x414bc3
cmp dword [ebp - 0x1023c], 0x40
jne 0x414bc3
push str.REW_and_REW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x12000
jb 0x414bc3
push str.0X12000
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xf94]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov ecx, dword [ebp - 0x10228]
add esp, 0x10
lea edx, [ebp - 0x1021c]
push edx
push 0x50
lea eax, [ebp - 0xf94]
push eax
add ecx, 0x2350
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x414bc3
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0xf94]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x414bc3
push str.match_15_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x14
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x997]
push ebx
push eax
mov byte [ebp - 0x998], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x998]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTON.NPAV4.21052018
push str.NPAV4CRYPTON.NPAV4.21052018
lea eax, [ebp - 0x998]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0x103
lea ecx, [ebp - 0x4f4f]
push ebx
push ecx
mov byte [ebp - 0x4f50], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4f50]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x4f50]
push str.WORM.CRYPTON.NPAV4.21052018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x565b]
push ebx
push eax
mov byte [ebp - 0x565c], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x21ff]
push ebx
push ecx
mov byte [ebp - 0x2200], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x414a61
lea edx, [ebp - 0x2200]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4149d8
lea eax, [ebp - 0x2200]
push eax
lea ecx, [ebp - 0x565c]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x565c]
push edx
lea eax, [ebp - 0x2200]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414a61
lea ecx, [ebp - 0x565c]
push ecx
lea edx, [ebp - 0x2200]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x414a54
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414a61
lea eax, [ebp - 0x2200]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x434]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
cmp dword [0x46f734], ebx
je 0x414b00
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4f50]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414aa8
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414b72
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
push 0x104
push ebx
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414b42
cmp dword [0x470144], ebx
je 0x414b72
lea ecx, [ebp - 0x10308]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x2000
jne 0x415021
cmp dword [ebp - 0x10230], 0x20
jne 0x41546d
cmp dword [ebp - 0x1023c], 0x80
jne 0x415476
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x415021
push str.0X2000
call fcn.004073f0
mov ecx, dword [ebp - 0x10228]
add esp, 4
lea edx, [ebp - 0x1021c]
push edx
push 6
lea eax, [ebp - 0x454]
push eax
push ecx
push edi
mov dword [ebp - 0x454], ebx
mov word [ebp - 0x450], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x454]
cmp edx, dword [ebp - 0xd8]
jne 0x415021
mov al, byte [ebp - 0xd4]
cmp al, byte [ebp - 0x450]
jne 0x415021
lea ecx, [ebp - 0x1021c]
push ecx
push 0x1e
lea edx, [ebp - 0x59c]
push edx
push 0x40cec0
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x59c], ebx
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x594], ebx
mov dword [ebp - 0x590], ebx
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x584], ebx
mov word [ebp - 0x580], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1e
jne 0x415021
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x16
push 0x1e
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x59c]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415021
push str.match_22_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x16
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xbd3]
push ebx
push edx
mov byte [ebp - 0xbd4], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xbd4]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4LOCK.NPAV4.16012018
push str.NPAV4LOCK.NPAV4.16012018
lea edx, [ebp - 0xbd4]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x5153]
push ebx
push eax
mov byte [ebp - 0x5154], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5154]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x5154]
push str.WORM.LOCK.NPAV4.16012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x7cb7]
push ebx
push edx
mov byte [ebp - 0x7cb8], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x29ff]
push ebx
push eax
mov byte [ebp - 0x2a00], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x414ec9
lea edx, [ebp - 0x2a00]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414e40
lea edx, [ebp - 0x2a00]
push edx
lea eax, [ebp - 0x7cb8]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x7cb8]
push ecx
lea edx, [ebp - 0x2a00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414ec9
lea eax, [ebp - 0x7cb8]
push eax
lea ecx, [ebp - 0x2a00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x414ebc
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414ec9
lea edx, [ebp - 0x2a00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414f59
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5154]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414f00
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414fd0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414fa0
cmp dword [0x470144], ebx
je 0x414fd0
lea edx, [ebp - 0x10310]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x3000
jne 0x41546d
cmp dword [ebp - 0x10230], 0x20
jne 0x41546d
cmp dword [ebp - 0x1023c], 0x80
jne 0x415476
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41546d
push str.0X3000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x494]
push ecx
push edx
push edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x78]
jne 0x41546d
mov eax, dword [ebp - 0x490]
cmp byte [ebp - 0x74], al
jne 0x41546d
cmp byte [ebp - 0x73], ah
jne 0x41546d
mov cl, byte [ebp - 0x72]
cmp cl, byte [ebp - 0x48e]
jne 0x41546d
lea edx, [ebp - 0x1021c]
push edx
push 0xa
lea eax, [ebp - 0x4ec]
push eax
push 0x40d615
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov word [ebp - 0x4e4], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xa
jne 0x41546d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xa
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x4ec]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41546d
push str.match_8_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x18
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9ff]
push ebx
push edx
mov byte [ebp - 0xa00], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa00]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4JAVA.NPAV4.08022018
push str.NPAV4JAVA.NPAV4.08022018
lea edx, [ebp - 0xa00]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x5357]
push ebx
push eax
mov byte [ebp - 0x5358], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5358]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x5358]
push str.WORM.JAVA.NPAV4.08022018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x585f]
push ebx
push edx
mov byte [ebp - 0x5860], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x14ff]
push ebx
push eax
mov byte [ebp - 0x1500], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41530d
lea edx, [ebp - 0x1500]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x415284
lea edx, [ebp - 0x1500]
push edx
lea eax, [ebp - 0x5860]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5860]
push ecx
lea edx, [ebp - 0x1500]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41530d
lea eax, [ebp - 0x5860]
push eax
lea ecx, [ebp - 0x1500]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x415300
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41530d
lea edx, [ebp - 0x1500]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x415399
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5358]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x415340
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x415410
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4153e0
cmp dword [0x470144], ebx
je 0x415410
lea edx, [ebp - 0x10318]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040ec00
push str.UmRdpService
call fcn.0040e9b0
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10230], 0x40
je 0x415490
cmp dword [ebp - 0x1023c], 0x40
jne 0x41582a
cmp byte [0x46fec4], 1
je 0x41582a
mov ecx, dword [esi + 4]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x41582a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4154d2
sub eax, edx
je 0x41582a
lea edx, [ebp - 0x434]
push str.svchost.exe
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41582a
push 0x104
push ebx
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415522
sub eax, edx
je 0x41582a
push 0x12c
push ebx
push 0x46fba8
call fcn.0042ea40
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415582
sub eax, edx
je 0x41582a
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41582a
push str.CryptoDefense:_Suspended_svchost.exe_Process
mov dword [0x470164], 1
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
call fcn.00408550
mov eax, dword [0x46ff94]
mov edx, dword [esi + 4]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [ebp - 0x3408]
push ebx
push eax
call fcn.0042ea40
add esp, 0x48
push 0x104
lea ecx, [ebp - 0x3408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x3408]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415660
sub eax, edx
je 0x41569d
lea eax, [ebp - 0x3408]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x415672
mov edx, dword [str._svchost.exe]
mov ecx, dword [0x45da60]
mov dword [eax], edx
mov edx, dword [0x45da64]
mov dword [eax + 4], ecx
mov cl, byte [0x45da68]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [ebp - 0x3408]
push str.WORM.CRYPTO.05052014
push edx
call fcn.0040a000
add esp, 8
cmp dword [0x46f734], ebx
je 0x415771
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x3408]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x4156d2
mov ecx, dword [0x45da48]
mov eax, dword [str.WORM.CRYPTO.05052014]
mov edx, dword [0x45da4c]
mov dword [0x46a042], ecx
mov ecx, dword [0x45da54]
mov dword [0x46a03e], eax
mov eax, dword [0x45da50]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dl, byte [0x45da58]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x41582a
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, dword [0x45da4c]
mov edx, dword [str.WORM.CRYPTO.05052014]
mov eax, dword [0x45da48]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45da50]
mov dword [0x46f73c], eax
mov eax, dword [0x45da54]
mov dword [0x46f740], ecx
mov cl, byte [0x45da58]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov byte [0x46f74c], cl
call fcn.0042ea40
mov edx, dword [str.svchost.exe]
mov eax, dword [0x45db08]
mov ecx, dword [0x45db0c]
add esp, 0x18
mov dword [0x46f978], edx
mov dword [0x46f97c], eax
mov dword [0x46f980], ecx
call fcn.00407a90
cmp dword [0x470144], ebx
je 0x41582a
lea edx, [ebp - 0x10328]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x1022c], 0x40000
jne 0x415947
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415853
cmp dword [ebp - 0x1023c], eax
jne 0x415b63
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x3000
jne 0x415947
push str.0x3000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x97c0]
push ebx
push eax
mov dword [ebp - 0x10278], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x10278]
push ecx
push 0x500
lea edx, [ebp - 0x97c0]
push edx
add eax, 0x2100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x97c0]
test ecx, ecx
je 0x415947
cmp dword [ebp - 0x10278], 0x500
jne 0x415947
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x97c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415947
push 0x11
push 0x500
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x97c0]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x415947
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x415b63
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415970
cmp dword [ebp - 0x1023c], eax
jne 0x415b63
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x3000
jne 0x415b63
push str.0x3000
call fcn.004073f0
push 0x700
lea ecx, [ebp - 0xafb4]
push ebx
push ecx
mov dword [ebp - 0x10280], ebx
call fcn.0042ea40
mov edx, dword [ebp - 0x10238]
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x10280]
push ecx
lea eax, [edx + eax - 0x700]
push 0x700
lea edx, [ebp - 0xafb4]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xafb4]
test eax, eax
je 0x415b63
cmp dword [ebp - 0x10280], 0x700
jne 0x415b63
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x700
lea ecx, [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0xafb4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415b63
push str.Sig_found_for_Ramnit_and_terminated_
call fcn.004073f0
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x10224]
inc dword [0x470308]
add esp, 0x18
push ecx
mov dword [0x470304], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415b63
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415b63
cmp dword [0x470308], 2
jg 0x415cc3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415ac0
mov edx, dword [str.Win32.Ramnit.13102015]
mov eax, dword [0x45d9c8]
mov ecx, dword [0x45d9cc]
mov dword [0x46a03e], edx
mov edx, dword [0x45d9d0]
mov dword [0x46a042], eax
mov eax, dword [0x45d9d4]
mov dword [0x46a046], ecx
mov cx, word [0x45d9d8]
mov dword [0x46a04a], edx
mov edx, dword [str.NPAV4]
mov dword [0x46a04e], eax
mov ax, word [0x45d9c0]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov word [0x46a0a7], ax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470308], 2
jne 0x415cc3
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165dc
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415b99
cmp dword [ebp - 0x1023c], eax
jne 0x415cd3
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2000
jne 0x415cc3
mov ecx, dword [esi + 4]
cmp ecx, dword [0x470304]
jne 0x415cc3
mov edx, dword [ebp - 0x10224]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415cc3
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415cc3
cmp dword [0x470308], 2
jne 0x415cc3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x415c20
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415c20
mov ecx, dword [0x45d9c8]
mov eax, dword [str.Win32.Ramnit.13102015]
mov edx, dword [0x45d9cc]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d9d4]
mov dword [0x46a03e], eax
mov eax, dword [0x45d9d0]
mov dword [0x46a04e], ecx
mov cx, word [0x45d9c0]
mov dword [0x46a046], edx
mov dx, word [0x45d9d8]
mov dword [0x46a04a], eax
mov eax, dword [str.NPAV4]
mov word [0x46a0a7], cx
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165dc
mov edx, dword [esi]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x415ff6
mov eax, 0x20
cmp dword [ebp - 0x10230], eax
je 0x415cff
cmp dword [ebp - 0x1023c], eax
jne 0x415ff6
push 0x45d9b8
call fcn.004073f0
mov eax, dword [0x46ff2c]
add esp, 4
cmp eax, ebx
je 0x415ff6
cmp eax, dword [esi + 4]
jne 0x415ff6
mov eax, dword [ebp - 0x10238]
add eax, 0xffffc000
cmp eax, 0x4000
ja 0x415ff6
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [0x46ff94]
mov edx, dword [esi]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push str.cry_sz_matched
mov dword [0x46ff94], eax
call fcn.004073f0
push 0x103
lea eax, [ebp - 0x360f]
push ebx
push eax
mov byte [ebp - 0x3610], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x3610]
push str.svchost.exe__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x3610]
push str.WORM.CTB_LOCK.210115
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x415e65
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x3610]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415dd0
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d984]
mov eax, dword [0x45d988]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d98c]
mov dword [0x46a042], edx
mov edx, dword [0x45d990]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d994]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov edx, dword [0x45d988]
mov eax, dword [str.WORM.CTB_LOCK.210115]
mov ecx, dword [0x45d984]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45d98c]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d990]
mov dword [0x46f740], edx
mov dl, byte [0x45d994]
push ebx
push 0x46f978
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x3610]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x415ed0
push 0x104
lea eax, [ebp - 0x555c]
push ebx
push eax
call fcn.0042ea40
push 0x104
lea ecx, [ebp - 0x5760]
push ebx
push ecx
call fcn.0042ea40
push 0x104
lea edx, [ebp - 0x3814]
push ebx
push edx
call fcn.0042ea40
push 0x104
lea eax, [ebp - 0xee0]
push ebx
push eax
call fcn.0042ea40
mov ecx, 8
mov esi, str.c:windows_system32_svchost.exe
lea edi, [ebp - 0xee0]
add esp, 0x30
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x3814], cl
inc eax
cmp cl, bl
jne 0x415f41
mov eax, dword [0x469868]
cmp eax, ebx
je 0x415f75
push 0x104
lea ecx, [ebp - 0x5760]
push ecx
lea edx, [ebp - 0x3814]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
cmp eax, ebx
je 0x415f91
lea ecx, [ebp - 0x555c]
push ecx
lea edx, [ebp - 0x3814]
push edx
call eax
add esp, 8
call fcn.00408eb0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea eax, [ebp - 0x555c]
push eax
lea ecx, [ebp - 0x5760]
push ecx
lea edx, [ebp - 0xee0]
push edx
push 0x45caa0
push str.WORM.CTB_LOCK.210115
call fcn.00407310
add esp, 0x20
cmp dword [0x470144], ebx
je 0x415fea
lea eax, [ebp - 0x10330]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41600f
cmp dword [ebp - 0x1023c], eax
jne 0x4165dc
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x416148
cmp eax, 4
je 0x416148
cmp dword [0x467218], eax
je 0x416148
cmp dword [0x46721c], eax
je 0x416148
cmp dword [0x467220], eax
je 0x416148
cmp dword [0x467224], eax
je 0x416148
push str.Priv_rwe
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2000
jne 0x416148
push str.0x2000
call fcn.004073f0
push 0x500
lea ecx, [ebp - 0x97c0]
push ebx
push ecx
mov dword [ebp - 0x10284], ebx
call fcn.0042ea40
mov ecx, dword [ebp - 0x10228]
add esp, 0x10
lea edx, [ebp - 0x10284]
push edx
push 0x500
lea eax, [ebp - 0x97c0]
push eax
add ecx, 0xe00
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x97c0]
test edx, edx
je 0x416148
cmp dword [ebp - 0x10284], 0x500
jne 0x416148
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x97c0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x416148
push 0x11
push 0x500
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x97c0]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x416148
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x470130], 0x1e
jl 0x41619e
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x41619e
cmp eax, 4
je 0x41619e
cmp dword [0x467218], eax
je 0x41619e
cmp dword [0x46721c], eax
je 0x41619e
mov ecx, 1
cmp dword [0x470294], ecx
je 0x4161a3
cmp dword [0x47013c], ebx
je 0x4161a3
mov dword [0x470128], ecx
jmp 0x4161a3
mov ecx, 1
mov eax, dword [ebp - 0x10238]
cmp eax, 0x8000
je 0x41655f
cmp eax, 0x9000
je 0x41655f
cmp eax, 0xe000
je 0x41655f
cmp eax, 0xf000
je 0x41655f
cmp eax, 0x27000
je 0x41655f
cmp eax, 0x28000
je 0x41655f
cmp eax, 0x32000
je 0x41655f
cmp eax, 0x33000
je 0x41655f
cmp eax, 0xd000
jne 0x416270
lea eax, [ebp - 0x10294]
push eax
xor edx, edx
push 8
lea ecx, [ebp - 0x38]
mov word [ebp - 0x38], dx
mov edx, dword [ebp - 0x10228]
push ecx
push edx
push edi
mov dword [ebp - 0x10294], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x1025c], al
jne 0x416249
mov cl, byte [ebp - 0x1025b]
cmp cl, byte [ebp - 0x37]
je 0x416264
cmp byte [ebp - 0x1024c], al
jne 0x4165dc
mov dl, byte [ebp - 0x37]
cmp byte [ebp - 0x1024b], dl
jne 0x4165dc
mov eax, dword [ebp - 0x10224]
push eax
jmp 0x4165bf
cmp eax, 0x7000
jne 0x4162c8
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x10290]
push ecx
push 8
lea edx, [ebp - 0x38]
push edx
push eax
push edi
mov dword [ebp - 0x10290], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x10260]
cmp cl, byte [ebp - 0x38]
jne 0x4165dc
mov dl, byte [ebp - 0x1025f]
cmp dl, byte [ebp - 0x37]
jne 0x4165dc
mov eax, dword [ebp - 0x10224]
push eax
jmp 0x4165bf
add eax, 0xff000000
cmp eax, 0x1000000
ja 0x4163a3
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165dc
cmp dword [ebp - 0x10230], 0x40
jne 0x4165dc
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x10298]
push ecx
push 5
lea edx, [ebp - 0x4d4]
push edx
push eax
push edi
mov dword [ebp - 0x10298], ebx
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4d0], ebx
mov word [ebp - 0x4cc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x10254]
cmp cl, byte [ebp - 0x4d4]
jne 0x4165dc
mov dl, byte [ebp - 0x10253]
cmp dl, byte [ebp - 0x4d3]
jne 0x4165dc
mov al, byte [ebp - 0x10252]
cmp al, byte [ebp - 0x4d2]
jne 0x4165dc
mov eax, 1
add dword [0x470120], eax
cmp dword [0x470124], eax
jne 0x41638c
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4165dc
cmp dword [0x470120], 8
jl 0x4165dc
mov dword [0x470124], eax
jmp 0x4165dc
cmp dword [0x470124], ecx
jne 0x4165dc
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0xa
lea eax, [ebp - 0x100]
push eax
push ecx
push edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov word [ebp - 0xf8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x100]
mov cl, byte [ebp - 0xfc]
cmp eax, dword [ebp - 0x88]
jne 0x41641c
cmp byte [ebp - 0x84], cl
jne 0x41641c
mov dl, byte [ebp - 0x83]
cmp dl, byte [ebp - 0xfb]
jne 0x41641c
mov dl, byte [ebp - 0x82]
cmp dl, byte [ebp - 0xfa]
je 0x416478
cmp eax, dword [ebp - 0x58]
jne 0x41643c
cmp byte [ebp - 0x54], cl
jne 0x41643c
mov dl, byte [ebp - 0xfb]
cmp byte [ebp - 0x53], dl
jne 0x41643c
mov dl, byte [ebp - 0x52]
cmp dl, byte [ebp - 0xfa]
je 0x416478
cmp eax, dword [ebp - 0x98]
jne 0x4165dc
cmp byte [ebp - 0x94], cl
jne 0x4165dc
mov al, byte [ebp - 0xfb]
cmp byte [ebp - 0x93], al
jne 0x4165dc
mov cl, byte [ebp - 0xfa]
cmp byte [ebp - 0x92], cl
jne 0x4165dc
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165dc
cmp dword [ebp - 0x10230], 0x40
jne 0x4165dc
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1000
je 0x4164ad
cmp eax, 0x2000
jne 0x4165dc
mov edx, dword [ebp - 0x10224]
push edx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc3b]
push ebx
push edx
mov byte [ebp - 0xc3c], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc3c]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SALITY.22022012
push str.NPAV4SALITY.22022012
lea edx, [ebp - 0xc3c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
jmp 0x4165dc
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x102a0]
push eax
push 8
lea ecx, [ebp - 0x38]
push ecx
push edx
push edi
mov dword [ebp - 0x102a0], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x10250], al
jne 0x4165a5
mov cl, byte [ebp - 0x1024f]
cmp cl, byte [ebp - 0x37]
jne 0x4165a5
mov edx, dword [ebp - 0x10224]
push edx
jmp 0x4165bf
cmp byte [ebp - 0x1024c], al
jne 0x4165dc
mov al, byte [ebp - 0x37]
cmp byte [ebp - 0x1024b], al
jne 0x4165dc
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [0x470150], ebx
jne 0x4165dc
call fcn.00407f90
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x1a
cmp eax, 0x6000
je 0x4165fb
cmp eax, 0x9000
jne 0x4168db
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4168db
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x4168db
cmp dword [ebp - 0x1023c], eax
jne 0x4168db
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416656
sub eax, edx
je 0x4168db
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4168db
push 0x104
push ebx
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4166a6
sub eax, edx
je 0x4168db
push 0x12c
push ebx
push 0x46fba8
call fcn.0042ea40
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416706
sub eax, edx
je 0x4168db
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4168db
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4168db
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov edi, 1
push str.NPAV4GAMERU.19072016
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.19072016
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45caa0
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x5963]
push ebx
push eax
mov byte [ebp - 0x5964], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x5964]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x5964]
push str.WORM.GAMERU.19072016
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x4168db
cmp dword [0x46f734], ebx
je 0x4168db
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5964]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416842
mov ecx, dword [str.WORM.GAMERU.19072016]
mov edx, dword [0x45d890]
mov eax, dword [0x45d894]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d898]
mov dword [0x46a042], edx
mov edx, dword [0x45d89c]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d8a0]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x4168db
cmp dword [ebp - 0x10238], 0x30000
mov dword [ebp - 4], 0x1c
jbe 0x416b45
cmp dword [ebp - 0x1022c], 0x20000
jne 0x416b45
cmp dword [ebp - 0x10230], 0x40
jne 0x416b45
cmp dword [ebp - 0x1023c], 0x40
jne 0x416b45
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416950
sub eax, edx
je 0x416b45
lea eax, [ebp - 0x434]
push str.POWERSHELL.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x416b45
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.POWERSHELL.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
push str.SMB:_Suspended_POWERSHELL.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x24
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416b45
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4WANNA.NPAV4.30072018
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4WANNA.NPAV4.30072018
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4POWERSHELL.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x3a17]
push ebx
push eax
mov byte [ebp - 0x3a18], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x3a18]
push str.POWERSHELL.EXE__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x3a18]
push str.WORM.WANNA.NPAV4.30072018
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x416afe
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x3a18]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x416aa2
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.WANNA.NPAV4.30072018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push str.POWERSHELL.EXE
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x416b45
push str.WORM.WANNA.NPAV4.30072018
push 0x45c58c
push 0x45c58c
push 0x45c58c
push str.NPAV4POWERSHELL.EXE
lea ecx, [ebp - 0x3a18]
push ecx
push 1
call eax
add esp, 0x1c
jmp 0x416b45
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x1e
cmp eax, 0xc000
je 0x416b6b
cmp eax, 0x12000
je 0x416b6b
cmp eax, 0xd000
jne 0x416ed9
cmp dword [ebp - 0x1022c], 0x20000
jne 0x416ed9
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x416b94
cmp dword [ebp - 0x1023c], eax
jne 0x416ed9
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416bc8
sub eax, edx
je 0x416ed9
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x416ed9
push 0x104
push ebx
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416c18
sub eax, edx
je 0x416ed9
push 0x12c
push ebx
push 0x46fba8
call fcn.0042ea40
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416c78
sub eax, edx
je 0x416ed9
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x416ed9
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0xa
lea edx, [ebp - 0x440]
push edx
push eax
push ecx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov word [ebp - 0x438], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dl, byte [ebp - 0x10258]
cmp dl, byte [ebp - 0x440]
jne 0x416d02
mov al, byte [ebp - 0x10257]
cmp al, byte [ebp - 0x43f]
jne 0x416d02
mov cl, byte [ebp - 0x10256]
cmp cl, byte [ebp - 0x43e]
je 0x416d26
mov edx, dword [ebp - 0x440]
cmp edx, dword [ebp - 0xe8]
jne 0x416ed9
mov al, byte [ebp - 0xe4]
cmp al, byte [ebp - 0x43c]
jne 0x416ed9
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416ed9
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov edi, 1
push str.NPAV4GAMERU.16032017
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.16032017
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45caa0
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x5b67]
push ebx
push eax
mov byte [ebp - 0x5b68], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x5b68]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x5b68]
push str.WORM.GAMERU.16032017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x416ed9
cmp dword [0x46f734], ebx
je 0x416ed9
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5b68]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416e40
mov ecx, dword [str.WORM.GAMERU.16032017]
mov edx, dword [0x45d7a0]
mov eax, dword [0x45d7a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d7a8]
mov dword [0x46a042], edx
mov edx, dword [0x45d7ac]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d7b0]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x416ed9
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x20
jne 0x4172df
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x416f09
cmp dword [ebp - 0x1023c], eax
jne 0x4172df
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2c000
jne 0x4172df
push str.0x2C000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x8ec0]
push ebx
push eax
mov dword [ebp - 0x1027c], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x1027c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0x500
lea edx, [ebp - 0x8ec0]
push edx
add eax, 0x2a11e
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8ec0]
test edx, edx
je 0x4172df
cmp dword [ebp - 0x1027c], 0x500
jne 0x4172df
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x8ec0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4172df
push str.match_87_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4172df
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xa67]
push ebx
push edx
mov byte [ebp - 0xa68], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa68]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.1
push str.NPAV4CERBER.20092016.1
lea edx, [ebp - 0xa68]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x5d6b]
push ebx
push eax
mov byte [ebp - 0x5d6c], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5d6c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x5d6c]
push str.WORM.CERBER.20092016.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41715b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5d6c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417100
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x4171a0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4171a0
cmp dword [0x470144], ebx
je 0x4171d0
lea ecx, [ebp - 0x10338]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x4b43]
push ebx
push edx
mov byte [ebp - 0x4b44], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x23ff]
push ebx
push eax
mov byte [ebp - 0x2400], bl
call fcn.0042ea40
mov ecx, dword [ebp - 0x10218]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x4172a1
lea edx, [ebp - 0x2400]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417222
lea eax, [ebp - 0x2400]
push eax
lea ecx, [ebp - 0x4b44]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x4b44]
push edx
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4172a1
lea ecx, [ebp - 0x4b44]
push ecx
lea edx, [ebp - 0x2400]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x417294
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4172a1
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x22
jne 0x4176e5
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41730f
cmp dword [ebp - 0x1023c], eax
jne 0x4176e5
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x26000
jne 0x4176e5
push str.0x26000
call fcn.004073f0
push 0x500
lea edx, [ebp - 0x8ec0]
push ebx
push edx
mov dword [ebp - 0x1028c], ebx
call fcn.0042ea40
mov edx, dword [ebp - 0x10228]
add esp, 0x10
lea eax, [ebp - 0x1028c]
push eax
mov eax, dword [ebp - 0x10220]
push 0x500
lea ecx, [ebp - 0x8ec0]
push ecx
add edx, 0x2411e
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8ec0]
test ecx, ecx
je 0x4176e5
cmp dword [ebp - 0x1028c], 0x500
jne 0x4176e5
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x8ec0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4176e5
push str.match_87_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4176e5
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xca3]
push ebx
push eax
mov byte [ebp - 0xca4], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xca4]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.2
push str.NPAV4CERBER.20092016.2
lea eax, [ebp - 0xca4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x5f6f]
push ebx
push ecx
mov byte [ebp - 0x5f70], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x5f70]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x5f70]
push str.WORM.CERBER.20092016.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41756c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x5f70]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417511
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x4175b0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4175b0
cmp dword [0x470144], ebx
je 0x4175e0
lea edx, [ebp - 0x10340]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x6e93]
push ebx
push eax
mov byte [ebp - 0x6e94], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x15ff]
push ebx
push ecx
mov byte [ebp - 0x1600], bl
call fcn.0042ea40
mov edx, dword [ebp - 0x10218]
mov eax, dword [edx + 4]
push eax
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x4176b1
lea edx, [ebp - 0x1600]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417632
lea ecx, [ebp - 0x1600]
push ecx
lea edx, [ebp - 0x6e94]
push str._s.np4
push edx
call fcn.0042ebd6
add esp, 0xc
push 1
lea eax, [ebp - 0x6e94]
push eax
lea ecx, [ebp - 0x1600]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4176b1
lea edx, [ebp - 0x6e94]
push edx
lea eax, [ebp - 0x1600]
push eax
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x4176a4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4176b1
lea ecx, [ebp - 0x1600]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10220]
push 9
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
mov eax, dword [ebp - 0x1022c]
mov dword [ebp - 4], 0x24
cmp eax, 0x20000
je 0x417704
cmp eax, 0x40000
jne 0x417ae5
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41771d
cmp dword [ebp - 0x1023c], eax
jne 0x417ae5
push str.map_and_RWE
call fcn.004073f0
mov esi, dword [ebp - 0x10238]
add esp, 4
cmp esi, 0x1e00
jb 0x417ae5
push 0x500
lea eax, [ebp - 0x8ec0]
push ebx
push eax
mov dword [ebp - 0x10288], ebx
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
add esp, 0xc
lea ecx, [ebp - 0x10288]
push ecx
push 0x500
lea edx, [ebp - 0x8ec0]
push edx
mov edx, dword [ebp - 0x10220]
lea ecx, [esi + eax - 0x1e00]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x8ec0]
test eax, eax
je 0x417ae5
cmp dword [ebp - 0x10288], 0x500
jne 0x417ae5
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea ecx, [ebp - 0x2c0]
push ecx
lea edx, [ebp - 0x8ec0]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x417ae5
push str.match_87_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417ae5
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xacf]
push ebx
push edx
mov byte [ebp - 0xad0], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xad0]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.3
push str.NPAV4CERBER.20092016.3
lea edx, [ebp - 0xad0]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x6173]
push ebx
push eax
mov byte [ebp - 0x6174], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6174]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x6174]
push str.WORM.CERBER.20092016.3
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x417973
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6174]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417918
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4179b0
cmp dword [0x470144], ebx
je 0x4179e0
lea ecx, [ebp - 0x1034c]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x5a63]
push ebx
push edx
mov byte [ebp - 0x5a64], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x18ff]
push ebx
push eax
mov byte [ebp - 0x1900], bl
call fcn.0042ea40
mov ecx, dword [ebp - 0x10218]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x417ab1
lea edx, [ebp - 0x1900]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417a32
lea eax, [ebp - 0x1900]
push eax
lea ecx, [ebp - 0x5a64]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x5a64]
push edx
lea eax, [ebp - 0x1900]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x417ab1
lea ecx, [ebp - 0x5a64]
push ecx
lea edx, [ebp - 0x1900]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x417aa4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x417ab1
lea eax, [ebp - 0x1900]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1c000
je 0x417afd
cmp eax, 0x1e000
jne 0x417ec9
cmp dword [ebp - 0x10230], 0x40
je 0x417b16
cmp dword [ebp - 0x1023c], 0x80
jne 0x417ec9
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x1022c]
add esp, 4
cmp eax, 0x1000000
je 0x417b3b
cmp eax, 0x20000
jne 0x417ec9
push str.0X1C000
call fcn.004073f0
mov esi, dword [ebp - 0x10228]
mov ecx, dword [ebp - 0x10220]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 4
lea edx, [ebp - 0x10264]
push edx
push 0xa
lea eax, [ebp - 0x46c]
push eax
push esi
push ecx
mov dword [ebp - 0x10264], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x464], bx
call edi
mov edx, dword [ebp - 0x46c]
cmp edx, dword [ebp - 0xa8]
jne 0x417ec9
mov al, byte [ebp - 0xa4]
cmp al, byte [ebp - 0x468]
jne 0x417ec9
mov cl, byte [ebp - 0xa3]
cmp cl, byte [ebp - 0x467]
jne 0x417ec9
mov dl, byte [ebp - 0xa2]
cmp dl, byte [ebp - 0x466]
jne 0x417ec9
push str.match_7_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10220]
add esp, 4
lea eax, [ebp - 0x10264]
push eax
push 0x200
lea ecx, [ebp - 0x92c0]
push ecx
add esi, 0xc300
push esi
push edx
call edi
lea eax, [ebp - 0x92c0]
test eax, eax
je 0x417ec9
cmp dword [ebp - 0x10264], 0x200
jne 0x417ec9
push str.read_successful_and_act_bytes
call fcn.004073f0
add esp, 4
mov ecx, 0x12
lea eax, [ebp - 0x198]
lea esi, [ebp - 0x9274]
jmp 0x417c40
mov edx, dword [esi]
cmp edx, dword [eax]
jne 0x417c69
sub ecx, 4
add eax, 4
add esi, 4
cmp ecx, 4
jae 0x417c40
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x417c69
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
jne 0x417c69
mov esi, 1
jmp 0x417c92
push str.going_to_serach_not_match_first_condition
call fcn.004073f0
push 0x12
push 0x200
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x92c0]
push ecx
call fcn.00408390
add esp, 0x14
mov esi, eax
push str.match_1st_Condition
call fcn.004073f0
mov edi, 1
add esp, 4
cmp esi, edi
jne 0x417ec9
push str.match_18_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x26
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417ec9
push str.Sig_found_and_suspend_
call fcn.004073f0
add esp, 4
mov dword [0x470164], edi
cmp dword [0x470154], ebx
jne 0x417d1b
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10354]
push eax
push ebx
push ebx
push 0x40c550
push ebx
push ebx
call esi
lea ecx, [ebp - 0x10348]
push ecx
push ebx
push ebx
push 0x40f030
push ebx
push ebx
call esi
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470154], edi
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xd0b]
push ebx
push eax
mov byte [ebp - 0xd0c], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xd0c]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PIONEER.05102016
push str.NPAV4PIONEER.05102016
lea eax, [ebp - 0xd0c]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x6377]
push ebx
push ecx
mov byte [ebp - 0x6378], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6378]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x6378]
push str.WORM.PIONEER.05102016
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x417ecf
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6378]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x417e30
mov ecx, dword [0x45d640]
mov eax, dword [str.WORM.PIONEER.05102016]
mov edx, dword [0x45d644]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d64c]
mov dword [0x46a03e], eax
mov eax, dword [0x45d648]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dx, word [0x45d650]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x417ec9
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x11000
je 0x417ee7
cmp eax, 0x10000
jne 0x418306
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x417f00
cmp dword [ebp - 0x1023c], eax
jne 0x418306
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x1022c]
add esp, 4
cmp eax, 0x20000
je 0x417f25
cmp eax, 0x1000000
jne 0x418306
push str.0X11000_0X10000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0x10214]
push ebx
push edx
call fcn.0042ea40
mov edx, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x1000
lea ecx, [ebp - 0x10214]
push ecx
add edx, 0x4000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1000
jne 0x418306
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x10214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418306
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0x10214]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418306
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x28
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xb37]
push ebx
push eax
mov byte [ebp - 0xb38], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xb38]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.09012017.1
push str.NPAV4CRYSIS.09012017.1
lea eax, [ebp - 0xb38]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x78ab]
push ebx
push ecx
mov byte [ebp - 0x78ac], bl
call fcn.0042ea40
push 0xff
lea edx, [ebp - 0x1aff]
push ebx
push edx
mov byte [ebp - 0x1b00], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x418155
mov ecx, eax
lea edx, [ebp - 0x1b00]
jmp 0x4180e0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4180e0
lea ecx, [ebp - 0x1b00]
push ecx
lea edx, [ebp - 0x78ac]
push str._s.np4
push edx
call fcn.0042ebd6
add esp, 0xc
push 1
lea eax, [ebp - 0x78ac]
push eax
lea ecx, [ebp - 0x1b00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418155
lea edx, [ebp - 0x78ac]
push edx
lea eax, [ebp - 0x1b00]
push eax
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x418148
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418155
lea ecx, [ebp - 0x1b00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x657f]
push ebx
push edx
mov byte [ebp - 0x6580], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6580]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x6580]
push str.WORM.CRYSIS.09012017.1
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41822d
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6580]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4181d0
mov dl, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4182a8
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x418280
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418280
cmp dword [0x470144], ebx
je 0x4182a8
lea eax, [ebp - 0x1033c]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040ec00
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x4182db
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0x3000
jne 0x418736
cmp dword [ebp - 0x10230], 0x20
je 0x41832f
cmp dword [ebp - 0x1023c], 0x80
jne 0x418f79
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418736
push str.0X3000
call fcn.004073f0
push 0x100
lea edx, [ebp - 0x876c]
push ebx
push edx
call fcn.0042ea40
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x100
lea ecx, [ebp - 0x876c]
push ecx
push 0x40d500
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x100
jne 0x418736
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x100
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x876c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418736
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x100
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0x876c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418736
push str.match_12_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2a
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xcd7]
push ebx
push edx
mov byte [ebp - 0xcd8], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xcd8]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.09012017.2
push str.NPAV4CRYSIS.09012017.2
lea edx, [ebp - 0xcd8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x5c67]
push ebx
push eax
mov byte [ebp - 0x5c68], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x1cff]
push ebx
push ecx
mov byte [ebp - 0x1d00], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x418582
mov ecx, eax
lea edx, [ebp - 0x1d00]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418500
lea eax, [ebp - 0x1d00]
push eax
lea ecx, [ebp - 0x5c68]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x5c68]
push edx
lea eax, [ebp - 0x1d00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418582
lea ecx, [ebp - 0x5c68]
push ecx
lea edx, [ebp - 0x1d00]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x418575
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418582
lea eax, [ebp - 0x1d00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x6787]
push ebx
push ecx
mov byte [ebp - 0x6788], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6788]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x6788]
push str.WORM.CRYSIS.09012017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41865b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6788]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418600
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4186d8
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4186b0
cmp dword [0x470144], ebx
je 0x4186d8
lea edx, [ebp - 0x102e0]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040ec00
mov eax, dword [0x470178]
add esp, 4
cmp eax, ebx
je 0x4186f2
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x136000
je 0x418755
cmp eax, 0x134000
je 0x418755
cmp eax, 0x135000
jne 0x418b57
cmp dword [ebp - 0x10230], 0x40
jne 0x418b57
cmp dword [ebp - 0x1023c], 0x80
jne 0x418b57
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418b57
push str.0X136000
call fcn.004073f0
push 0x32
lea ecx, [ebp - 0xd40]
push ebx
push ecx
call fcn.0042ea40
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea edx, [ebp - 0x1021c]
push edx
push 0x32
lea eax, [ebp - 0xd40]
push eax
push 0x406020
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x418b57
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0xd40]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418b57
push str.match_11_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2c
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x68b]
push ebx
push edx
mov byte [ebp - 0x68c], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x68c]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4STOPRANSOM.NPAV4.18112019
push str.NPAV4STOPRANSOM.NPAV4.18112019
lea edx, [ebp - 0x68c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x412b]
push ebx
push eax
mov byte [ebp - 0x412c], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x1eff]
push ebx
push ecx
mov byte [ebp - 0x1f00], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x418986
mov ecx, eax
lea edx, [ebp - 0x1f00]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418904
lea eax, [ebp - 0x1f00]
push eax
lea ecx, [ebp - 0x412c]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x412c]
push edx
lea eax, [ebp - 0x1f00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418986
lea ecx, [ebp - 0x412c]
push ecx
lea edx, [ebp - 0x1f00]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x418979
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418986
lea eax, [ebp - 0x1f00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3c1b]
push ebx
push ecx
mov byte [ebp - 0x3c1c], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3c1c]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x3c1c]
push str.WORM.STOPRANSOM.NPAV4.18112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x418a5c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x3c1c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418a01
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418ad8
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418ab0
cmp dword [0x470144], ebx
je 0x418ad8
lea edx, [ebp - 0x102bc]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418b11
push str.WORM.STOPRANSOM.NPAV4.18112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x412c]
push ecx
lea edx, [ebp - 0x68c]
push edx
lea ecx, [ebp - 0x3c1c]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418b35
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.STOPRANSOM.18112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0xd000
jne 0x418f5d
cmp dword [ebp - 0x10230], 0x40
jne 0x4197e6
cmp dword [ebp - 0x1023c], 0x80
jne 0x4197e6
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418f5d
push str.0XD000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xddc]
push ebx
push eax
call fcn.0042ea40
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x32
lea edx, [ebp - 0xddc]
push edx
push 0x40d3e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x418f5d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0xddc]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418f5d
push str.match_11_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
push ebx
push edx
mov dword [ebp - 4], 0x2e
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x75b]
push ebx
push edx
mov byte [ebp - 0x75c], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x75c]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4DEATHRANSOM.NPAV4.22112019
push str.NPAV4DEATHRANSOM.NPAV4.22112019
lea edx, [ebp - 0x75c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x3913]
push ebx
push eax
mov byte [ebp - 0x3914], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x20ff]
push ebx
push ecx
mov byte [ebp - 0x2100], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x418d98
mov ecx, eax
lea edx, [ebp - 0x2100]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418d16
lea eax, [ebp - 0x2100]
push eax
lea ecx, [ebp - 0x3914]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x3914]
push edx
lea eax, [ebp - 0x2100]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418d98
lea ecx, [ebp - 0x3914]
push ecx
lea edx, [ebp - 0x2100]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x418d8b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418d98
lea eax, [ebp - 0x2100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3e23]
push ebx
push ecx
mov byte [ebp - 0x3e24], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3e24]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x3e24]
push str.WORM.DEATHRANSOM.NPAV4.22112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x418e6b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x3e24]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418e13
mov eax, dword [str.NPA4]
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418ede
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
push 0x104
push ebx
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418eb6
cmp dword [0x470144], ebx
je 0x418ede
lea edx, [ebp - 0x102cc]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418f17
push str.WORM.DEATHRANSOM.NPAV4.22112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3914]
push ecx
lea edx, [ebp - 0x75c]
push edx
lea ecx, [ebp - 0x3e24]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418f3b
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.DEATHRANSOM.22112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0x2000
je 0x418f79
cmp dword [ebp - 0x10238], 0x3000
jne 0x419387
cmp dword [ebp - 0x10230], 0x40
jne 0x419387
cmp dword [ebp - 0x1023c], 0x80
jne 0x419387
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x419387
push str.0X2000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xd74]
push ebx
push eax
call fcn.0042ea40
mov eax, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x32
lea edx, [ebp - 0xd74]
push edx
add eax, 0x11c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x419387
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x12
push 0x32
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0xd74]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x419387
push str.match_18_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x30
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x623]
push ebx
push edx
mov byte [ebp - 0x624], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x624]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SIFRELENDI.NPAV4.19122019
push str.NPAV4SIFRELENDI.NPAV4.19122019
lea edx, [ebp - 0x624]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x3303]
push ebx
push eax
mov byte [ebp - 0x3304], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x22ff]
push ebx
push ecx
mov byte [ebp - 0x2300], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x4191b2
mov ecx, eax
lea edx, [ebp - 0x2300]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419130
lea eax, [ebp - 0x2300]
push eax
lea ecx, [ebp - 0x3304]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x3304]
push edx
lea eax, [ebp - 0x2300]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4191b2
lea ecx, [ebp - 0x3304]
push ecx
lea edx, [ebp - 0x2300]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x4191a5
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4191b2
lea eax, [ebp - 0x2300]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x402b]
push ebx
push ecx
mov byte [ebp - 0x402c], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x402c]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x402c]
push str.WORM.SIFRELENDI.NPAV4.19122019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41928b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x402c]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419230
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x419308
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4192e0
cmp dword [0x470144], ebx
je 0x419308
lea edx, [ebp - 0x102d8]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x419341
push str.WORM.SIFRELENDI.NPAV4.19122019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3304]
push ecx
lea edx, [ebp - 0x624]
push edx
lea ecx, [ebp - 0x402c]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x419365
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.SIFRELENDI.19122019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1d000
je 0x4193a6
cmp eax, 0x1c000
je 0x4193a6
cmp eax, 0x22000
jne 0x4197e6
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4197e6
push str.MEM_PRIVATE
call fcn.004073f0
mov eax, 0x40
add esp, 4
cmp dword [ebp - 0x10230], eax
je 0x4193dc
cmp dword [ebp - 0x1023c], eax
jne 0x4197e6
push str.PAGE_EXECUTE_READWRITE
call fcn.004073f0
push 0x200
lea eax, [ebp - 0x90c0]
push ebx
push eax
call fcn.0042ea40
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x200
lea edx, [ebp - 0x90c0]
push edx
push 0x40c400
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x200
jne 0x4197e6
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x200
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x90c0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4197e6
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x200
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0x90c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4197e6
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x32
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xb9f]
push ebx
push eax
mov byte [ebp - 0xba0], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xba0]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.06022017.3
push str.NPAV4CRYSIS.06022017.3
lea eax, [ebp - 0xba0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x8567]
push ebx
push ecx
mov byte [ebp - 0x8568], bl
call fcn.0042ea40
push 0xff
lea edx, [ebp - 0x24ff]
push ebx
push edx
mov byte [ebp - 0x2500], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41963a
mov ecx, eax
lea edx, [ebp - 0x2500]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419590
lea ecx, [ebp - 0x2500]
push ecx
lea edx, [ebp - 0x8568]
push str._s.np4
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x8568]
push eax
lea ecx, [ebp - 0x2500]
push ecx
call fcn.0043081d
add esp, 0x14
test eax, eax
jne 0x4195eb
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41963a
push 0x1f2
lea eax, [ebp - 0x99b2]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x99b4], dx
call fcn.0042ea40
lea ecx, [ebp - 0x2500]
push 0x5c
push ecx
call fcn.0042ef70
add esp, 0x14
cmp eax, ebx
je 0x41961d
mov byte [eax], bl
lea edx, [ebp - 0x99b4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x2500]
push ecx
call fcn.0040a680
add esp, 0xc
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x6b8f]
push ebx
push edx
mov byte [ebp - 0x6b90], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6b90]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x6b90]
push str.WORM.CRYSIS.06022017.3
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x419712
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6b90]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4196b5
mov dl, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x419788
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419760
cmp dword [0x470144], ebx
je 0x419788
lea eax, [ebp - 0x102fc]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040ec00
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x4197bb
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x34
cmp eax, 0x38000
je 0x419821
cmp eax, 0x3a000
je 0x419821
cmp eax, 0x34000
je 0x419821
cmp eax, 0x3b000
je 0x419821
cmp eax, 0x91000
je 0x419821
cmp eax, 0x39000
jne 0x419bc8
cmp dword [ebp - 0x1022c], 0x20000
jne 0x419bc8
mov ecx, 0x40
cmp dword [ebp - 0x10230], ecx
je 0x41984a
cmp dword [ebp - 0x1023c], ecx
jne 0x419bc8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419878
sub eax, edx
je 0x419bc2
lea edx, [ebp - 0x434]
push str.EXPLORER.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x4198eb
lea eax, [ebp - 0x434]
push str.CHROME.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x4198eb
lea ecx, [ebp - 0x434]
push str.IEXPLORE.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x4198eb
lea edx, [ebp - 0x434]
push str.FIREFOX.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x419bc2
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
mov eax, dword [ebp - 0x10220]
push 0xa
lea ecx, [ebp - 0x330]
push ecx
push edx
push eax
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov word [ebp - 0x328], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x330]
mov cl, byte [ebp - 0x32c]
cmp eax, dword [ebp - 0x30]
jne 0x419943
cmp byte [ebp - 0x2c], cl
jne 0x419943
mov dl, byte [ebp - 0x2b]
cmp dl, byte [ebp - 0x32b]
je 0x41998b
cmp eax, dword [ebp - 0xd0]
jne 0x419961
cmp byte [ebp - 0xcc], cl
jne 0x419961
mov dl, byte [ebp - 0xcb]
cmp dl, byte [ebp - 0x32b]
je 0x41998b
cmp eax, dword [ebp - 0xc0]
jne 0x419bc2
cmp byte [ebp - 0xbc], cl
jne 0x419bc2
mov al, byte [ebp - 0x32b]
cmp byte [ebp - 0xbb], al
jne 0x419bc2
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419bc2
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6d93]
push ebx
push eax
mov byte [ebp - 0x6d94], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6d94]
push str.AR8__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x6d94]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419b19
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6d94]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419a90
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d3a0]
mov eax, dword [0x45d3a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d3a8]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a042], edx
mov dx, word [0x45d3ac]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419bc2
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov eax, dword [0x45d3a0]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d3a4]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d3a8]
mov dword [0x46f73c], eax
mov ax, word [0x45d3ac]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042ea40
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d398]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419bc2
lea eax, [ebp - 0x1032c]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x36
cmp eax, 0x96000
je 0x419be8
cmp eax, 0x93000
je 0x419be8
cmp eax, 0x94000
jne 0x419eca
cmp dword [ebp - 0x1022c], 0x20000
jne 0x419eca
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x419c11
cmp dword [ebp - 0x1023c], eax
jne 0x419eca
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0xa
lea edx, [ebp - 0x44c]
push edx
push eax
push ecx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov word [ebp - 0x444], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x30]
jne 0x419c69
mov dl, byte [ebp - 0x2c]
cmp dl, byte [ebp - 0x448]
jne 0x419c69
mov cl, byte [ebp - 0x2b]
cmp cl, byte [ebp - 0x447]
je 0x419c99
cmp eax, dword [ebp - 0xc8]
jne 0x419eca
mov dl, byte [ebp - 0x448]
cmp byte [ebp - 0xc4], dl
jne 0x419eca
mov al, byte [ebp - 0x447]
cmp byte [ebp - 0xc3], al
jne 0x419eca
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419eca
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6f97]
push ebx
push eax
mov byte [ebp - 0x6f98], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6f98]
push str.AR8__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x6f98]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419e21
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x6f98]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419d98
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d3a0]
mov eax, dword [0x45d3a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d3a8]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a042], edx
mov dx, word [0x45d3ac]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419eca
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov eax, dword [0x45d3a0]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d3a4]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d3a8]
mov dword [0x46f73c], eax
mov ax, word [0x45d3ac]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042ea40
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d398]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419eca
lea eax, [ebp - 0x10304]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x38
jne 0x41a360
mov eax, dword [ebp - 0x10238]
cmp eax, 0x14000
je 0x419ef9
cmp eax, 0x13000
jne 0x41a360
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41a360
cmp dword [ebp - 0x1023c], eax
jne 0x41a360
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042ea40
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419f44
sub eax, edx
je 0x41a360
lea ecx, [ebp - 0x434]
push str.CacheMgr.exe
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x419f87
lea edx, [ebp - 0x434]
push str.dwm22.exe
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41a360
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
mov eax, dword [ebp - 0x10220]
push 0xa
lea ecx, [ebp - 0x4f8]
push ecx
push edx
push eax
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov word [ebp - 0x4f0], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, 9
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x4f8]
nop
cmp edx, 4
jb 0x41a01d
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x41a360
sub edx, 4
add eax, 4
add ecx, 4
jmp 0x419fd0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a360
push str.FAEDEVOUR:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a360
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4FAEDEVOUR.22022017
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push str.NPAV4FAEDEVOUR.22022017
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea edx, [ebp - 0x719b]
push ebx
push edx
mov byte [ebp - 0x719c], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
lea edx, [ebp - 0x719c]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x719c]
push str.WORM.FAEDEVOUR.22022017
push eax
call fcn.0040a000
add esp, 0x44
cmp dword [0x46f734], ebx
je 0x41a1c3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x719c]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a130
mov ecx, dword [str.WORM.FAEDEVOUR.22022017]
mov edx, dword [0x45d328]
mov eax, dword [0x45d32c]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d330]
mov dword [0x46a042], edx
mov edx, dword [0x45d334]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov eax, dword [0x45d338]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a052], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
push 0xff
lea eax, [ebp - 0x7097]
push ebx
push eax
mov byte [ebp - 0x7098], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x26ff]
push ebx
push ecx
mov byte [ebp - 0x2700], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41a298
lea edx, [ebp - 0x2700]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41a210
lea eax, [ebp - 0x2700]
push eax
lea ecx, [ebp - 0x7098]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x7098]
push edx
lea eax, [ebp - 0x2700]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a298
lea ecx, [ebp - 0x7098]
push ecx
lea edx, [ebp - 0x2700]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41a28b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a298
lea eax, [ebp - 0x2700]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x470160], ebx
jne 0x41a360
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov edx, dword [str.WORM.FAEDEVOUR.22022017]
mov eax, dword [0x45d328]
mov ecx, dword [0x45d32c]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d330]
mov dword [0x46f73c], eax
mov eax, dword [0x45d334]
mov dword [0x46f740], ecx
mov ecx, dword [0x45d338]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41a330
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a330
cmp dword [0x470144], ebx
je 0x41a360
lea edx, [ebp - 0x102c8]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x10238], 0x3000
mov dword [ebp - 4], 0x3a
jne 0x41a863
cmp dword [ebp - 0x10230], 0x20
je 0x41a38d
cmp dword [ebp - 0x1023c], 0x40
jne 0x41a863
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41a863
push str.0x3000
call fcn.004073f0
mov edi, dword [ebp - 0x10228]
mov edx, dword [ebp - 0x10220]
add esp, 4
lea eax, [ebp - 0x10268]
push eax
push 0xa
lea ecx, [ebp - 0x460]
push ecx
push edi
push edx
mov dword [ebp - 0x10268], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov word [ebp - 0x458], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0xb8]
jne 0x41a863
mov cl, byte [ebp - 0xb4]
cmp cl, byte [ebp - 0x45c]
jne 0x41a863
mov dl, byte [ebp - 0xb3]
cmp dl, byte [ebp - 0x45b]
jne 0x41a863
mov al, byte [ebp - 0xb2]
cmp al, byte [ebp - 0x45a]
jne 0x41a863
push 0x200
lea ecx, [ebp - 0x9bb4]
push ebx
push ecx
call fcn.0042ea40
mov ecx, dword [ebp - 0x10220]
add esp, 0xc
lea edx, [ebp - 0x10268]
push edx
push 0x200
lea eax, [ebp - 0x9bb4]
push eax
add edi, 0x900
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x10268], 0x200
jne 0x41a863
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x1f
push 0x200
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x9bb4]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41a863
push str.match_31_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 8
push str.Program_files
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x41a863
mov edx, dword [ebp - 0x10224]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a863
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc6f]
push ebx
push edx
mov byte [ebp - 0xc70], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc70]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4BTCWARE.12042017.1
push str.NPAV4BTCWARE.12042017.1
lea edx, [ebp - 0xc70]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x739f]
push ebx
push eax
mov byte [ebp - 0x73a0], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x73a0]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x73a0]
push str.WORM.BTCWARE.12042017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41a6a1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x73a0]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a610
mov edx, dword [str.WORM.BTCWARE.12042017.1]
mov eax, dword [0x45d2d4]
mov ecx, dword [0x45d2d8]
mov dword [0x46a03e], edx
mov edx, dword [0x45d2dc]
mov dword [0x46a042], eax
mov eax, dword [0x45d2e0]
mov dword [0x46a046], ecx
mov ecx, dword [0x45d2e4]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41a750
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, dword [str.WORM.BTCWARE.12042017.1]
mov edx, dword [0x45d2d4]
mov eax, dword [0x45d2d8]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d2dc]
mov dword [0x46f73c], edx
mov edx, dword [0x45d2e0]
mov dword [0x46f740], eax
mov eax, dword [0x45d2e4]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov dword [0x46f74c], eax
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a720
cmp dword [0x470144], ebx
je 0x41a750
lea ecx, [ebp - 0x102d0]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x5e6b]
push ebx
push edx
mov byte [ebp - 0x5e6c], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x28ff]
push ebx
push eax
mov byte [ebp - 0x2900], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41a825
lea edx, [ebp - 0x2900]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41a7a0
lea edx, [ebp - 0x2900]
push edx
lea eax, [ebp - 0x5e6c]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5e6c]
push ecx
lea edx, [ebp - 0x2900]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a825
lea eax, [ebp - 0x5e6c]
push eax
lea ecx, [ebp - 0x2900]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41a818
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a825
lea edx, [ebp - 0x2900]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10220]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x3c
jne 0x41ac51
cmp dword [ebp - 0x10238], 0x11000
jb 0x41ac51
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41ac51
cmp dword [ebp - 0x1023c], eax
jne 0x41ac51
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042ea40
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41a8d5
sub eax, edx
je 0x41ac51
lea ecx, [ebp - 0x434]
push str.SVCHOST.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x41a918
lea edx, [ebp - 0x434]
push str.SPOOLSV.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41ac51
push str.Chengdu:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41ac51
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x7f7]
push ebx
push edx
mov byte [ebp - 0x7f8], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7f8]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Chengdu.22032022
push str.NPAV4Chengdu.22032022
lea edx, [ebp - 0x7f8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x422f]
push ebx
push eax
mov byte [ebp - 0x4230], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4230]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x4230]
push str.WORM.CHENGDU.22032022
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41ab05
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4230]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41aa72
mov edx, dword [str.WORM.CHENGDU.22032022]
mov eax, dword [0x45d278]
mov ecx, dword [0x45d27c]
mov dword [0x46a03e], edx
mov edx, dword [0x45d280]
mov dword [0x46a042], eax
mov eax, dword [0x45d284]
mov dword [0x46a046], ecx
mov cx, word [0x45d288]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41ac2d
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov eax, dword [0x45d264]
mov ecx, dword [str.WORM.CHENGDU.25052017]
mov edx, dword [0x45d260]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d268]
mov dword [0x46f73c], edx
mov edx, dword [0x45d26c]
mov dword [0x46f740], eax
mov ax, word [0x45d270]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41ab90
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41ab90
push 0x44
lea ecx, [ebp - 0x10398]
push ebx
push ecx
call fcn.0042ea40
add esp, 0xc
lea edx, [ebp - 0x102b0]
push edx
lea eax, [ebp - 0x10398]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.IPSEC_STATIC_DELETE_POLICY_NAMEQIANYE
push str.C:WINDOWSSYSTEM32NETSH.EXE
mov dword [ebp - 0x10398], 0x44
mov dword [ebp - 0x102b0], ebx
mov dword [ebp - 0x102ac], ebx
mov dword [ebp - 0x102a8], ebx
mov dword [ebp - 0x102a4], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41ac2d
push 0x46f738
call fcn.00407460
add esp, 4
test eax, eax
jne 0x41ac2d
cmp dword [0x470144], ebx
je 0x41ac2d
lea ecx, [ebp - 0x10334]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea edx, [ebp - 0x4230]
push str.WORM.CHENGDU.NPAV4.25052017
push edx
call fcn.0040a000
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x1022c], 0x40000
mov dword [ebp - 4], 0x3e
jne 0x41af36
cmp dword [ebp - 0x10238], 0x2ee0
jb 0x41af36
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41af36
cmp dword [ebp - 0x1023c], eax
jne 0x41af36
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042ea40
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41acc3
sub eax, edx
je 0x41af36
lea ecx, [ebp - 0x434]
push str.EXPLORER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41af36
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x20]
push str.pid_d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x20]
push ecx
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41af30
mov dword [0x470164], 1
call fcn.0040c260
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [ebp - 0x75a7]
push ebx
push edx
mov byte [ebp - 0x75a8], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x75a8]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x75a8]
push str.WORM.DOFOIL.NPAV4.23032018
push eax
call fcn.0040a000
add esp, 0x38
cmp dword [0x470160], ebx
jne 0x41af30
push 0x31
lea ecx, [ebp - 0x82b]
push ebx
push ecx
mov byte [ebp - 0x82c], bl
call fcn.0042ea40
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x82c]
push str.NPAV4_s
push eax
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4DOFOIL.NPAV4.23032018
push str.NPAV4DOFOIL.NPAV4.23032018
lea ecx, [ebp - 0x82c]
push 0x45caa0
push ecx
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41aebb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x75a8]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41ae60
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41af00
cmp dword [0x470144], ebx
je 0x41af30
lea ecx, [ebp - 0x1030c]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x1022c], 0x40000
mov eax, 0x40
mov dword [ebp - 4], eax
jne 0x41b22a
cmp dword [ebp - 0x10238], 0x55f0
jb 0x41b22a
cmp dword [ebp - 0x10230], eax
jne 0x41b22a
cmp dword [ebp - 0x1023c], eax
jne 0x41b22a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41afa4
sub eax, edx
je 0x41b22a
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x41b22a
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b22a
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042ea40
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x77ab]
push ebx
push ecx
mov byte [ebp - 0x77ac], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x77ac]
push str._s__d
push ecx
call fcn.0042ebd6
add esp, 0x30
cmp dword [0x470160], ebx
jne 0x41b200
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x31
mov dword [0x46ff94], eax
lea eax, [ebp - 0x893]
push ebx
push eax
mov byte [ebp - 0x894], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x894]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
lea eax, [ebp - 0x894]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41b181
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x77ac]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b124
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41b1d0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b1d0
cmp dword [0x470144], ebx
je 0x41b200
lea eax, [ebp - 0x102c4]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea ecx, [ebp - 0x77ac]
push str.WORM.CRY_MSIEXC.NPAV4.06032019
push ecx
call fcn.0040a000
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x42
jne 0x41b6f3
cmp dword [ebp - 0x10238], 0x9000
jne 0x41b6f3
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41b6f3
cmp dword [ebp - 0x1023c], eax
jne 0x41b6f3
mov eax, dword [esi + 4]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
jne 0x41b2e0
mov eax, dword [ebp - 0x10224]
cmp eax, ebx
je 0x41b299
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10220]
cmp eax, ebx
je 0x41dcc9
push eax
jmp 0x41dcc3
push 0x104
lea ecx, [ebp - 0xee0]
push ebx
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [ebp - 0xee0]
push edx
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xee0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41b318
sub eax, edx
je 0x41b6f3
lea eax, [ebp - 0xee0]
push eax
call fcn.004302ba
lea ecx, [ebp - 0xee0]
push str.APPDATAROAMINGMICROSOFT_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
jne 0x41b367
lea edx, [ebp - 0xee0]
push str.APPLICATION_DATAMICROSOFT_
push edx
call fcn.0042efa0
add esp, 8
test eax, eax
je 0x41b6f3
push str.HRM:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b6f3
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8fb]
push ebx
push edx
mov byte [ebp - 0x8fc], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8fc]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4HRM.02112017.1
push str.NPAV4HRM.02112017.1
lea edx, [ebp - 0x8fc]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x79af]
push ebx
push eax
mov byte [ebp - 0x79b0], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x79b0]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x79b0]
push str.WORM.HRM.02112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41b548
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x79b0]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b4c1
mov edx, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45d0fc]
mov eax, dword [0x45d0f8]
mov dword [0x46a03e], edx
mov edx, dword [0x45d100]
mov dword [0x46a046], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a042], eax
mov eax, dword [0x45d104]
mov dword [0x46a04a], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a04e], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41b5f0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov eax, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45d0f8]
mov edx, dword [0x45d0fc]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45d100]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d104]
push ebx
push 0x46f978
mov dword [0x46f740], edx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41b5c0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b5c0
cmp dword [0x470144], ebx
je 0x41b5f0
lea edx, [ebp - 0x102e4]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x80c3]
push ebx
push eax
mov byte [ebp - 0x80c4], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x2aff]
push ebx
push ecx
mov byte [ebp - 0x2b00], bl
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41b630
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x2b00], cl
inc eax
cmp cl, bl
jne 0x41b630
lea edx, [ebp - 0x2b00]
push edx
lea eax, [ebp - 0x80c4]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x80c4]
push ecx
lea edx, [ebp - 0x2b00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41b6be
lea eax, [ebp - 0x80c4]
push eax
lea ecx, [ebp - 0x2b00]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41b6b1
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41b6be
lea edx, [ebp - 0x2b00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e9b0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [ebp - 0x10238], 0x1000
mov dword [ebp - 4], 0x44
jne 0x41bbba
cmp dword [ebp - 0x10230], 0x20
jne 0x41bbba
cmp dword [ebp - 0x1023c], 0x80
jne 0x41bbba
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41bbba
push str.0x1000
call fcn.004073f0
push 0x150
lea ecx, [ebp - 0x89c0]
push ebx
push ecx
mov dword [ebp - 0x1026c], ebx
call fcn.0042ea40
mov edi, dword [ebp - 0x10228]
mov ecx, dword [ebp - 0x10220]
add esp, 0x10
lea edx, [ebp - 0x1026c]
push edx
push 7
lea eax, [ebp - 0x4e0]
push eax
push edi
push ecx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], ebx
mov word [ebp - 0x4d8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x4e0]
cmp edx, dword [ebp - 0xe0]
jne 0x41bbba
mov al, byte [ebp - 0xdc]
cmp al, byte [ebp - 0x4dc]
jne 0x41bbba
push str.match_5_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10220]
add esp, 4
lea ecx, [ebp - 0x1026c]
push ecx
push 0x150
lea edx, [ebp - 0x89c0]
push edx
add edi, 0xbb0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x89c0]
test ecx, ecx
je 0x41bbba
cmp dword [ebp - 0x1026c], 0x150
jne 0x41bbba
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x21
push 0x150
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x89c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41bbba
push str.match_33_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41bbba
push str.Sig_found_and_suspend_
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x963]
push ebx
push eax
mov byte [ebp - 0x964], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x964]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4HRM.02112017.2
push str.NPAV4HRM.02112017.2
lea eax, [ebp - 0x964]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x7bb7]
push ebx
push ecx
mov byte [ebp - 0x7bb8], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7bb8]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x7bb8]
push str.WORM.HRM.02112017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41ba05
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x7bb8]
mov edx, 0x469f12
jmp 0x41b980
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b980
mov eax, dword [str.WORM.HRM.02112017.2]
mov ecx, dword [0x45d0a4]
mov edx, dword [0x45d0a8]
mov dword [0x46a03e], eax
mov eax, dword [0x45d0ac]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d0b0]
mov dword [0x46a046], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04a], eax
mov al, byte [0x45ca74]
mov dword [0x46a04e], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41bab0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, dword [str.WORM.HRM.02112017.2]
mov edx, dword [0x45d0a4]
mov eax, dword [0x45d0a8]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d0ac]
mov dword [0x46f73c], edx
mov edx, dword [0x45d0b0]
push ebx
push 0x46f978
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41ba80
cmp dword [0x470144], ebx
je 0x41bab0
lea eax, [ebp - 0x102c0]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [ebp - 0x606f]
push ebx
push ecx
mov byte [ebp - 0x6070], bl
call fcn.0042ea40
push 0xff
lea edx, [ebp - 0x2cff]
push ebx
push edx
mov byte [ebp - 0x2d00], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41bb85
lea edx, [ebp - 0x2d00]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41bb00
lea ecx, [ebp - 0x2d00]
push ecx
lea edx, [ebp - 0x6070]
push str._s.np4
push edx
call fcn.0042ebd6
add esp, 0xc
push 1
lea eax, [ebp - 0x6070]
push eax
lea ecx, [ebp - 0x2d00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41bb85
lea edx, [ebp - 0x6070]
push edx
lea eax, [ebp - 0x2d00]
push eax
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41bb78
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41bb85
lea ecx, [ebp - 0x2d00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e9b0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [ebp - 0x10238], 0x5000
mov dword [ebp - 4], 0x46
jne 0x41c072
cmp dword [ebp - 0x10230], 0x20
jne 0x41c072
cmp dword [ebp - 0x1023c], 0x80
jne 0x41c072
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41c072
push str.0x5000
call fcn.004073f0
push 0x150
lea eax, [ebp - 0x8468]
push ebx
push eax
mov dword [ebp - 0x10274], ebx
call fcn.0042ea40
mov edi, dword [ebp - 0x10228]
mov eax, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x10274]
push ecx
push 9
lea edx, [ebp - 0x478]
push edx
push edi
push eax
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov word [ebp - 0x470], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp - 0x60]
jne 0x41c072
mov dl, byte [ebp - 0x5c]
cmp dl, byte [ebp - 0x474]
jne 0x41c072
mov al, byte [ebp - 0x5b]
cmp al, byte [ebp - 0x473]
jne 0x41c072
mov cl, byte [ebp - 0x5a]
cmp cl, byte [ebp - 0x472]
jne 0x41c072
push str.match_7_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10220]
add esp, 4
lea edx, [ebp - 0x10274]
push edx
push 0x150
lea eax, [ebp - 0x8468]
push eax
add edi, 0x48b0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8468]
test edx, edx
je 0x41c072
cmp dword [ebp - 0x10274], 0x150
jne 0x41c072
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x150
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x8468]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c072
push 9
push 0x150
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x845e]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c072
push 8
push 0x150
lea ecx, [ebp - 0x14c]
push ecx
lea edx, [ebp - 0x8458]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c072
push str.match_33_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41c072
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9cb]
push ebx
push edx
mov byte [ebp - 0x9cc], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x9cc]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ZEPFOD.NPAV4.29112017.1
push str.NPAV4ZEPFOD.NPAV4.29112017.1
lea edx, [ebp - 0x9cc]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7dbb]
push ebx
push eax
mov byte [ebp - 0x7dbc], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7dbc]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x7dbc]
push str.WORM.ZEPFOD.NPAV4.29112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41beff
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x7dbc]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41bea6
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41bf80
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41bf50
cmp dword [0x470144], ebx
je 0x41bf80
lea ecx, [ebp - 0x10320]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x729b]
push ebx
push edx
mov byte [ebp - 0x729c], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x1237]
push ebx
push eax
mov byte [ebp - 0x1238], bl
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41c064
lea edx, [ebp - 0x1238]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41bfd2
lea edx, [ebp - 0x1238]
push edx
lea eax, [ebp - 0x729c]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x729c]
push ecx
lea edx, [ebp - 0x1238]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c057
lea eax, [ebp - 0x729c]
push eax
lea ecx, [ebp - 0x1238]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41c04a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c057
lea edx, [ebp - 0x1238]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1238]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
cmp dword [ebp - 0x10238], 0x8000
mov dword [ebp - 4], 0x48
jne 0x41c533
cmp dword [ebp - 0x10230], 0x20
jne 0x41c533
cmp dword [ebp - 0x1023c], 0x80
jne 0x41c533
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41c533
push str.0x8000
call fcn.004073f0
push 0x150
lea edx, [ebp - 0x8318]
push ebx
push edx
mov dword [ebp - 0x10270], ebx
call fcn.0042ea40
mov edi, dword [ebp - 0x10228]
mov edx, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x10270]
push eax
push 9
lea ecx, [ebp - 0x484]
push ecx
push edi
push edx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
mov word [ebp - 0x47c], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x70]
jne 0x41c533
mov cl, byte [ebp - 0x6c]
cmp cl, byte [ebp - 0x480]
jne 0x41c533
mov dl, byte [ebp - 0x6b]
cmp dl, byte [ebp - 0x47f]
jne 0x41c533
mov al, byte [ebp - 0x6a]
cmp al, byte [ebp - 0x47e]
jne 0x41c533
push str.match_7_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10220]
add esp, 4
lea ecx, [ebp - 0x10270]
push ecx
push 0x150
lea edx, [ebp - 0x8318]
push edx
add edi, 0x7bc0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8318]
test ecx, ecx
je 0x41c533
cmp dword [ebp - 0x10270], 0x150
jne 0x41c533
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x13
push 0x150
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x8318]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c533
push 0xc
push 0x150
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x8305]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c533
push 7
push 0x150
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x82ff]
push ecx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c533
push str.match_33_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41c533
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xa33]
push ebx
push edx
mov byte [ebp - 0xa34], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa34]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ZEPFOD.NPAV4.29112017.2
push str.NPAV4ZEPFOD.NPAV4.29112017.2
lea edx, [ebp - 0xa34]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7fc3]
push ebx
push eax
mov byte [ebp - 0x7fc4], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7fc4]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x7fc4]
push str.WORM.ZEPFOD.NPAV4.29112017.2
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c3b9
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x7fc4]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c360
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41c440
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x41c410
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41c410
cmp dword [0x470144], ebx
je 0x41c440
lea ecx, [ebp - 0x102e8]
push ecx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x6273]
push ebx
push edx
mov byte [ebp - 0x6274], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x1337]
push ebx
push eax
mov byte [ebp - 0x1338], bl
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41c525
lea edx, [ebp - 0x1338]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41c492
lea edx, [ebp - 0x1338]
push edx
lea eax, [ebp - 0x6274]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x6274]
push ecx
lea edx, [ebp - 0x1338]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c518
lea eax, [ebp - 0x6274]
push eax
lea ecx, [ebp - 0x1338]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41c50b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c518
lea edx, [ebp - 0x1338]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1338]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10238], 0x3d000
mov esi, dword [ebp - 0x10218]
jb 0x41c9a4
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41c9a4
cmp dword [ebp - 0x1023c], eax
jne 0x41c9a4
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
jne 0x41cfa4
push str.0X3D000_0X3E000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0xf214]
push ebx
push edx
call fcn.0042ea40
mov edx, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x1000
lea ecx, [ebp - 0xf214]
push ecx
add edx, 0x3d30
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1000
jne 0x41c9a4
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xf214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c9a4
mov edx, dword [ebp - 0x10224]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xf214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c9a4
push str.match_12_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0x4a
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x657]
push ebx
push eax
mov byte [ebp - 0x658], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x658]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4COMBO.NPAV4.21092018
push 0x45cfc8
lea eax, [ebp - 0x658]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0xff
lea ecx, [ebp - 0x493f]
push ebx
push ecx
mov byte [ebp - 0x4940], bl
call fcn.0042ea40
push 0xff
lea edx, [ebp - 0x2eff]
push ebx
push edx
mov byte [ebp - 0x2f00], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
call fcn.0040e820
add esp, 0x1c
cmp eax, ebx
je 0x41c7b8
mov ecx, eax
lea edx, [ebp - 0x2f00]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c743
lea ecx, [ebp - 0x2f00]
push ecx
lea edx, [ebp - 0x4940]
push str._s.np4
push edx
call fcn.0042ebd6
add esp, 0xc
push 1
lea eax, [ebp - 0x4940]
push eax
lea ecx, [ebp - 0x2f00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c7b8
lea edx, [ebp - 0x4940]
push edx
lea eax, [ebp - 0x2f00]
push eax
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41c7ab
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c7b8
lea ecx, [ebp - 0x2f00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x4433]
push ebx
push edx
mov byte [ebp - 0x4434], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x4434]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [ebp - 0x4434]
push str.WORM.COMBO.NPAV4.21092018
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c890
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4434]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c833
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.COMBO.NPAV4.21092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x41c908
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, 0x45cf90
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c8e0
cmp dword [0x470144], ebx
je 0x41c908
lea eax, [ebp - 0x102f0]
push eax
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
lea ecx, [ebp - 0x434]
mov esi, 1
push ecx
mov dword [0x470154], esi
mov dword [0x470164], esi
call fcn.0040ec00
mov eax, dword [0x470174]
add esp, 8
cmp eax, ebx
je 0x41c945
push 0xd3d
call eax
add esp, 4
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x41c99d
push 0x45cf90
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x4940]
push edx
lea ecx, [ebp - 0x658]
push ecx
lea edx, [ebp - 0x4434]
push edx
push esi
call eax
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1022c], 0x20000
jne 0x41cfa4
cmp dword [ebp - 0x10238], 0x50000
jb 0x41cfa4
push str.RWE_AND_RW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41cfa4
cmp dword [ebp - 0x1023c], 4
jne 0x41cfa4
push 0x1000
lea eax, [ebp - 0xccb4]
push ebx
push eax
mov byte [ebp - 0x10245], bl
call fcn.0042ea40
mov esi, dword [ebp - 0x10228]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0x1000
lea edx, [ebp - 0xccb4]
push edx
lea eax, [esi + 0x58d00]
push eax
push ecx
call edi
jmp 0x41ca40
cmp dword [ebp - 0x1021c], 0x1000
jne 0x41caa1
push 7
push 0x1000
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0xccb4]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41caa1
mov ecx, dword [ebp - 0x10224]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xc
push 0x1000
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0xccb4]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
je 0x41cb05
cmp byte [ebp - 0x10245], bl
jne 0x41cfa4
push 0x1000
lea ecx, [ebp - 0xccb4]
push ebx
push ecx
call fcn.0042ea40
add esp, 0xc
lea edx, [ebp - 0x1021c]
push edx
mov edx, dword [ebp - 0x10220]
push 0x1000
lea eax, [ebp - 0xccb4]
push eax
lea ecx, [esi + 0x51500]
push ecx
push edx
call edi
mov byte [ebp - 0x10245], 1
jmp 0x41ca40
mov eax, dword [ebp - 0x10224]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41cfa4
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x4637]
push ebx
push ecx
mov byte [ebp - 0x4638], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4638]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x4638]
push edx
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x31
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0xa9b]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
mov byte [ebp - 0xa9c], bl
call fcn.0042ea40
add esp, 0x40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa9c]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4MAYDAY.NPAV4.25082022
push str.NPAV4MAYDAY.NPAV4.25082022
lea edx, [ebp - 0xa9c]
push 0x45caa0
push edx
call fcn.00407310
lea eax, [ebp - 0x4638]
push str.WORM.MAYDAY.NPAV4.25082022
push eax
call fcn.0040a000
add esp, 0x34
cmp dword [0x46f734], ebx
je 0x41cca5
push str.PFNADDENTRY_FOUND
call fcn.004073f0
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0x4638]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41cc40
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41cce0
push 0x103
lea eax, [ebp - 0x886f]
push ebx
push eax
mov byte [ebp - 0x8870], bl
call fcn.0042ea40
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x8870]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x8870]
push ecx
call fcn.004073f0
push 0x103
lea edx, [ebp - 0x81c7]
push ebx
push edx
mov byte [ebp - 0x81c8], bl
call fcn.0042ea40
push 0x103
lea eax, [ebp - 0x7ebf]
push ebx
push eax
mov byte [ebp - 0x7ec0], bl
call fcn.0042ea40
push 0x103
lea ecx, [ebp - 0x1137]
push ebx
push ecx
mov byte [ebp - 0x1138], bl
call fcn.0042ea40
add esp, 0x44
push 0x103
lea edx, [ebp - 0x3203]
push ebx
push edx
mov byte [ebp - 0x3204], bl
call fcn.0042ea40
mov eax, dword [esi + 4]
push eax
call fcn.0040e820
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x41cf67
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41cf74
lea edx, [ebp - 0x81c8]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41cdd0
lea ecx, [ebp - 0x81c8]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x1138]
push edx
call fcn.004075a0
lea eax, [ebp - 0x1138]
push str.ZVSCAN
push eax
call fcn.0042efa0
lea eax, [ebp - 0x1138]
add esp, 0x10
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x41ce10
mov ecx, dword [str.ECLNR.EXE]
mov edx, dword [0x45cf30]
mov dword [eax], ecx
mov cx, word [0x45cf34]
mov dword [eax + 4], edx
mov dl, byte [0x45cf36]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x1138]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x81c8]
push ecx
lea edx, [ebp - 0x1138]
push edx
push str._s__F___s_
lea eax, [ebp - 0x7ec0]
push 0x104
push eax
call fcn.0042ec6f
lea ecx, [ebp - 0x7ec0]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x7ec0]
push edx
call fcn.00408230
mov eax, dword [0x470008]
add esp, 0x20
or eax, dword [0x47000c]
jne 0x41ced2
lea ecx, [ebp - 0x1138]
push ecx
push str._s__A
lea edx, [ebp - 0x3204]
push 0x104
push edx
call fcn.0042ec6f
lea eax, [ebp - 0x3204]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x3204]
push ecx
call fcn.00408230
add esp, 0x18
jmp 0x41cf54
call fcn.00430850
cdq
mov dword [0x470010], eax
sub eax, dword [0x470008]
push ebx
mov dword [0x470014], edx
sbb edx, dword [0x47000c]
push 0x3e8
push edx
push eax
call fcn.004309c0
push ebx
push 0x3c
push edx
push eax
call fcn.004309c0
push ebx
push 0x3c
push edx
push eax
call fcn.004309c0
mov dword [0x470000], eax
mov dword [0x470004], edx
cmp eax, 3
jne 0x41cf74
cmp edx, ebx
jne 0x41cf74
lea edx, [ebp - 0x1138]
push edx
push str._s__A
lea eax, [ebp - 0x3204]
push 0x104
push eax
call fcn.0042ec6f
lea ecx, [ebp - 0x3204]
push ecx
call fcn.00408230
add esp, 0x14
call fcn.00430850
cdq
mov dword [0x470008], eax
mov dword [0x47000c], edx
jmp 0x41cf74
push str.PATH_NOT_FOUND_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470160], ebx
jne 0x41cfa4
mov dword [0x470160], 1
cmp dword [0x470144], ebx
je 0x41cfa4
lea edx, [ebp - 0x10314]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x10238]
add eax, 0xfffe2000
cmp eax, 0xa000
ja 0x41d74e
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41d74e
cmp dword [ebp - 0x1023c], 0x80
jne 0x41d74e
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41d74e
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
mov edi, 0x64
push edi
lea ecx, [ebp - 0x1400]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042ea40
mov ecx, dword [ebp - 0x10220]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0x14
lea edx, [ebp - 0x1021c]
push edx
push edi
lea eax, [ebp - 0x1400]
push eax
push 0x40e530
push ecx
call esi
cmp dword [ebp - 0x1021c], edi
jne 0x41d74e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xc
push edi
lea edx, [ebp - 0x1d4]
push edx
lea eax, [ebp - 0x1400]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d39e
push str.match_12_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 8
push ecx
mov dword [ebp - 4], 0x4c
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x6bf]
push ebx
push eax
mov byte [ebp - 0x6c0], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6c0]
push str.NPAV4_s
push edx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea eax, [ebp - 0x6c0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x483f]
push ebx
push ecx
mov byte [ebp - 0x4840], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4840]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [ebp - 0x4840]
push str.WORM.SAVEFILES.NPAV4.26092018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x3b17]
push ebx
push eax
mov byte [ebp - 0x3b18], bl
call fcn.0042ea40
push 0xff
lea ecx, [ebp - 0x30ff]
push ebx
push ecx
mov byte [ebp - 0x3100], bl
call fcn.0042ea40
mov edx, dword [esi + 4]
push edx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41d257
lea edx, [ebp - 0x3100]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d1e2
lea eax, [ebp - 0x3100]
push eax
lea ecx, [ebp - 0x3b18]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [ebp - 0x3b18]
push edx
lea eax, [ebp - 0x3100]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d257
lea ecx, [ebp - 0x3b18]
push ecx
lea edx, [ebp - 0x3100]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41d24a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d257
lea eax, [ebp - 0x3100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d2ea
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4840]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d290
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d31e
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3b18]
push ecx
lea edx, [ebp - 0x6c0]
push edx
lea ecx, [ebp - 0x4840]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d718
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x41d370
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d370
cmp dword [0x470144], ebx
je 0x41d718
lea edx, [ebp - 0x102d4]
jmp 0x41d708
push edi
lea eax, [ebp - 0x139c]
push ebx
push eax
call fcn.0042ea40
mov eax, dword [ebp - 0x10220]
add esp, 0xc
lea ecx, [ebp - 0x1021c]
push ecx
push edi
lea edx, [ebp - 0x139c]
push edx
push 0x40f3b5
push eax
call esi
cmp dword [ebp - 0x1021c], edi
jne 0x41d74e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xb
push edi
lea ecx, [ebp - 0x1b0]
push ecx
lea edx, [ebp - 0x139c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d74e
push str.match_11_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 8
push eax
mov dword [ebp - 4], 0x4e
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042ea40
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x727]
push ebx
push edx
mov byte [ebp - 0x728], bl
call fcn.0042ea40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x728]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea edx, [ebp - 0x728]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x4a43]
push ebx
push eax
mov byte [ebp - 0x4a44], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4a44]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [ebp - 0x4a44]
push str.WORM.SAVEFILES.NPAV4.26092018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x432f]
push ebx
push edx
mov byte [ebp - 0x4330], bl
call fcn.0042ea40
push 0xff
lea eax, [ebp - 0x17ff]
push ebx
push eax
mov byte [ebp - 0x1800], bl
call fcn.0042ea40
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e820
add esp, 0x40
cmp eax, ebx
je 0x41d5d5
lea edx, [ebp - 0x1800]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d560
lea edx, [ebp - 0x1800]
push edx
lea eax, [ebp - 0x4330]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4330]
push ecx
lea edx, [ebp - 0x1800]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d5d5
lea eax, [ebp - 0x4330]
push eax
lea ecx, [ebp - 0x1800]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x41d5c8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d5d5
lea edx, [ebp - 0x1800]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10220]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d66c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
lea ecx, [ebp - 0x4a44]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d610
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d6a0
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x4330]
push ecx
lea edx, [ebp - 0x728]
push edx
lea ecx, [ebp - 0x4a44]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d718
push 0x104
push ebx
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d6f0
cmp dword [0x470144], ebx
je 0x41d718
lea edx, [ebp - 0x102ec]
push edx
push ebx
push ebx
push 0x40e7e0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x41d747
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1022c]
cmp eax, 0x20000
je 0x41d766
cmp eax, 0x40000
jne 0x41db53
push str.PAGE_EXECUTE_READ
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x10000
jb 0x41db53
push str.mbi_._MEM_PRIVATE
call fcn.004073f0
mov eax, 0x40
add esp, 4
cmp dword [ebp - 0x10230], eax
jne 0x41db53
cmp dword [ebp - 0x1023c], eax
jne 0x41db53
push str.greater_than_0X10000
call fcn.004073f0
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042ea40
mov edi, dword [ebp - 0x10218]
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x18
lea edx, [eax + 1]
jmp 0x41d7f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41d7f0
sub eax, edx
je 0x41db59
push str.checking_len
call fcn.004073f0
push 0x7ff
lea eax, [ebp - 0xd4b3]
push ebx
push eax
mov byte [ebp - 0xd4b4], bl
call fcn.0042ea40
push 0x7ff
lea ecx, [ebp - 0xb7b3]
push ebx
push ecx
mov byte [ebp - 0xb7b4], bl
call fcn.0042ea40
push 0x7ff
lea edx, [ebp - 0xa3b3]
push ebx
push edx
mov byte [ebp - 0xa3b4], bl
call fcn.0042ea40
mov eax, dword [edi + 4]
add esp, 0x28
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x41d897
push str.inside__hProcess
call fcn.004073f0
lea ecx, [ebp - 0xd4b4]
push ecx
push esi
call fcn.0040f980
add esp, 0xc
push 0x200
lea edx, [ebp - 0xa3b4]
push edx
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0xd4b4]
push eax
lea ecx, [ebp - 0xb7b4]
push 0x800
push ecx
call fcn.004307b5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov edx, dword [edi + 4]
push edx
lea eax, [ebp - 0x20]
push str.pid_d
push eax
call fcn.0042ebd6
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042ea40
mov eax, dword [edi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x350b]
push ebx
push ecx
mov byte [ebp - 0x350c], bl
call fcn.0042ea40
mov edx, dword [edi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x350c]
push str._s__d
push ecx
call fcn.0042ebd6
mov edx, dword [edi + 4]
mov eax, dword [0x46ff94]
add esp, 0x48
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x31
mov dword [0x46ff94], eax
lea eax, [ebp - 0xda7]
push ebx
push eax
mov byte [ebp - 0xda8], bl
call fcn.0042ea40
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xda8]
push str.NPAV4_s
push edx
call fcn.0042ebd6
add esp, 0x18
cmp dword [0x470158], ebx
jne 0x41db59
push 0x103
lea eax, [ebp - 0x866b]
push ebx
push eax
mov byte [ebp - 0x866c], bl
call fcn.0042ea40
push str.FILE_NOT_IN_GOOD_RMD5
call fcn.004073f0
lea ecx, [ebp - 0xa3b4]
push ecx
call dword [0x470184]
mov esi, eax
push esi
lea edx, [ebp - 0xa3b4]
push edx
lea eax, [ebp - 0x866c]
push str.__s__d
push eax
call fcn.0040dcc0
lea ecx, [ebp - 0x866c]
push ecx
call fcn.004073f0
add esp, 0x28
cmp esi, ebx
jne 0x41db44
push str.FILE_NOT_IN_GETDSRWITHSTATUS
call fcn.004073f0
push 0x63
lea edx, [ebp - 0xf43]
push ebx
push edx
mov byte [ebp - 0xf44], bl
call fcn.0042ea40
mov eax, dword [ebp - 0x10238]
push eax
lea ecx, [ebp - 0xf44]
push str.REGIONSIZE__0x_X
push ecx
call fcn.0040dce0
mov eax, dword [0x47017c]
add esp, 0x1c
cmp eax, ebx
je 0x41daa6
mov ecx, dword [ebp - 0x1022c]
cmp ecx, 0x20000
jne 0x41da71
push str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
lea edx, [ebp - 0xb7b4]
push edx
lea ecx, [ebp - 0xa3b4]
push ecx
lea edx, [ebp - 0x350c]
push edx
lea ecx, [ebp - 0xf44]
push ecx
push str.THREAD_TYPE__MEM_PRIVATE
jmp 0x41da9f
cmp ecx, 0x40000
jne 0x41daa6
push str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
lea edx, [ebp - 0xb7b4]
push edx
lea ecx, [ebp - 0xa3b4]
push ecx
lea edx, [ebp - 0x350c]
push edx
lea ecx, [ebp - 0xf44]
push ecx
push str.THREAD_TYPE__MEM_MAPPED
push 1
call eax
add esp, 0x1c
cmp dword [0x46f734], ebx
je 0x41db38
push 0x1e0
push ebx
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x41dad0
mov cl, byte [ebp + eax - 0x350c]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41dad0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 9
mov esi, str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10218]
add esp, 0x1e0
mov dword [0x470158], 1
jmp 0x41db59
push str.FILE__FOUND_IN_GOOD_DATABASE
call fcn.004073f0
add esp, 4
jmp 0x41db59
mov edi, dword [ebp - 0x10218]
cmp dword [0x470164], ebx
jne 0x41dc98
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41db7e
cmp dword [ebp - 0x1023c], eax
jne 0x41dc98
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41dc98
cmp eax, 4
je 0x41dc98
cmp dword [0x467218], eax
je 0x41dc98
cmp dword [0x46721c], eax
je 0x41dc98
cmp dword [0x467220], eax
je 0x41dc98
cmp dword [0x467224], eax
je 0x41dc98
cmp dword [0x470140], 1
jne 0x41dc98
cmp dword [0x47012c], ebx
jne 0x41dc98
mov eax, dword [ebp - 0x10228]
mov esi, dword [ebp - 0x10220]
lea ecx, [ebp - 0x1021c]
push ecx
push 0xa
lea edx, [ebp - 0x504]
push edx
push eax
push esi
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x500], ebx
mov word [ebp - 0x4fc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 0x504], bl
je 0x41dc9e
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x564], ebx
mov word [ebp - 0x560], bx
mov ecx, dword [edi + 4]
push ecx
lea edx, [ebp - 0x57c]
push str.pid__d_
push edx
call fcn.0042ebd6
push str.Orange_thread_found_in_process__n
call fcn.004073f0
lea eax, [ebp - 0x57c]
push eax
call fcn.004073f0
push str.Calling_td.exe...
call fcn.004073f0
add esp, 0x18
call fcn.00408150
mov dword [0x47012c], 1
jmp 0x41dc9e
mov esi, dword [ebp - 0x10220]
mov eax, dword [ebp - 0x10224]
cmp eax, ebx
je 0x41dcaf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x41dcba
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1029c]
jmp 0x41dccb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042ea25
mov esp, ebp
pop ebp
ret