Function at 0x459db0
Capabilities:
Check if file exists
Check mutex on windows
Delete file
Delete registry key
Disable system features via registry on windows
Enumerate processes
Hide shutdown actions via policy
Persist via image file execution options registry key
Persist via run registry key
Set current directory
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a333
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x5c9ea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0x20000
push 1
mov dword [ebp - 0x14], eax
call fcn.0053438d
push eax
call fcn.0053a3ed
add esp, 8
push eax
call fcn.0053a20d
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5d0a8c
mov dword [0x5d0aa8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.004596b0
push 0x5be110
call fcn.00459870
add esp, 4
push str.Decrypt_tool
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
push str.___Process_init...
mov dword [0x5d02c0], eax
call fcn.00459870
add esp, 4
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x459e6b
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x459e8b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push edi
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x5d02c8], eax
call esi
mov dword [0x5d02c4], eax
call fcn.00460f50
push str.___Set_Privileges...
call fcn.00459870
add esp, 4
call fcn.004600f0
push str.YourBunnyWrote
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x459ed5
push str.___CLONE_INFO:_Im_a_clone_
call fcn.00459870
add esp, 4
mov eax, 1
jmp 0x45b0e0
push str.___CLONE_INFO:_Im_original_process_
call fcn.00459870
push str.___Get_White_process...
call fcn.00459870
add esp, 8
mov dword [ebp - 0x2f8], str.spoolsv.exe
mov dword [ebp - 0x2f4], str.explorer.exe
mov dword [ebp - 0x2f0], str.sihost.exe
mov dword [ebp - 0x2ec], str.fontdrvhost.exe
push 0
push 2
mov dword [ebp - 0x2e8], str.cmd.exe
mov dword [ebp - 0x2e4], str.dwm.exe
mov dword [ebp - 0x2e0], str.LogonUI.exe
mov dword [ebp - 0x2dc], str.SearchUI.exe
mov dword [ebp - 0x2d8], str.lsass.exe
mov dword [ebp - 0x2d4], str.csrss.exe
mov dword [ebp - 0x2d0], str.smss.exe
mov dword [ebp - 0x2cc], str.winlogon.exe
mov dword [ebp - 0x2c8], str.services.exe
mov dword [ebp - 0x2c4], str.conhost.exe
mov dword [ebp - 0x2c0], str.everything.exe
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x2a0], ebx
test ebx, ebx
je 0x45a062
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x29c], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x45a05b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax]
nop word [eax + eax]
xor esi, esi
push dword [ebp + esi*4 - 0x2f8]
lea eax, [ebp - 0x278]
push eax
call edi
test eax, eax
je 0x459fee
inc esi
cmp esi, 0xf
jl 0x459fd2
jmp 0x45a045
push 4
call fcn.005183e4
mov ecx, dword [ebp - 0x294]
add esp, 4
mov dword [ebp - 0x2a4], eax
mov dword [eax], ecx
lea eax, [ebp - 0x2a4]
mov esi, dword [0x5d0a60]
push eax
mov ebx, dword [esi + 4]
push ebx
push esi
call fcn.00459620
mov edx, dword [0x5d0a64]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x45b101
inc edx
mov dword [0x5d0a64], edx
mov dword [esi + 4], eax
mov dword [ebx], eax
mov ebx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x459fd0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.___Kill_Cryptor...
call fcn.00459870
add esp, 4
call fcn.0045ce50
call fcn.0045fed0
call fcn.0045ce50
call fcn.0045fed0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
call fcn.0045ce50
call fcn.0045fed0
push str.___Delete_session_key...
call fcn.00459870
add esp, 4
push 0x5d08f0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.___Set_current_dir...
call fcn.00459870
add esp, 4
push 0x5d06e8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.___Init_CRC...
call fcn.00459870
add esp, 4
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.hashlist.txt
mov word [ecx], ax
call fcn.0044a140
xor ecx, ecx
call fcn.00454b00
mov ecx, esp
xor eax, eax
push 0xd
push str.md5_check.txt
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0044a140
mov ecx, 1
call fcn.00454b00
add esp, 0x18
mov byte [ebp - 0x2b9], 0
lea ecx, [ebp - 0x70]
push 0x5cab5c
call fcn.0044ba20
mov dword [ebp - 4], 0
lea eax, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
cmovae eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45a187
push str.___Loading_hash_list...
call fcn.00459870
add esp, 4
call fcn.00454c90
mov byte [ebp - 0x2b9], 1
jmp 0x45a1a0
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
push str.___Hash_list_not_found:__s
call fcn.00459870
add esp, 8
push str.___Read_tail...
call fcn.00459870
mov ecx, dword [0x5cab38]
add esp, 4
test ecx, ecx
jne 0x45a1c2
call fcn.00454870
mov ecx, dword [0x5cab38]
cmp dword [0x5cab3c], 8
mov eax, 0x5cab28
push ecx
cmovae eax, dword [0x5cab28]
lea ecx, [ebp - 0x34]
xor edx, edx
mov dword [ebp - 0x24], 0
push eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], dx
call fcn.0044a140
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00453780
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x45a23d
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a233
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b0fc
push edx
push ecx
call fcn.00518414
add esp, 8
call fcn.0045dd60
cmp dword [0x5caadc], 8
mov esi, 0x5caac8
cmovae esi, dword [0x5caac8]
cmp dword [0x5d02c0], 0
je 0x45a299
push esi
mov dword [ebp - 0x2ac], 5
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x2a4], esi
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x2ac]
push eax
push 0
push 0x4a
push dword [0x5d02c0]
call dword [sym.imp.USER32.dll_SendMessageW]
xorps xmm0, xmm0
lea ecx, [ebp - 0x40]
push 0x5d09d8
movlpd qword [ebp - 0x40], xmm0
call fcn.0045b170
xorps xmm0, xmm0
mov byte [ebp - 4], 2
push 0x5d09e8
lea ecx, [ebp - 0x1c]
movlpd qword [ebp - 0x1c], xmm0
call fcn.0045b170
push str.___Find_Services...
mov byte [ebp - 4], 3
call fcn.00459870
lea ecx, [ebp - 0x40]
call fcn.0045d610
push str.___Kill_Services...
call fcn.00459870
lea ecx, [ebp - 0x40]
call fcn.0045c690
push str.___Wait_10_sec...
call fcn.00459870
add esp, 0xc
push 0x2710
call ebx
push str.___Kill_Processes...
call fcn.00459870
add esp, 4
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x34]
mov word [ebp - 0x34], ax
push 0x11
push str.SearchIndexer.exe
call fcn.0044a140
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov edx, dword [ebp - 0x18]
mov esi, 0x7fffffe
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45b101
mov ecx, dword [ebp - 0x2a4]
inc edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a3b0
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a3a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b10b
push edx
push ecx
call fcn.00518414
add esp, 8
push 0x16
xor eax, eax
mov dword [ebp - 0x24], 0
push str.SearchProtocolHost.exe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a140
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov edx, dword [ebp - 0x18]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45b110
mov ecx, dword [ebp - 0x2a4]
inc edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a44b
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a441
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b11a
push edx
push ecx
call fcn.00518414
add esp, 8
push 0xd
xor eax, eax
mov dword [ebp - 0x24], 0
push str.SearchApp.exe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a140
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov edx, dword [ebp - 0x18]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45b11f
mov ecx, dword [ebp - 0x2a4]
inc edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a4e6
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a4dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b129
push edx
push ecx
call fcn.00518414
add esp, 8
push 0x13
xor eax, eax
mov dword [ebp - 0x24], 0
push str.CompatTelRunner.exe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a140
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov edx, dword [ebp - 0x18]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45b12e
mov ecx, dword [ebp - 0x2a4]
inc edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a581
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a577
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b138
push edx
push ecx
call fcn.00518414
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x24], 0
push str.wsqmcons.exe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a140
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov edx, dword [ebp - 0x18]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45b13d
mov ecx, dword [ebp - 0x2a4]
inc edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a61c
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a612
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b147
push edx
push ecx
call fcn.00518414
add esp, 8
push 0xe
xor eax, eax
mov dword [ebp - 0x24], 0
push str.everything.exe
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
call fcn.0044a140
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x34]
mov edi, dword [ebp - 0x1c]
push ecx
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x2a4], eax
call fcn.00454820
mov ecx, dword [ebp - 0x18]
sub esi, ecx
cmp esi, 1
jb 0x45b14c
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x2a4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov dword [ecx], eax
cmp edx, 8
jb 0x45a6b5
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a6ab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b156
push edx
push ecx
call fcn.00518414
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.0045d080
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x2a8], xmm0
push 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
call fcn.0044aa50
mov dword [ebp - 0x2a8], eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0xa
call fcn.0045d220
lea ecx, [ebp - 0x2a8]
call fcn.0045d080
push str.___Wait_10_sec...
call fcn.00459870
add esp, 4
push 0x2710
call ebx
cmp dword [0x5caa94], 0x10
lea ecx, [ebp - 0x58]
mov esi, 0x5caa80
mov dword [ebp - 0x48], 0
cmovae esi, dword [0x5caa80]
mov ebx, 0x5caa80
add esi, dword [0x5caa90]
cmp dword [0x5caa94], 0x10
mov dword [ebp - 0x44], 7
cmovae ebx, dword [0x5caa80]
xor eax, eax
mov word [ebp - 0x58], ax
mov eax, esi
sub eax, ebx
push eax
call fcn.0044b410
push dword [ebp - 0x38]
lea ecx, [ebp - 0x58]
push esi
push ebx
call fcn.0044b6f0
mov byte [ebp - 4], 0xb
push dword [ebp - 0x3c]
push str.___Services_to_kill__count_:___i
call fcn.00459870
push dword [ebp - 0x18]
push str.___Processes_to_kill__count_:__i
call fcn.00459870
cmp dword [0x5caadc], 8
mov eax, 0x5caac8
cmovae eax, dword [0x5caac8]
push eax
push str.___Decryption_key:__s
call fcn.00459870
cmp dword [0x5caaf4], 8
mov eax, 0x5caae0
cmovae eax, dword [0x5caae0]
push eax
push str.___Note_file_name:__s
call fcn.00459870
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
push str.___Using_extension:__s
call fcn.00459870
push str.___Local_Search...
call fcn.00459870
add esp, 0x2c
cmp dword [ebp + 8], 2
jne 0x45a9b1
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
mov edx, dword [edx + 4]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a820
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.0044a140
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x24], 1
jne 0x45a84c
push 2
push 0x5bdfbc
jmp 0x45a89c
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x38], esp
push 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x5bda28
mov word [ecx], ax
call fcn.0044a140
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.0044ba20
mov byte [ebp - 4], 0xc
call fcn.0045f660
add esp, 0x30
test eax, eax
jne 0x45a8a4
push 1
push 0x5bda28
lea ecx, [ebp - 0x34]
call fcn.004517b0
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push str.___Starting_search_on:___s_
call fcn.00459870
mov eax, dword [ebp - 0x20]
lea esi, [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 8
cmovae esi, ecx
cmp dword [0x5d02c0], 0
je 0x45a91c
push esi
mov dword [ebp - 0x2b8], 1
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2b0], esi
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0x4a
push dword [0x5d02c0]
call ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
jmp 0x45a922
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 8
lea edx, [ebp - 0x34]
cmovae edx, ecx
sub esp, 0x18
mov esi, esp
mov ecx, edx
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45a950
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0044a140
call fcn.0045e940
mov byte [ebp - 4], 0xb
add esp, 0x18
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x45a9cc
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45a9a5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b15b
push edx
push ecx
call fcn.00518414
add esp, 8
jmp 0x45a9cc
mov ecx, 0x5d0a40
call fcn.00459120
call fcn.0045f070
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push str.___Mapped_drives_Search__user_context_...
call fcn.00459870
add esp, 4
call fcn.0045f200
push str.___Network_Search...
call fcn.00459870
add esp, 4
call fcn.0045c320
cmp dword [0x5d02c0], 0
je 0x45aa34
push 0x5bd148
mov dword [ebp - 0x2b8], 6
call edi
mov dword [ebp - 0x2b0], 0x5bd148
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0x4a
push dword [0x5d02c0]
call ebx
push str.___Remove_debugger...
call fcn.00459870
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.logoff.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x278]
add esp, 0x1c
push eax
push reloc.WS2_32.dll_bind
call ebx
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.shutdown.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.taskmgr.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.tasklist.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.taskkill.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call ebx
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push str.perfmon.exe
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call ebx
push str.___Restore_Services...
call fcn.00459870
lea ecx, [ebp - 0x40]
call fcn.0045cb20
push str.___Restore_Processes...
call fcn.00459870
mov ecx, dword [ebp - 0x1c]
add esp, 8
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx]
mov dword [ebp - 0x2a0], eax
cmp eax, ecx
je 0x45acbc
nop dword [eax]
cmp dword [eax + 0x1c], 8
lea ebx, [eax + 8]
jb 0x45ac5b
mov ebx, dword [ebx]
mov ecx, 0x25
lea edi, [ebp - 0x278]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x1e2]
rep movsd dword es:[edi], dword [esi]
push 0x172
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052fbd0
push ebx
lea eax, [ebp - 0x278]
push 0x104
push eax
call fcn.0053a6a7
add esp, 0x18
lea eax, [ebp - 0x278]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x2a0]
mov eax, dword [eax]
mov dword [ebp - 0x2a0], eax
cmp eax, dword [ebp - 0x14]
jne 0x45ac50
push str.___Remove_Autorun...
call fcn.00459870
sub esp, 0x14
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.AppDataLocal
mov word [ecx], ax
call fcn.0044a140
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
xor eax, eax
push 0x2d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov word [ecx], ax
call fcn.0044a140
mov ecx, bind
mov byte [ebp - 4], 0xb
call fcn.00460460
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0xd
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.AppDataLocal
mov word [ecx], ax
call fcn.0044a140
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
xor eax, eax
push 0x2d
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov word [ecx], ax
call fcn.0044a140
mov ecx, reloc.WS2_32.dll_bind
mov byte [ebp - 4], 0xb
call fcn.00460460
call fcn.0045f3d0
push str.___Remove_logon_notice...
call fcn.00459870
add esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0xf
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.legalnoticetext
mov word [ecx], ax
call fcn.0044a140
sub esp, 0x18
mov byte [ebp - 4], 0x10
mov ecx, esp
xor eax, eax
push 0x39
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
mov word [ecx], ax
call fcn.0044a140
mov byte [ebp - 4], 0xb
call fcn.00460360
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x38], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x12
xor eax, eax
push str.legalnoticecaption
mov word [ecx], ax
call fcn.0044a140
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
xor eax, eax
push 0x39
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.SOFTWAREMICROSOFTWindowsCurrentVersionPoliciesSystem
mov word [ecx], ax
call fcn.0044a140
mov byte [ebp - 4], 0xb
call fcn.00460360
push str.___Allow_Shutdown...
call fcn.00459870
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2a0]
add esp, 0x34
mov dword [ebp - 0x14], 0
push 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.WS2_32.dll_bind
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45aeaa
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [ebp - 0x2a0]
call esi
push dword [ebp - 0x2a0]
call edi
push 0
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45aef6
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.HidePowerOptions
push dword [ebp - 0x2a0]
call esi
push dword [ebp - 0x2a0]
call edi
push 0
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x14], 1
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
call ebx
test eax, eax
jne 0x45af42
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.shutdownwithoutlogon
push dword [ebp - 0x2a0]
call esi
push dword [ebp - 0x2a0]
call edi
push 0
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45af8e
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.NoClose
push dword [ebp - 0x2a0]
call esi
push dword [ebp - 0x2a0]
call edi
push 0
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x38], 0
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push bind
call ebx
test eax, eax
jne 0x45afda
push 4
lea eax, [ebp - 0x38]
push eax
push 4
push 0
push str.StartMenuLogOff
push dword [ebp - 0x2a0]
call esi
push dword [ebp - 0x2a0]
call edi
cmp byte [ebp - 0x2b9], 0
je 0x45b03e
test byte [0x5d0a68], 4
je 0x45aff9
push str._If_this_report_empty__all_checksum_match_
call fcn.00454d40
add esp, 4
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov ecx, 0x5d0a84
xchg dword [ecx], eax
mov eax, dword [0x5cab58]
cmp eax, 0xffffffff
je 0x45b028
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5cab58], 0xffffffff
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5d0a6c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push str.Decryption_finished._n_n
call fcn.00459870
push str.System_should_be_rebooted_in_30_seconds..._n
call fcn.00459870
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
mov esi, 0x1e
push 0x3e8
call edi
mov edx, 0x5bd148
mov ecx, 0x5cf208
call fcn.00457400
sub esi, 1
jne 0x45b060
push esi
push 1
push 1
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
lea ecx, [ebp - 0x58]
call fcn.00448e30
lea ecx, [ebp - 0x2a8]
call fcn.0044a450
push 0x20
push dword [ebp - 0x2a8]
call fcn.00518414
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.0044a450
push 0x20
push dword [ebp - 0x1c]
call fcn.00518414
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.0044a450
push 0x20
push dword [ebp - 0x40]
call fcn.00518414
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.00448e30
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005181d3
mov esp, ebp
pop ebp
ret
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
push str.list_T__too_long
call fcn.00515b6e
call fcn.00533a91
call fcn.00533a91
int3