Function at 0x4213c0
Capabilities:
Create thread
Delete file
Enumerate processes
Get common file path
Get file attributes
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x221c
call fcn.00430990
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x2218], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x805]
push 0
push eax
mov byte [esp + 0x80c], 0
call fcn.0042ea40
push 0x103
lea ecx, [esp + 0xd25]
push 0
push ecx
mov byte [esp + 0xd2c], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0xc2d]
push 0
push edx
mov byte [esp + 0xc34], 0
call fcn.0042ea40
push 0x103
lea eax, [esp + 0xa31]
push 0
push eax
mov byte [esp + 0xa38], 0
call fcn.0042ea40
push 0x103
lea ecx, [esp + 0xb41]
push 0
push ecx
mov byte [esp + 0xb48], 0
call fcn.0042ea40
push 0x128
lea edx, [esp + 0x80]
push 0
push edx
call fcn.0042ea40
add esp, 0x48
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x425ec9
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x425ec9
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x64]
push ecx
call fcn.004302ba
lea edx, [esp + 0x68]
push str._SYSTEM_PROCESS_
push edx
call fcn.0045306b
add esp, 0xc
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.SYSTEM
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.SERVICES.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.LSASS.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.LSM.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.SMSS.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.TASKHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.WINLOGON.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.AUDIODG.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.DWM.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.SEARCHFILTERHOST.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.SEARCHINDEXER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.DLLHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.MSMSGS.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.WUAUCLT.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.EMAILSCN.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.NPPRTFRW.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push 0x45eb90
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.NPPROT.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.NPHOST.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.ZVMONNT.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.ZVMOUNT.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.SESSMGR.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.DASHOST.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.MSMPENG.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.NISSRV.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.RUNTIMEBROKER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.SEARCHFILTERHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.SEARCHPROTOCOLHOST.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.TASKHOSTEX.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.WMIPRVSE.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.IEXPLORE.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.CHROME.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.FIREFOX.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.SAFARI.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.ZVCMD64.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.APCONSVC.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.NPAVIDS.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea ecx, [esp + 0x64]
push str.EMON.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.LANMON3.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
mov eax, dword [esp + 0x48]
push eax
call fcn.00408800
add esp, 4
cmp al, 1
je 0x425eb2
lea ecx, [esp + 0x64]
push str.RUNDLL32.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x421950
lea edx, [esp + 0x64]
push str.REGASM.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x421950
lea eax, [esp + 0x64]
push str.REGSVC.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x421950
lea ecx, [esp + 0x64]
push str.REGSVCS.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x421ebc
push 0x7ff
lea edx, [esp + 0x1a2d]
push 0
push edx
mov byte [esp + 0x1a34], 0
call fcn.0042ea40
push 0x7ff
lea eax, [esp + 0x1239]
push 0
push eax
mov byte [esp + 0x1240], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x60]
add esp, 0x18
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4219b2
lea edx, [esp + 0x1a28]
push edx
push eax
call fcn.0040f980
add esp, 8
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004307b5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push str..DLL
lea ecx, [esp + 0x122c]
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x421ebc
push 0x45ea58
lea edx, [esp + 0x122c]
push edx
call ebp
test eax, eax
je 0x421ebc
push 0xc7
lea eax, [esp + 0x2f1]
push 0
push eax
mov byte [esp + 0x2f8], 0
call fcn.0042ea40
push 0x103
lea ecx, [esp + 0x915]
push 0
push ecx
mov byte [esp + 0x91c], 0
call fcn.0042ea40
lea edx, [esp + 0x1240]
push 0x5c
push edx
call fcn.0042ef70
mov esi, eax
add esp, 0x20
cmp edi, esi
jbe 0x421ebc
test esi, esi
je 0x421ebc
inc esi
sub edi, esi
add edi, 4
push edi
lea eax, [esp + 0x2f0]
push esi
push eax
call fcn.00430b80
lea ecx, [esp + 0x2f8]
push 0x5f
push ecx
call fcn.0042ef70
add esp, 0x14
test eax, eax
je 0x421ebc
test esi, esi
je 0x421ebc
lea edx, [esp + 0x1228]
push 0x3a
dec esi
push edx
mov byte [esi], 0
call fcn.0042eeb0
dec eax
lea edx, [esp + 0x90c]
add esp, 8
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x421ad0
lea eax, [esp + 0x904]
push eax
mov byte [esi], 0x5c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x17
je 0x421afb
cmp eax, 0x2017
jne 0x421ebc
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ebd6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x1c9]
push 0
push ecx
mov byte [esp + 0x1d0], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0x71d]
push 0
push edx
mov byte [esp + 0x724], 0
call fcn.0042ea40
lea eax, [esp + 0x314]
push eax
lea ecx, [esp + 0x930]
push ecx
push str._s_s
lea edx, [esp + 0x730]
push 0x104
push edx
call fcn.0042ec6f
lea eax, [esp + 0x940]
push eax
call fcn.0040aeb0
lea ecx, [esp + 0x73c]
add esp, 0x40
push ecx
call fcn.0040aeb0
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x1bc]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x58]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PED_LNK.NPAV4.25022022
push str.NPAV4PED_LNK.NPAV4.25022022
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1dc]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
mov eax, dword [esp + 0x78]
push str..np4
push 1
push eax
call fcn.00428860
push 0xff
lea ecx, [esp + 0x431]
push 0
push ecx
mov byte [esp + 0x438], 0
call fcn.0042ea40
add esp, 0x48
lea edx, [esp + 0x6fc]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x704]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x421c9f
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x700]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x421c9f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
push 0x103
lea edx, [esp + 0x1ed]
push 0
push edx
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x1fc]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [esp + 0x204]
push str.WORM.PED_LNK.NPAV4.25022022
push eax
call fcn.0040a000
lea ecx, [esp + 0x88]
push ecx
call fcn.0040c960
mov ebp, dword [0x46f734]
add esp, 0x28
test ebp, ebp
je 0x421d7c
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x421d20
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x421e9f
mov eax, dword [0x47017c]
test eax, eax
je 0x421dbd
push str.WORM.PED_LNK.NPAV4.25022022
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x421df5
mov eax, 0x46f978
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x421e10
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x421e34
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x421e45
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421e61
mov ax, word [0x45ea04]
push 0x46f738
mov word [edi], ax
call fcn.00407460
add esp, 4
test eax, eax
jne 0x421e9f
cmp dword [0x470144], eax
je 0x421e9f
lea ecx, [esp + 0x38]
push ecx
push eax
push eax
push 0x40e7e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.RUNDLL32.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x42282b
push 0x7ff
push eax
mov byte [esp + 0x1a30], al
lea eax, [esp + 0x1a31]
push eax
call fcn.0042ea40
push 0x7ff
lea ecx, [esp + 0x1239]
push 0
push ecx
mov byte [esp + 0x1240], 0
call fcn.0042ea40
mov edx, dword [esp + 0x60]
xor eax, eax
add esp, 0x18
push edx
push eax
push 0x410
mov byte [esp + 0x1c0], 0
mov dword [esp + 0x1c1], eax
mov dword [esp + 0x1c5], eax
mov dword [esp + 0x1c9], eax
mov dword [esp + 0x1cd], eax
mov dword [esp + 0x1d1], eax
mov dword [esp + 0x1d5], eax
mov dword [esp + 0x1d9], eax
mov dword [esp + 0x1dd], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421f9e
push str.GetCommandLine_in_cmdline
call fcn.004073f0
lea eax, [esp + 0x1a2c]
push eax
push esi
call fcn.0040f980
add esp, 0xc
cmp eax, 0xffffffff
jne 0x421f9e
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x1a28]
push ecx
push edx
call dword [0x46a1e4]
add esp, 8
push 0x45e9e4
lea eax, [esp + 0x1a2c]
push eax
call ebp
test eax, eax
je 0x4224fb
push str..DLL
lea ecx, [esp + 0x1a2c]
push ecx
call ebp
test eax, eax
je 0x4224fb
push 0x45e9e0
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x4224fb
push str.rundll32
lea eax, [esp + 0x1a2c]
push eax
call ebp
test eax, eax
je 0x422009
push str.AppDataLocalTemp_
lea ecx, [esp + 0x1a2c]
push ecx
call ebp
test eax, eax
jne 0x422020
push str.Program_Files
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x42282b
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004307b5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push 0x103
lea ecx, [esp + 0x2f1]
push 0
push ecx
mov byte [esp + 0x2f8], 0
call fcn.0042ea40
lea edx, [esp + 0x1234]
push edx
call fcn.004073f0
push str.Waiting_in_cmdline
call fcn.004073f0
push 3
lea eax, [esp + 0x304]
push eax
lea ecx, [esp + 0x1244]
push ecx
call fcn.0041f920
lea edx, [esp + 0x30c]
push edx
call fcn.004073f0
lea eax, [esp + 0x310]
push eax
call fcn.0040eb20
push 0x103
lea ecx, [esp + 0x625]
push 0
push ecx
mov esi, eax
mov byte [esp + 0x62c], 0
call fcn.0042ea40
push esi
lea edx, [esp + 0x630]
push str.File_date_creation_diff___d
push edx
call fcn.0040dcc0
lea eax, [esp + 0x638]
add esp, 0x40
push eax
call fcn.004073f0
add esp, 4
cmp esi, 5
ja 0x42282b
push str.new_cmdline_found
call fcn.004073f0
mov eax, dword [0x470170]
add esp, 4
test eax, eax
je 0x42282b
lea ecx, [esp + 0x1b4]
push ecx
lea edx, [esp + 0x2f0]
push edx
call eax
lea eax, [esp + 0x1bc]
push eax
call fcn.0040b650
add esp, 0xc
test al, al
je 0x42282b
mov eax, dword [0x470168]
test eax, eax
je 0x42282b
lea ecx, [esp + 0x2ec]
push ecx
call eax
add esp, 4
cmp eax, 1
je 0x42282b
lea edx, [esp + 0x2ec]
push edx
call dword [0x47016c]
add esp, 4
test al, al
jne 0x42282b
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
push 0x31
lea eax, [esp + 0x189]
push 0
push eax
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x194]
push str.NPAV4_s
push edx
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea edx, [esp + 0x1260]
push edx
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push str.NPAV4WORM.RUN_DLL.NPAV4.13122023
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
mov ecx, dword [esp + 0x90]
add esp, 0x48
push str..np4
push 1
push ecx
call fcn.00428860
push 0xff
lea edx, [esp + 0x401]
push 0
push edx
mov byte [esp + 0x408], 0
call fcn.0042ea40
lea eax, [esp + 0x304]
push eax
lea ecx, [esp + 0x40c]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0x24
push 1
lea edx, [esp + 0x3f4]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4222d2
lea ecx, [esp + 0x3f0]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x4222d2
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x204]
push str.WORM.RUN_DLL.NPAV4.13122023
push ecx
call fcn.0040a000
lea edx, [esp + 0x88]
push edx
call fcn.0040c960
push str.TASKKILL__F__IM_RUNDLL32.EXE
call fcn.00430a9d
mov ebp, dword [0x46f734]
add esp, 0x2c
test ebp, ebp
je 0x4223bc
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x422360
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422360
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.RUN_DLL.NPAV4.13122023
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x422821
mov eax, dword [0x47017c]
test eax, eax
je 0x422400
push str.WORM.RUN_DLL.NPAV4.13122023
lea edx, [esp + 0x122c]
push edx
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.RUN_DLL.NPAV4.13122023
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x422440
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422440
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422455
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422480
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422491
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4224b0
mov ax, word [0x45ea04]
push 0x46f738
mov word [edi], ax
call fcn.00407460
add esp, 4
test eax, eax
jne 0x422821
cmp dword [0x470144], eax
je 0x422821
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
push 0x40e7e0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x422821
push 0x45e9e4
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x42282b
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004307b5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push 0x103
lea ecx, [esp + 0x3f5]
push 0
push ecx
mov byte [esp + 0x3fc], 0
call fcn.0042ea40
lea edx, [esp + 0x1234]
push edx
call fcn.004073f0
push str.Waiting_in_cmdline
call fcn.004073f0
push 3
lea eax, [esp + 0x408]
push eax
lea ecx, [esp + 0x1244]
push ecx
call fcn.0041f920
lea edx, [esp + 0x410]
push edx
call fcn.004073f0
lea eax, [esp + 0x414]
push eax
call fcn.0040eb20
add esp, 0x28
cmp eax, 5
ja 0x42282b
mov eax, dword [0x470170]
test eax, eax
je 0x42282b
lea ecx, [esp + 0x1b4]
push ecx
lea edx, [esp + 0x3f4]
push edx
call eax
lea eax, [esp + 0x1bc]
push eax
call fcn.0040b650
add esp, 0xc
test al, al
je 0x42282b
mov eax, dword [0x470168]
test eax, eax
je 0x42282b
lea ecx, [esp + 0x3f0]
push ecx
call eax
add esp, 4
cmp eax, 1
je 0x42282b
lea edx, [esp + 0x3f0]
push edx
call dword [0x47016c]
add esp, 4
test al, al
jne 0x42282b
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
push 0x31
lea eax, [esp + 0x189]
push 0
push eax
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x194]
push str.NPAV4_s
push edx
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea edx, [esp + 0x1260]
push edx
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push str.NPAV4AUD.RUN_DLL.NPAV4.28082023
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x5fd]
push 0
push ecx
mov byte [esp + 0x604], 0
call fcn.0042ea40
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x60c]
push str._s__d
push ecx
call fcn.0042ebd6
add esp, 0x1c
cmp dword [0x470154], 0
jne 0x422821
mov eax, dword [0x47017c]
test eax, eax
je 0x422763
push str.AUD.RUN_DLL.NPAV4.28082023
lea edx, [esp + 0x122c]
push edx
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x60c]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str.AUD.RUN_DLL.NPAV4.28082023
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4227a0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4227b5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4227e0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4227f1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422810
mov ax, word [0x45ea04]
mov word [edi], ax
mov dword [0x470154], 1
lea ecx, [esp + 0x64]
push str.PROCESSHACKER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea edx, [esp + 0x64]
push str.MIMIKATZ.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea eax, [esp + 0x64]
push str.NS.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea ecx, [esp + 0x64]
push str.NC.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea edx, [esp + 0x64]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea eax, [esp + 0x64]
push str.NPSETUP.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea ecx, [esp + 0x64]
push str.STOPNPAV.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea edx, [esp + 0x64]
push str.TASKMGR.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea eax, [esp + 0x64]
push str.STARTNP.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea ecx, [esp + 0x64]
push str.PROCXP64.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea edx, [esp + 0x64]
push str.PROCXP.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
push 6
lea eax, [esp + 0x68]
push str.NLBRUT
push eax
call fcn.004308ce
add esp, 0xc
test eax, eax
je 0x422a0b
push 0xd
lea ecx, [esp + 0x68]
push str.PROCESSHACKER
push ecx
call fcn.004308ce
add esp, 0xc
test eax, eax
je 0x422a0b
push 9
lea edx, [esp + 0x68]
push str.KPORTSCAN
push edx
call fcn.004308ce
add esp, 0xc
test eax, eax
je 0x422a0b
lea eax, [esp + 0x64]
push str.ARP.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea ecx, [esp + 0x64]
push str.QUSER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea edx, [esp + 0x64]
push str.WINRS.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea eax, [esp + 0x64]
push str.CURL.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x422a0b
lea ecx, [esp + 0x64]
push str.SHARE.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x422e15
push str.Rdp_hacker_rule
call fcn.004073f0
mov edx, dword [esp + 0x4c]
add esp, 4
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425eb2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
push eax
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x422e15
push str.UNDER_RDP_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470174], 0
je 0x425eb2
push str.going_to_Export_INIIR_checking_rule
call fcn.004073f0
push 0xd3d
call dword [0x470174]
add esp, 8
cmp eax, 1
jne 0x422e15
push str.going_to_checking_rule
call fcn.004073f0
mov ecx, dword [esp + 0x4c]
push ecx
xor eax, eax
lea edx, [esp + 0x170]
push str.pid__d
push edx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov word [esp + 0x180], ax
call fcn.0042ebd6
lea eax, [esp + 0x178]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x18d]
push 0
push ecx
mov byte [esp + 0x194], 0
call fcn.0042ea40
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x198]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x74]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RDPHACKER.NPAV4.10052018
push str.NPAV4RDPHACKER.NPAV4.10052018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b8]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x204]
push str.WORM.RDPHACKER.NPAV4.10052018
push ecx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422bd3
push str.WORM.RDPHACKER.NPAV4.10052018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x1fc]
push ecx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x422c5f
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x422c00
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422c00
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x64]
push str.TASKMGR.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea edx, [esp + 0x64]
push str.STARTNP.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
lea eax, [esp + 0x64]
push str.STOPNPAV.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f450
push 0
push 0
call ebx
lea ecx, [esp + 0x64]
push ecx
call fcn.0040c960
call fcn.0040c260
mov edx, dword [esp + 0x4c]
push 1
push edx
call fcn.00408550
mov eax, dword [0x470178]
add esp, 0xc
test eax, eax
je 0x422ced
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [0x470154], 0
jne 0x422dfe
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422d60
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422d75
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422da0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422db1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422dd0
cmp dword [0x470144], 0
mov ax, word [0x45ea04]
mov word [edi], ax
je 0x422dfe
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x40e7e0
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x423185
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425eb2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x423185
mov edx, dword [esp + 0x48]
xor eax, eax
push edx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
lea eax, [esp + 0x16c]
push str.pid__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x174]
push ecx
call fcn.004073f0
push 0x31
lea edx, [esp + 0x189]
push 0
push edx
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x194]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4CLEANUN_RDP.NPAV4.070619
inc eax
push str.NPAV4CLEANUN_RDP.NPAV4.070619
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x1ed]
push 0
push ecx
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1fc]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x204]
push str.WORM.CLEANUN_RDP.NPAV4.070619
push edx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422fa5
push str.WORM.CLEANUN_RDP.NPAV4.070619
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x42302e
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422fd0
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f450
push 0
push 0
call ebx
lea edx, [esp + 0x64]
push edx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x423062
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [0x470154], 0
jne 0x42316e
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4230d0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4230e5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423110
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423121
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423140
cmp dword [0x470144], 0
mov ax, word [0x45ea04]
mov word [edi], ax
je 0x42316e
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0x40e7e0
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.IOBITT.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
lea eax, [esp + 0x64]
push str.IOBIT.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
lea ecx, [esp + 0x64]
push str.GMER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
lea edx, [esp + 0x64]
push str.IOBITUNINSTALER.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
lea eax, [esp + 0x64]
push str.IUSERVICE.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
push 0xd
lea ecx, [esp + 0x68]
push str.PROCESSHACKER
push ecx
call fcn.004308ce
add esp, 0xc
test eax, eax
je 0x42325f
push 0x17
lea edx, [esp + 0x68]
push str.CONCURRENT_RDP_PATCHER.
push edx
call fcn.004308ce
add esp, 0xc
test eax, eax
je 0x42325f
lea eax, [esp + 0x64]
push str.NETSCAN.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42325f
lea ecx, [esp + 0x64]
push str.IOBITUNLOCKER.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4235b6
mov edx, dword [esp + 0x48]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425eb2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
push eax
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x4235b6
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ebd6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4HACKT_RDP.NPAV4.180722
push str.NPAV4HACKT_RDP.NPAV4.180722
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x204]
push str.WORM.HACKT_RDP.NPAV4.180722
push ecx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x4233d5
push str.WORM.HACKT_RDP.NPAV4.180722
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x1fc]
push ecx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x42345c
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423400
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f450
push 0
push 0
call ebx
lea ecx, [esp + 0x64]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x423490
call eax
push str.UmRdpService
call fcn.0040e9b0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9b0
add esp, 4
cmp dword [0x470154], 0
jne 0x42359f
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x423500
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423515
mov dx, word [0x45ea08]
mov cl, byte [0x45ea0a]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423540
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423551
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423570
cmp dword [0x470144], 0
mov dx, word [0x45ea04]
mov word [edi], dx
je 0x42359f
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x40e7e0
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea ecx, [esp + 0x64]
push str.CSRSS.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x423b1f
push 0x12c
push eax
push 0x46fba8
call fcn.0042ea40
mov edx, dword [esp + 0x54]
push 0x46fba8
push edx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045306b
add esp, 0x1c
test eax, eax
je 0x425eb2
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425eb2
push 0x104
lea ecx, [esp + 0x4f8]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f8]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423662
sub eax, edx
je 0x425eb2
lea eax, [esp + 0x4f4]
push eax
call fcn.004302ba
lea ecx, [esp + 0x4f8]
push str.SYSTEM32_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
jne 0x423b1f
lea edx, [esp + 0x4f4]
push str.WINSXS_
push edx
call fcn.0042efa0
add esp, 8
test eax, eax
jne 0x423b1f
mov eax, dword [esp + 0x48]
push eax
call fcn.00408800
add esp, 4
test al, al
jne 0x423b1f
push 0x104
push 0
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4236f3
sub eax, edx
je 0x423b1f
push str.SYSTEM
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.CSRSS.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423750
sub eax, edx
je 0x423b1f
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x423b1f
call fcn.0040c260
push str.WORM.ETERNALB.NPAV4.30102018_Terminated_csrsss.EXE_Process
call fcn.004073f0
mov ecx, dword [esp + 0x4c]
push ecx
xor eax, eax
lea edx, [esp + 0x170]
push str.pid__d
push edx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov word [esp + 0x180], ax
call fcn.0042ebd6
lea eax, [esp + 0x178]
push eax
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ETERNALB.NPAV4.30102018
push str.NPAV4ETERNALB.NPAV4.30102018
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4CSRSS.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x838]
push 0
push edx
call fcn.0042ea40
mov ecx, dword [esp + 0x88]
add esp, 0x40
lea eax, [esp + 0x800]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x1f5]
push 0
push edx
mov byte [esp + 0x1fc], 0
call fcn.0042ea40
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0x818]
push ecx
lea edx, [esp + 0x204]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [esp + 0x20c]
push str.WORM.ETERNALB.NPAV4.30102018
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x44
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4238c0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4238d5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423900
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423911
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423930
mov ebp, dword [0x46f734]
mov ax, word [0x45ea04]
mov word [edi], ax
test ebp, ebp
je 0x4239cf
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x423970
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423970
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x4239f9
cmp dword [0x470144], 0
je 0x4239f9
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0x40e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [esp + 0x3f5]
push 0
push ecx
mov dword [0x470154], 1
mov byte [esp + 0x3fc], 0
call fcn.0042ea40
push 0xff
lea edx, [esp + 0x2fd]
push 0
push edx
mov byte [esp + 0x304], 0
call fcn.0042ea40
mov eax, dword [esp + 0x60]
push eax
call fcn.0040e820
add esp, 0x1c
test eax, eax
je 0x423adc
lea edx, [esp + 0x2ec]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x423a60
lea ecx, [esp + 0x2ec]
push ecx
lea edx, [esp + 0x3f4]
push str._s.np4
push edx
call fcn.0042ebd6
add esp, 0xc
push 1
lea eax, [esp + 0x3f4]
push eax
lea ecx, [esp + 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x423adc
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0x2f0]
push eax
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x423ace
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x423adc
lea ecx, [esp + 0x2ec]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x48]
push 1
push edx
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x423b1f
push str.WORM.ETERNALB.NPAV4.30102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x504]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
lea eax, [esp + 0x64]
push str.POWERSHELL.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x423d58
mov ecx, dword [esp + 0x48]
push ecx
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425eb2
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov esi, dword [0x46a1e4]
test esi, esi
je 0x425eb2
push 0x7ff
lea edx, [esp + 0x122d]
push 0
push edx
mov byte [esp + 0x1234], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x1234]
push eax
push ecx
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x14
push str._NOP
lea edx, [esp + 0x122c]
push edx
call esi
test eax, eax
je 0x423d5e
push str.__NONI
lea eax, [esp + 0x122c]
push eax
call esi
test eax, eax
je 0x423d5e
push str._HIDDEN
lea ecx, [esp + 0x122c]
push ecx
call esi
test eax, eax
je 0x423d5e
push str..DownloadFile
lea edx, [esp + 0x122c]
push edx
call esi
test eax, eax
je 0x423d5e
push str..ShellExecute
lea eax, [esp + 0x122c]
push eax
call esi
test eax, eax
je 0x423d5e
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ebd6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PS.NPAV4.05062018
push str.NPAV4PS.NPAV4.05062018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x5fd]
push 0
push eax
mov byte [esp + 0x604], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x60c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x614]
push str._WORM.PS.NPAV4.05062018
push ecx
call fcn.0040a000
lea edx, [esp + 0x88]
push edx
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 0x28
test eax, eax
je 0x423d5e
push str.WORM.PS.NPAV4.05062018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x60c]
push edx
push 1
call eax
add esp, 0x1c
jmp 0x423d5e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x64]
push str.TIMEOUT.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x423de6
lea ecx, [esp + 0x64]
push str.NS.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x423de6
lea edx, [esp + 0x64]
push str.IOBITT.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x423de6
lea eax, [esp + 0x64]
push str.IOBITUNLOCKER.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x423de6
lea ecx, [esp + 0x64]
push str.IOBIT.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x423de6
lea edx, [esp + 0x64]
push str.NC.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x424036
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425eb2
push eax
call ebx
cmp dword [0x470154], 0
jne 0x423e36
lea ecx, [esp + 0x64]
push str.TIMEOUT.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x423e36
call fcn.0040c260
mov dword [0x470154], 1
jmp 0x425eb2
mov edx, dword [esp + 0x48]
push edx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x424036
lea eax, [esp + 0x64]
push str.TIMEOUT.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x424036
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ebd6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042ea40
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4MALPRO.NPAV4.01102018
push str.NPAV4MALPRO.NPAV4.01102018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x204]
push str._WORM.MALPRO.NPAV4.01102018
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x24
test ebp, ebp
je 0x423ff0
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423f91
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.MALPRO.NPAV4.01102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x64]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x47017c]
test eax, eax
je 0x424036
push str.WORM.MALPRO.NPAV4.01102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x1fc]
push ecx
push 1
call eax
add esp, 0x1c
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x424490
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425eb2
push 0x104
lea ecx, [esp + 0x4f8]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f8]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call ebx
lea eax, [esp + 0x4f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4240a5
sub eax, edx
je 0x425eb2
lea eax, [esp + 0x4f4]
push eax
call fcn.004302ba
lea ecx, [esp + 0x4f8]
push str.TEMP_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
je 0x424490
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x64]
push edx
push eax
mov byte [0x46fec6], 1
mov byte [0x46fec7], 1
call fcn.00408b60
add esp, 8
test al, al
je 0x424490
mov ecx, dword [0x46ff94]
mov eax, dword [esp + 0x48]
mov dword [ecx*4 + 0x4693b8], eax
inc ecx
push 0
push eax
mov dword [0x46ff94], ecx
call fcn.00408550
lea ecx, [esp + 0x6c]
push str.WORM.CTB_LOCK.210115
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x10
test ebp, ebp
je 0x4241ec
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424160
mov edx, dword [str.WORM.CTB_LOCK.210115]
mov eax, dword [0x45d984]
mov ecx, dword [0x45d988]
mov dword [0x46a03e], edx
mov edx, dword [0x45d98c]
mov dword [0x46a042], eax
mov eax, dword [0x45d990]
mov dword [0x46a046], ecx
mov cl, byte [0x45d994]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov byte [0x46a052], cl
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d984]
mov eax, dword [0x45d988]
mov dword [0x46f738], ecx
mov ecx, dword [0x45d98c]
mov dword [0x46f73c], edx
mov edx, dword [0x45d990]
mov dword [0x46f744], ecx
mov ecx, dword [esp + 0x54]
mov dword [0x46f740], eax
mov al, byte [0x45d994]
push ecx
mov dword [0x46f748], edx
mov byte [0x46f74c], al
xor eax, eax
lea edx, [esp + 0x1b8]
push str.pid__d
push edx
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1c4], eax
mov word [esp + 0x1c8], ax
call fcn.0042ebd6
push 0x104
push 0
push 0x46f978
call fcn.0042ea40
add esp, 0x24
xor eax, eax
jmp 0x424290
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424290
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4242a5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x1a8]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4242d0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4242e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424300
mov ax, word [0x45ea04]
push 0x104
lea ecx, [esp + 0xd18]
push 0
push ecx
mov word [edi], ax
call fcn.0042ea40
push 0x104
lea edx, [esp + 0xc20]
push 0
push edx
call fcn.0042ea40
push 0x104
lea eax, [esp + 0xa24]
push 0
push eax
call fcn.0042ea40
add esp, 0x24
xor eax, eax
jmp 0x424360
mov cl, byte [esp + eax + 0x4f4]
mov byte [esp + eax + 0xa08], cl
inc eax
test cl, cl
jne 0x424360
mov eax, dword [0x469868]
test eax, eax
je 0x424396
push 0x104
lea ecx, [esp + 0xc14]
push ecx
lea edx, [esp + 0xa10]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
test eax, eax
je 0x4243b4
lea ecx, [esp + 0xd14]
push ecx
lea edx, [esp + 0xa0c]
push edx
call eax
add esp, 8
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea eax, [esp + 0xd20]
push eax
lea ecx, [esp + 0xc20]
push ecx
lea edx, [esp + 0x508]
push edx
push 0x45caa0
push str.WORM.CTB_LOCK.210115
call fcn.00407310
push 0x104
lea eax, [esp + 0xb30]
push 0
push eax
call fcn.0042ea40
add esp, 0x2c
xor eax, eax
jmp 0x424410
mov cl, byte [esp + eax + 0x4f4]
mov byte [esp + eax + 0xb0c], cl
inc eax
test cl, cl
jne 0x424410
lea eax, [esp + 0xb0c]
dec eax
jmp 0x424430
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424430
mov ecx, dword [str..np4.vir]
mov edx, dword [0x45bfd4]
mov dword [eax], ecx
mov cl, byte [0x45bfd8]
mov dword [eax + 4], edx
push 1
lea edx, [esp + 0xb10]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x4fc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.00408eb0
cmp dword [0x470144], 0
je 0x424490
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x40e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x46fec4], 0
jne 0x4248ba
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4248ba
mov eax, dword [esp + 0x48]
push eax
call fcn.00408800
add esp, 4
test al, al
jne 0x4248ba
push 0x104
push 0
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4244f2
sub eax, edx
je 0x4248ba
push 0x12c
push 0
push 0x46fba8
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045306b
add esp, 0x1c
test eax, eax
jne 0x424549
cmp dword [0x46ff2c], eax
jne 0x424549
mov edx, dword [esp + 0x48]
mov dword [0x46ff2c], edx
push str.SYSTEM
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424596
sub eax, edx
je 0x4248ba
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4248ba
push str.CryptoDefense:_Suspended_svchost.exe_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x170]
push str.pid__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x178]
push edx
call fcn.004073f0
mov eax, dword [esp + 0x5c]
push 0
push eax
call fcn.00408550
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x64]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x228]
push 0
push edx
call fcn.0042ea40
add esp, 0x48
push 0x104
lea eax, [esp + 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x1e8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424688
sub eax, ecx
je 0x4246cb
lea eax, [esp + 0x1e8]
dec eax
jmp 0x4246a0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4246a0
mov ecx, dword [str._svchost.exe]
mov edx, dword [0x45da60]
mov dword [eax], ecx
mov ecx, dword [0x45da64]
mov dword [eax + 4], edx
mov dl, byte [0x45da68]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x1e8]
push str.WORM.CRYPTO.05052014
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov edx, dword [0x45da4c]
mov ecx, dword [0x45da48]
mov eax, dword [0x45da50]
mov ebx, dword [str.WORM.CRYPTO.05052014]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45da54]
mov dword [0x46f740], edx
mov dl, byte [0x45da58]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042ea40
add esp, 0x20
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424750
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424765
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424790
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4247a1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4247c0
mov ebp, dword [0x46f734]
mov ax, word [0x45ea04]
mov word [edi], ax
test ebp, ebp
je 0x42488b
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x424800
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424800
mov ecx, dword [0x45da48]
mov edx, dword [0x45da4c]
mov eax, dword [0x45da50]
mov dword [0x46a042], ecx
mov ecx, dword [0x45da54]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dl, byte [0x45da58]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x4248ba
call fcn.00407a90
cmp dword [0x470144], 0
je 0x4248ba
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x40e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x64]
push str.WININIT.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x424e7b
push 0x12c
push eax
push 0x46fba8
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045306b
add esp, 0x1c
test eax, eax
je 0x425eb2
mov edx, dword [esp + 0x48]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425eb2
push 0x104
lea eax, [esp + 0x4f8]
push 0
push eax
call fcn.0042ea40
add esp, 0xc
push 0x104
lea ecx, [esp + 0x4f8]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424966
sub eax, edx
je 0x425eb2
lea edx, [esp + 0x4f4]
push edx
call fcn.004302ba
lea eax, [esp + 0x4f8]
push str.SYSTEM32_
push eax
call fcn.0042efa0
add esp, 0xc
test eax, eax
jne 0x424e7b
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x424e7b
push 0x104
push 0
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4249e0
sub eax, edx
je 0x424e7b
push str.SYSTEM
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.wininit.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424a40
sub eax, edx
je 0x424e7b
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x424e7b
push str.WORM.Bancteian.CB4_Terminated_wininit.exe_Process
call fcn.004073f0
mov edx, dword [esp + 0x4c]
xor eax, eax
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
lea eax, [esp + 0x170]
push str.pid__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x178]
push ecx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4wininit.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [esp + 0x838]
push 0
push eax
call fcn.0042ea40
mov edx, dword [esp + 0x88]
add esp, 0x40
lea ecx, [esp + 0x800]
push ecx
push edx
call fcn.00408710
push 0x103
lea eax, [esp + 0x709]
push 0
push eax
mov byte [esp + 0x710], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x5c]
push ecx
lea edx, [esp + 0x818]
push edx
lea eax, [esp + 0x718]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x720]
push str.WORM.Bancteian.01122016
push ecx
call fcn.0040a000
lea eax, [esp + 0x728]
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424b78
sub eax, ecx
je 0x424bbb
lea eax, [esp + 0x6fc]
dec eax
jmp 0x424b90
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424b90
mov edx, dword [str.wininit.exe]
mov ecx, dword [0x45e3c0]
mov dword [eax], edx
mov edx, dword [0x45e3c4]
mov dword [eax + 4], ecx
mov cl, byte [0x45e3c8]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [esp + 0x6fc]
push str.WORM.Bancteian.01122016
push edx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov eax, dword [0x45e3d0]
mov ecx, dword [0x45e3d4]
mov edx, dword [0x45e3d8]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], eax
mov eax, dword [0x45e3dc]
mov dword [0x46f740], ecx
mov ecx, dword [0x45e3e0]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042ea40
add esp, 0x20
xor eax, eax
jmp 0x424c40
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424c40
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424c55
mov dx, word [0x45ea08]
mov cl, byte [0x45ea0a]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424c80
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424c91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424cb0
mov ebp, dword [0x46f734]
mov dx, word [0x45ea04]
mov word [edi], dx
test ebp, ebp
je 0x424d79
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x424cf0
mov cl, byte [esp + eax + 0x6fc]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424cf0
mov eax, dword [0x45e3d0]
mov ecx, dword [0x45e3d4]
mov edx, dword [0x45e3d8]
mov dword [0x46a042], eax
mov eax, dword [0x45e3dc]
mov dword [0x46a046], ecx
mov ecx, dword [0x45e3e0]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x424d9a
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [esp + 0x3f5]
push 0
push edx
mov byte [esp + 0x3fc], 0
call fcn.0042ea40
push 0xff
lea eax, [esp + 0x2fd]
push 0
push eax
mov byte [esp + 0x304], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040e820
add esp, 0x1c
test eax, eax
je 0x424e6c
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424df0
lea edx, [esp + 0x2ec]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x424e6c
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x2f0]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x424e5e
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x424e6c
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x48]
push 1
push eax
call fcn.00408550
add esp, 8
lea ecx, [esp + 0x64]
push str.SPOOLSV.EXE
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4253dd
push 0x12c
push eax
push 0x46fba8
call fcn.0042ea40
mov edx, dword [esp + 0x54]
push 0x46fba8
push edx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045306b
add esp, 0x1c
test eax, eax
je 0x425eb2
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425eb2
push 0x104
lea ecx, [esp + 0x4f8]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f8]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424f27
sub eax, edx
je 0x425eb2
lea eax, [esp + 0x4f4]
push eax
call fcn.004302ba
lea ecx, [esp + 0x4f8]
push str.SYSTEM32_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
jne 0x4253dd
mov edx, dword [esp + 0x48]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x4253dd
push 0x104
push 0
push 0x469cd8
call fcn.0042ea40
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
jmp 0x424fa0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424fa0
sub eax, edx
je 0x4253dd
push str.SYSTEM
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
je 0x425eb2
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.SPOOLSV.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425000
sub eax, edx
je 0x4253dd
push 0x46fba8
push 0x469cd8
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x4253dd
push str.WORM.Bancteian.CB4_Terminated_SPOOLSV.EXE_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x170]
push str.pid__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x178]
push edx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4SPOOLSV.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x838]
push 0
push edx
call fcn.0042ea40
mov ecx, dword [esp + 0x88]
add esp, 0x40
lea eax, [esp + 0x800]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x605]
push 0
push edx
mov byte [esp + 0x60c], 0
call fcn.0042ea40
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0x818]
push ecx
lea edx, [esp + 0x614]
push str._s__d
push edx
call fcn.0042ebd6
lea eax, [esp + 0x61c]
push str.WORM.Bancteian.01122016
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, dword [0x45e3d0]
mov edx, dword [0x45e3d4]
mov eax, dword [0x45e3d8]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45e3dc]
mov dword [0x46f740], edx
mov edx, dword [0x45e3e0]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov dword [0x46f74c], edx
call fcn.0042ea40
add esp, 0x44
xor eax, eax
jmp 0x4251a0
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4251a0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4251b5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4251e0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4251f1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x425210
mov ebp, dword [0x46f734]
mov ax, word [0x45ea04]
mov word [edi], ax
test ebp, ebp
je 0x4252db
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x425250
mov cl, byte [esp + eax + 0x5f8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425250
mov ecx, dword [0x45e3d0]
mov edx, dword [0x45e3d4]
mov eax, dword [0x45e3d8]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e3dc]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov edx, dword [0x45e3e0]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a052], edx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x4252fc
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0x40e7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [esp + 0x3f5]
push 0
push eax
mov byte [esp + 0x3fc], 0
call fcn.0042ea40
push 0xff
lea ecx, [esp + 0x2fd]
push 0
push ecx
mov byte [esp + 0x304], 0
call fcn.0042ea40
mov edx, dword [esp + 0x60]
push edx
call fcn.0040e820
add esp, 0x1c
test eax, eax
je 0x4253ce
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425352
lea eax, [esp + 0x2ec]
push eax
lea ecx, [esp + 0x3f4]
push str._s.np4
push ecx
call fcn.0042ebd6
add esp, 0xc
push 1
lea edx, [esp + 0x3f4]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4253ce
lea ecx, [esp + 0x3f0]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x4253c0
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4253ce
lea eax, [esp + 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x48]
push 1
push ecx
call fcn.00408550
add esp, 8
lea edx, [esp + 0x64]
push str.EXPLORER.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea eax, [esp + 0x64]
push str.ICSYS.ICN.EXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea ecx, [esp + 0x64]
push str.EXPLORER.EXE.VIR
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea edx, [esp + 0x64]
push str.EXPLORER.EXE.MAL
push edx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea eax, [esp + 0x64]
push str.SVCHOST.VXE
push eax
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea ecx, [esp + 0x64]
push str.ICSYS.ICN.EXE.VIR
push ecx
call fcn.0045306b
add esp, 8
test eax, eax
je 0x42547f
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045306b
add esp, 8
test eax, eax
jne 0x425a71
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425eb2
push 0x104
lea ecx, [esp + 0x4f8]
push 0
push ecx
call fcn.0042ea40
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f8]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4254d8
sub eax, edx
je 0x425eb2
lea eax, [esp + 0x4f4]
push eax
call fcn.004302ba
lea ecx, [esp + 0x4f8]
push str.RESOURCES_
push ecx
call fcn.0042efa0
add esp, 0xc
test eax, eax
je 0x425a71
push str.File_path_found
call fcn.004073f0
mov edx, dword [esp + 0x4c]
xor eax, eax
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
lea eax, [esp + 0x170]
push str.pid__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x178]
push ecx
call fcn.004073f0
push 0x104
lea edx, [esp + 0x818]
push 0
push edx
call fcn.0042ea40
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0x820]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [esp + 0x1a1]
push 0
push edx
mov byte [esp + 0x1a8], 0
call fcn.0042ea40
lea eax, [esp + 0x834]
push eax
lea ecx, [esp + 0x1ac]
push str.NPAV4_s
push ecx
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x88]
add esp, 0x40
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4NP4.SWISYSN.26102017
inc eax
push str.NPAV4NP4.SWISYSN.26102017
mov dword [0x46ff94], eax
lea eax, [esp + 0x18c]
push 0x45caa0
push eax
call fcn.00407310
push 0x103
lea ecx, [esp + 0x61d]
push 0
push ecx
mov byte [esp + 0x624], 0
call fcn.0042ea40
mov edx, dword [esp + 0x74]
push edx
lea eax, [esp + 0x830]
push eax
lea ecx, [esp + 0x62c]
push str._s__d
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x634]
push str._WORM.NP4.SWISYSN.26102017
push edx
call fcn.0040a000
add esp, 0x44
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ecx, 6
mov esi, str._WORM.NP4.SWISYSN.26102017
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042ea40
add esp, 0x18
xor eax, eax
jmp 0x425690
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425690
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4256a5
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4256d0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4256e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x425700
mov ax, word [0x45ea04]
push 0x103
lea ecx, [esp + 0x1ed]
push 0
push ecx
mov word [edi], ax
mov byte [esp + 0x1f4], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0x915]
push 0
push edx
mov byte [esp + 0x91c], 0
call fcn.0042ea40
push 0x103
lea eax, [esp + 0x40d]
push 0
push eax
mov byte [esp + 0x414], 0
call fcn.0042ea40
push 0x103
lea ecx, [esp + 0x725]
push 0
push ecx
mov byte [esp + 0x72c], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0x321]
push 0
push edx
mov byte [esp + 0x328], 0
call fcn.0042ea40
push 0x103
lea eax, [esp + 0x1165]
push 0
push eax
mov byte [esp + 0x116c], 0
call fcn.0042ea40
add esp, 0x48
push 0x103
lea ecx, [esp + 0xf21]
push 0
push ecx
mov byte [esp + 0xf28], 0
call fcn.0042ea40
push 0x103
lea edx, [esp + 0x1031]
push 0
push edx
mov byte [esp + 0x1038], 0
call fcn.0042ea40
push 0x103
lea eax, [esp + 0xe35]
push 0
push eax
mov byte [esp + 0xe3c], 0
call fcn.0042ea40
add esp, 0x24
push 0x104
lea ecx, [esp + 0x700]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RESOURCESTHEMESEXPLORER.EXE
lea edx, [esp + 0x700]
push edx
lea eax, [esp + 0x1f0]
push str._s_s
push eax
call fcn.0040dcc0
push str.RESOURCESSVCHOST.EXE
lea ecx, [esp + 0x710]
push ecx
lea edx, [esp + 0x91c]
push str._s_s
push edx
call fcn.0040dcc0
push str.RESOURCESTHEMESICSYS.ICN.EXE
lea eax, [esp + 0x720]
push eax
push str._s_s
lea ecx, [esp + 0x41c]
push ecx
call fcn.0040dcc0
push str.RESOURCESSPOOLSV.EXE
lea edx, [esp + 0x730]
push edx
lea eax, [esp + 0x324]
push str._s_s
push eax
call fcn.0040dcc0
add esp, 0x40
lea ecx, [esp + 0x1e8]
push ecx
lea edx, [esp + 0x1128]
push str._s.np4
push edx
call fcn.0042ebd6
lea eax, [esp + 0x910]
push eax
lea ecx, [esp + 0xf2c]
push str._s.np4
push ecx
call fcn.0042ebd6
lea edx, [esp + 0x408]
push edx
lea eax, [esp + 0x103c]
push str._s.np4
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x310]
push ecx
lea edx, [esp + 0xe40]
push str._s.np4
push edx
call fcn.0042ebd6
lea eax, [esp + 0x218]
push eax
call fcn.0040aeb0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x34
push 1
lea ecx, [esp + 0x1128]
push ecx
lea edx, [esp + 0x1f0]
push edx
call esi
lea eax, [esp + 0x904]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xf20]
push ecx
lea edx, [esp + 0x90c]
push edx
call esi
lea eax, [esp + 0x3f0]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0x1024]
push ecx
lea edx, [esp + 0x3f8]
push edx
call esi
lea eax, [esp + 0x2ec]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xe1c]
push ecx
lea edx, [esp + 0x2f4]
push edx
call esi
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x425a2e
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x4259d0
mov cl, byte [esp + eax + 0x5f8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4259d0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.NP4.SWISYSN.26102017
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov eax, dword [0x47017c]
test eax, eax
je 0x425a62
push str.WORM.NP4.SWISYSN.26102017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x60c]
push ecx
push 1
call eax
add esp, 0x1c
mov edx, dword [esp + 0x48]
push 1
push edx
call fcn.00408550
add esp, 8
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str..vir
lea eax, [esp + 0x68]
push eax
call esi
test eax, eax
jne 0x425abb
push str..mal
lea ecx, [esp + 0x68]
push ecx
call esi
test eax, eax
jne 0x425abb
push str..np4
lea edx, [esp + 0x68]
push edx
call esi
test eax, eax
jne 0x425abb
push str.SVCHOST..EXE
lea eax, [esp + 0x68]
push eax
call esi
test eax, eax
je 0x425eb2
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ebd6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x104
lea ecx, [esp + 0x814]
push 0
push ecx
call fcn.0042ea40
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x81c]
push edx
push eax
call fcn.00408710
push 0x31
lea ecx, [esp + 0x19d]
push 0
push ecx
mov byte [esp + 0x1a4], 0
call fcn.0042ea40
lea edx, [esp + 0x830]
push edx
lea eax, [esp + 0x1a8]
push str.NPAV4_s
push eax
call fcn.0042ebd6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x84]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RECECON.14112017
push str.NPAV4RECECON.14112017
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1c8]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x5c
push 0x103
lea eax, [esp + 0x5fd]
push 0
push eax
mov byte [esp + 0x604], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x810]
push edx
lea eax, [esp + 0x60c]
push str._s__d
push eax
call fcn.0042ebd6
lea ecx, [esp + 0x614]
push str.WORM.RECECON.14112017
push ecx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042ea40
mov ebx, dword [str.WORM.RECECON.14112017]
mov edx, dword [0x45e1d0]
mov eax, dword [0x45e1d4]
mov ecx, dword [0x45e1d8]
mov dword [0x46f738], ebx
mov dword [0x46f73c], edx
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov edx, dword [0x45e1dc]
mov ax, word [0x45e1e0]
push 0x104
push 0
push 0x46f978
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042ea40
add esp, 0x3c
xor eax, eax
jmp 0x425c60
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425c60
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425c75
mov cx, word [0x45ea08]
mov dl, byte [0x45ea0a]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425ca0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x425cb1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x425cd0
mov ebp, dword [0x46f734]
mov ax, word [0x45ea04]
mov word [edi], ax
test ebp, ebp
je 0x425d9d
push 0x1e0
push 0
push 0x469f00
call fcn.0042ea40
add esp, 0xc
xor eax, eax
jmp 0x425d10
mov cl, byte [esp + eax + 0x5f8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425d10
mov ecx, dword [0x45e1d0]
mov edx, dword [0x45e1d4]
mov eax, dword [0x45e1d8]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e1dc]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dx, word [0x45e1e0]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0xff
lea edx, [esp + 0x3f5]
push 0
push edx
mov byte [esp + 0x3fc], 0
call fcn.0042ea40
push 0xff
lea eax, [esp + 0x2fd]
push 0
push eax
mov byte [esp + 0x304], 0
call fcn.0042ea40
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040e820
add esp, 0x1c
test eax, eax
je 0x425e6f
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425df3
lea edx, [esp + 0x2ec]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ebd6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x425e6f
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x2f0]
push ecx
call fcn.0043081d
add esp, 8
test eax, eax
jne 0x425e61
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x425e6f
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x48]
push 1
push eax
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x425eb2
push str.WORM.RECECON.NPAV4.14112017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x60c]
push edx
push 1
call eax
add esp, 0x1c
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4214b1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042ea25
add esp, 0x221c
ret