Function at 0x4211f0
Capabilities:
Create thread
Delete file
Enumerate processes
Get common file path
Get file attributes
Move file

Disassembly:
mov eax, 0x2218
call fcn.00430230
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x2214], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x801]
push 0
push eax
mov byte [esp + 0x808], 0
call fcn.0042e2e0
push 0x103
lea ecx, [esp + 0xc1d]
push 0
push ecx
mov byte [esp + 0xc24], 0
call fcn.0042e2e0
push 0x103
lea edx, [esp + 0xd2d]
push 0
push edx
mov byte [esp + 0xd34], 0
call fcn.0042e2e0
push 0x103
lea eax, [esp + 0xa2d]
push 0
push eax
mov byte [esp + 0xa34], 0
call fcn.0042e2e0
push 0x103
lea ecx, [esp + 0xb3d]
push 0
push ecx
mov byte [esp + 0xb44], 0
call fcn.0042e2e0
push 0x128
lea edx, [esp + 0x7c]
push 0
push edx
call fcn.0042e2e0
add esp, 0x48
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x425779
lea eax, [esp + 0x3c]
push eax
push esi
mov dword [esp + 0x44], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x425779
mov edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x60]
push ecx
call fcn.0042fb5a
lea edx, [esp + 0x64]
push str._SYSTEM_PROCESS_
push edx
call fcn.0045290b
add esp, 0xc
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.SYSTEM
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.SERVICES.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.LSASS.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.LSM.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.SMSS.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.TASKHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.WINLOGON.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.AUDIODG.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.DWM.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.SEARCHFILTERHOST.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.SEARCHINDEXER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.DLLHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.MSMSGS.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.WUAUCLT.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.EMAILSCN.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.NPPRTFRW.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push 0x45e954
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.NPPROT.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.NPHOST.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.ZVMONNT.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.ZVMOUNT.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.SESSMGR.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.DASHOST.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.MSMPENG.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.NISSRV.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.RUNTIMEBROKER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.SEARCHFILTERHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.SEARCHPROTOCOLHOST.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.TASKHOSTEX.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.WMIPRVSE.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.IEXPLORE.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.CHROME.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.FIREFOX.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.SAFARI.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.ZVCMD64.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.APCONSVC.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.NPAVIDS.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea ecx, [esp + 0x60]
push str.EMON.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.LANMON3.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
mov eax, dword [esp + 0x44]
push eax
call fcn.00408800
add esp, 4
cmp al, 1
je 0x425762
lea ecx, [esp + 0x60]
push str.RUNDLL32.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x42177f
lea edx, [esp + 0x60]
push str.REGASM.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x42177f
lea eax, [esp + 0x60]
push str.REGSVC.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x42177f
lea ecx, [esp + 0x60]
push str.REGSVCS.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x421ceb
push 0x7ff
lea edx, [esp + 0x1a29]
push 0
push edx
mov byte [esp + 0x1a30], 0
call fcn.0042e2e0
push 0x7ff
lea eax, [esp + 0x1235]
push 0
push eax
mov byte [esp + 0x123c], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x5c]
add esp, 0x18
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4217e1
lea edx, [esp + 0x1a24]
push edx
push eax
call fcn.0040f8b0
add esp, 8
lea eax, [esp + 0x1a24]
push eax
lea ecx, [esp + 0x1228]
push 0x800
push ecx
call fcn.00430055
add esp, 0xc
push 0x800
lea edx, [esp + 0x1228]
push edx
lea eax, [esp + 0x1a2c]
push eax
call ebx
push str..DLL
lea ecx, [esp + 0x1228]
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x421ceb
push 0x45e82c
lea edx, [esp + 0x1228]
push edx
call ebp
test eax, eax
je 0x421ceb
push 0xc7
lea eax, [esp + 0x3f1]
push 0
push eax
mov byte [esp + 0x3f8], 0
call fcn.0042e2e0
push 0x103
lea ecx, [esp + 0x911]
push 0
push ecx
mov byte [esp + 0x918], 0
call fcn.0042e2e0
lea edx, [esp + 0x123c]
push 0x5c
push edx
call fcn.0042e810
mov esi, eax
add esp, 0x20
cmp edi, esi
jbe 0x421ceb
test esi, esi
je 0x421ceb
inc esi
sub edi, esi
add edi, 4
push edi
lea eax, [esp + 0x3f0]
push esi
push eax
call fcn.00430310
lea ecx, [esp + 0x3f8]
push 0x5f
push ecx
call fcn.0042e810
add esp, 0x14
test eax, eax
je 0x421ceb
test esi, esi
je 0x421ceb
lea edx, [esp + 0x1224]
push 0x3a
dec esi
push edx
mov byte [esi], 0
call fcn.0042e750
dec eax
lea edx, [esp + 0x908]
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4218f8
lea eax, [esp + 0x900]
push eax
mov byte [esi], 0x5c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x17
je 0x421923
cmp eax, 0x2017
jne 0x421ceb
mov ecx, dword [esp + 0x44]
push ecx
xor eax, eax
lea edx, [esp + 0x168]
push str.pid__d
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
call fcn.0042e476
lea eax, [esp + 0x170]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x1c5]
push 0
push ecx
mov byte [esp + 0x1cc], 0
call fcn.0042e2e0
push 0x103
lea edx, [esp + 0x719]
push 0
push edx
mov byte [esp + 0x720], 0
call fcn.0042e2e0
lea eax, [esp + 0x414]
push eax
lea ecx, [esp + 0x92c]
push ecx
push str._s_s
lea edx, [esp + 0x72c]
push 0x104
push edx
call fcn.0042e50f
lea eax, [esp + 0x93c]
push eax
call fcn.0040aeb0
lea ecx, [esp + 0x738]
add esp, 0x40
push ecx
call fcn.0040aeb0
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x1b8]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x54]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4PED_LNK.NPAV4.25022022
push str.NPAV4PED_LNK.NPAV4.25022022
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1d8]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
mov eax, dword [esp + 0x74]
push str..np4
push 1
push eax
call fcn.00428100
push 0xff
lea ecx, [esp + 0x329]
push 0
push ecx
mov byte [esp + 0x330], 0
call fcn.0042e2e0
add esp, 0x48
lea edx, [esp + 0x6f8]
push edx
lea eax, [esp + 0x2ec]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [esp + 0x2ec]
push ecx
lea edx, [esp + 0x700]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x421ac7
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x6fc]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x421ac7
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
push 0x103
lea edx, [esp + 0x1e9]
push 0
push edx
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x1f8]
push str._s__d
push edx
call fcn.0042e476
lea eax, [esp + 0x200]
push str.WORM.PED_LNK.NPAV4.25022022
push eax
call fcn.0040a000
lea ecx, [esp + 0x84]
push ecx
call fcn.0040c960
mov ebp, dword [0x46f734]
add esp, 0x28
test ebp, ebp
je 0x421b9d
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x421b41
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x421cce
mov eax, dword [0x47017c]
test eax, eax
je 0x421bde
push str.WORM.PED_LNK.NPAV4.25022022
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x1f8]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x421c20
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x421c20
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x421c35
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x421c60
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x421c71
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421c90
mov ax, word [0x45e7d8]
push 0x46f738
mov word [edi], ax
call fcn.00407460
add esp, 4
test eax, eax
jne 0x421cce
cmp dword [0x470144], eax
je 0x421cce
lea ecx, [esp + 0x38]
push ecx
push eax
push eax
push 0x40e710
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x60]
push str.RUNDLL32.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4220fb
push 0x7ff
push eax
mov byte [esp + 0x1a2c], al
lea eax, [esp + 0x1a2d]
push eax
call fcn.0042e2e0
push 0x7ff
lea ecx, [esp + 0x1235]
push 0
push ecx
mov byte [esp + 0x123c], 0
call fcn.0042e2e0
mov edx, dword [esp + 0x5c]
xor eax, eax
add esp, 0x18
push edx
push eax
push 0x410
mov byte [esp + 0x1bc], 0
mov dword [esp + 0x1bd], eax
mov dword [esp + 0x1c1], eax
mov dword [esp + 0x1c5], eax
mov dword [esp + 0x1c9], eax
mov dword [esp + 0x1cd], eax
mov dword [esp + 0x1d1], eax
mov dword [esp + 0x1d5], eax
mov dword [esp + 0x1d9], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421dcd
push str.GetCommandLine_in_cmdline
call fcn.004073f0
lea eax, [esp + 0x1a28]
push eax
push esi
call fcn.0040f8b0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x421dcd
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x1a24]
push ecx
push edx
call dword [0x46a1e4]
add esp, 8
push 0x45e7b8
lea eax, [esp + 0x1a28]
push eax
call ebp
test eax, eax
je 0x4220fb
lea ecx, [esp + 0x1a24]
push ecx
lea edx, [esp + 0x1228]
push 0x800
push edx
call fcn.00430055
add esp, 0xc
push 0x800
lea eax, [esp + 0x1228]
push eax
lea ecx, [esp + 0x1a2c]
push ecx
call ebx
push 0x103
lea edx, [esp + 0x2ed]
push 0
push edx
mov byte [esp + 0x2f4], 0
call fcn.0042e2e0
lea eax, [esp + 0x1230]
push eax
call fcn.004073f0
push str.Waiting_in_cmdline
call fcn.004073f0
push 3
lea ecx, [esp + 0x300]
push ecx
lea edx, [esp + 0x1240]
push edx
call fcn.0041f750
lea eax, [esp + 0x308]
push eax
call fcn.004073f0
lea ecx, [esp + 0x30c]
push ecx
call fcn.0040ea50
add esp, 0x28
cmp eax, 5
ja 0x4220fb
mov eax, dword [0x470170]
test eax, eax
je 0x4220fb
lea edx, [esp + 0x1b0]
push edx
lea ecx, [esp + 0x2ec]
push ecx
call eax
lea edx, [esp + 0x1b8]
push edx
call fcn.0040b650
add esp, 0xc
test al, al
je 0x4220fb
mov eax, dword [0x470168]
test eax, eax
je 0x4220fb
lea ecx, [esp + 0x2e8]
push ecx
call eax
add esp, 4
cmp eax, 1
je 0x4220fb
lea edx, [esp + 0x2e8]
push edx
call dword [0x47016c]
add esp, 4
test al, al
jne 0x4220fb
xor eax, eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov word [esp + 0x16c], ax
mov eax, dword [esp + 0x44]
push eax
lea ecx, [esp + 0x168]
push str.pid__d
push ecx
call fcn.0042e476
lea edx, [esp + 0x170]
push edx
call fcn.004073f0
push 0x31
lea eax, [esp + 0x185]
push 0
push eax
mov byte [esp + 0x18c], 0
call fcn.0042e2e0
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x190]
push str.NPAV4_s
push edx
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x6c]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
lea edx, [esp + 0x125c]
push edx
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push str.NPAV4AUD.RUN_DLL.NPAV4.28082023
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b0]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x5f9]
push 0
push ecx
mov byte [esp + 0x600], 0
call fcn.0042e2e0
mov edx, dword [esp + 0x50]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x608]
push str._s__d
push ecx
call fcn.0042e476
add esp, 0x1c
cmp dword [0x470154], 0
jne 0x4220f1
mov eax, dword [0x47017c]
test eax, eax
je 0x422032
push str.AUD.RUN_DLL.NPAV4.28082023
lea edx, [esp + 0x1228]
push edx
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x180]
push ecx
lea edx, [esp + 0x608]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str.AUD.RUN_DLL.NPAV4.28082023
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422070
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422085
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4220b0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4220c1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4220e0
mov ax, word [0x45e7d8]
mov word [edi], ax
mov dword [0x470154], 1
lea ecx, [esp + 0x60]
push str.PROCESSHACKER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea edx, [esp + 0x60]
push str.MIMIKATZ.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea eax, [esp + 0x60]
push str.NS.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea ecx, [esp + 0x60]
push str.NC.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea edx, [esp + 0x60]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea eax, [esp + 0x60]
push str.NPSETUP.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea ecx, [esp + 0x60]
push str.STOPNPAV.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea edx, [esp + 0x60]
push str.TASKMGR.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea eax, [esp + 0x60]
push str.STARTNP.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea ecx, [esp + 0x60]
push str.PROCXP64.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea edx, [esp + 0x60]
push str.PROCXP.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
push 6
lea eax, [esp + 0x64]
push str.NLBRUT
push eax
call fcn.0043016e
add esp, 0xc
test eax, eax
je 0x4222db
push 0xd
lea ecx, [esp + 0x64]
push str.PROCESSHACKER
push ecx
call fcn.0043016e
add esp, 0xc
test eax, eax
je 0x4222db
push 9
lea edx, [esp + 0x64]
push str.KPORTSCAN
push edx
call fcn.0043016e
add esp, 0xc
test eax, eax
je 0x4222db
lea eax, [esp + 0x60]
push str.ARP.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea ecx, [esp + 0x60]
push str.QUSER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea edx, [esp + 0x60]
push str.WINRS.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea eax, [esp + 0x60]
push str.CURL.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4222db
lea ecx, [esp + 0x60]
push str.SHARE.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4226e5
push str.Rdp_hacker_rule
call fcn.004073f0
mov edx, dword [esp + 0x48]
add esp, 4
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425762
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x44]
push eax
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x4226e5
push str.UNDER_RDP_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470174], 0
je 0x425762
push str.going_to_Export_INIIR_checking_rule
call fcn.004073f0
push 0xd3d
call dword [0x470174]
add esp, 8
cmp eax, 1
jne 0x4226e5
push str.going_to_checking_rule
call fcn.004073f0
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042e476
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042e2e0
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4RDPHACKER.NPAV4.10052018
push str.NPAV4RDPHACKER.NPAV4.10052018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [esp + 0x1e9]
push 0
push eax
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1f8]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x200]
push str.WORM.RDPHACKER.NPAV4.10052018
push ecx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x4224a3
push str.WORM.RDPHACKER.NPAV4.10052018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x1f8]
push ecx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x42252f
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x4224d0
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4224d0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x60]
push str.TASKMGR.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea edx, [esp + 0x60]
push str.STARTNP.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
lea eax, [esp + 0x60]
push str.STOPNPAV.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f380
push 0
push 0
call ebx
lea ecx, [esp + 0x60]
push ecx
call fcn.0040c960
call fcn.0040c260
mov edx, dword [esp + 0x48]
push 1
push edx
call fcn.00408550
mov eax, dword [0x470178]
add esp, 0xc
test eax, eax
je 0x4225bd
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [0x470154], 0
jne 0x4226ce
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422630
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422645
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422670
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422681
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4226a0
cmp dword [0x470144], 0
mov ax, word [0x45e7d8]
mov word [edi], ax
je 0x4226ce
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x40e710
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x60]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x422a45
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425762
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x422a45
mov edx, dword [esp + 0x44]
xor eax, eax
push edx
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
lea eax, [esp + 0x168]
push str.pid__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x170]
push ecx
call fcn.004073f0
push 0x31
lea edx, [esp + 0x185]
push 0
push edx
mov byte [esp + 0x18c], 0
call fcn.0042e2e0
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x190]
push str.NPAV4_s
push ecx
call fcn.0042e476
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x6c]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4CLEANUN_RDP.NPAV4.070619
inc eax
push str.NPAV4CLEANUN_RDP.NPAV4.070619
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b0]
push 0x45ca48
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x1e9]
push 0
push ecx
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
mov edx, dword [esp + 0x50]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x1f8]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [esp + 0x200]
push str.WORM.CLEANUN_RDP.NPAV4.070619
push edx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422872
push str.WORM.CLEANUN_RDP.NPAV4.070619
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x180]
push ecx
lea edx, [esp + 0x1f8]
push edx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x4228f0
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422892
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f380
push 0
push 0
call ebx
lea edx, [esp + 0x60]
push edx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x422924
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [0x470154], 0
jne 0x422a2e
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422990
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4229a5
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4229d0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4229e1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422a00
cmp dword [0x470144], 0
mov ax, word [0x45e7d8]
mov word [edi], ax
je 0x422a2e
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
push 0x40e710
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x60]
push str.IOBITT.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
lea eax, [esp + 0x60]
push str.IOBIT.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
lea ecx, [esp + 0x60]
push str.GMER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
lea edx, [esp + 0x60]
push str.IOBITUNINSTALER.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
lea eax, [esp + 0x60]
push str.IUSERVICE.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
push 0xd
lea ecx, [esp + 0x64]
push str.PROCESSHACKER
push ecx
call fcn.0043016e
add esp, 0xc
test eax, eax
je 0x422b1f
push 0x17
lea edx, [esp + 0x64]
push str.CONCURRENT_RDP_PATCHER.
push edx
call fcn.0043016e
add esp, 0xc
test eax, eax
je 0x422b1f
lea eax, [esp + 0x60]
push str.NETSCAN.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x422b1f
lea ecx, [esp + 0x60]
push str.IOBITUNLOCKER.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x422e76
mov edx, dword [esp + 0x44]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425762
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x44]
push eax
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x422e76
mov ecx, dword [esp + 0x44]
push ecx
xor eax, eax
lea edx, [esp + 0x168]
push str.pid__d
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
call fcn.0042e476
lea eax, [esp + 0x170]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x185]
push 0
push ecx
mov byte [esp + 0x18c], 0
call fcn.0042e2e0
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x190]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x6c]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4HACKT_RDP.NPAV4.180722
push str.NPAV4HACKT_RDP.NPAV4.180722
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b0]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x1e9]
push 0
push eax
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1f8]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x200]
push str.WORM.HACKT_RDP.NPAV4.180722
push ecx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422c92
push str.WORM.HACKT_RDP.NPAV4.180722
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x1f8]
push ecx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x422d1c
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x422cc0
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422cc0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f380
push 0
push 0
call ebx
lea ecx, [esp + 0x60]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x422d50
call eax
push str.UmRdpService
call fcn.0040e8e0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e8e0
add esp, 4
cmp dword [0x470154], 0
jne 0x422e5f
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422dc0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422dd5
mov dx, word [0x45e7dc]
mov cl, byte [0x45e7de]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422e00
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422e11
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422e30
cmp dword [0x470144], 0
mov dx, word [0x45e7d8]
mov word [edi], dx
je 0x422e5f
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x40e710
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea ecx, [esp + 0x60]
push str.CSRSS.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4233cf
push 0x12c
push eax
push 0x46fba8
call fcn.0042e2e0
mov edx, dword [esp + 0x50]
push 0x46fba8
push edx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045290b
add esp, 0x1c
test eax, eax
je 0x425762
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425762
push 0x104
lea ecx, [esp + 0x4f4]
push 0
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f4]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422f22
sub eax, edx
je 0x425762
lea eax, [esp + 0x4f0]
push eax
call fcn.0042fb5a
lea ecx, [esp + 0x4f4]
push str.SYSTEM32_
push ecx
call fcn.0042e840
add esp, 0xc
test eax, eax
jne 0x4233cf
lea edx, [esp + 0x4f0]
push str.WINSXS_
push edx
call fcn.0042e840
add esp, 8
test eax, eax
jne 0x4233cf
mov eax, dword [esp + 0x44]
push eax
call fcn.00408800
add esp, 4
test al, al
jne 0x4233cf
push 0x104
push 0
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x422fb3
sub eax, edx
je 0x4233cf
push str.SYSTEM
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.CSRSS.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423010
sub eax, edx
je 0x4233cf
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4233cf
call fcn.0040c260
push str.WORM.ETERNALB.NPAV4.30102018_Terminated_csrsss.EXE_Process
call fcn.004073f0
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042e476
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x58]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4ETERNALB.NPAV4.30102018
push str.NPAV4ETERNALB.NPAV4.30102018
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45ca48
push str.NPAV4CSRSS.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x834]
push 0
push edx
call fcn.0042e2e0
mov ecx, dword [esp + 0x84]
add esp, 0x40
lea eax, [esp + 0x7fc]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x1f1]
push 0
push edx
mov byte [esp + 0x1f8], 0
call fcn.0042e2e0
mov eax, dword [esp + 0x58]
push eax
lea ecx, [esp + 0x814]
push ecx
lea edx, [esp + 0x200]
push str._s__d
push edx
call fcn.0042e476
lea eax, [esp + 0x208]
push str.WORM.ETERNALB.NPAV4.30102018
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x44
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x423180
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423195
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4231c0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4231d1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4231f0
mov ebp, dword [0x46f734]
mov ax, word [0x45e7d8]
mov word [edi], ax
test ebp, ebp
je 0x423280
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423221
mov dl, byte [0x45ca1c]
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x4232aa
cmp dword [0x470144], 0
je 0x4232aa
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [esp + 0x2ed]
push 0
push ecx
mov dword [0x470154], 1
mov byte [esp + 0x2f4], 0
call fcn.0042e2e0
push 0xff
lea edx, [esp + 0x3fd]
push 0
push edx
mov byte [esp + 0x404], 0
call fcn.0042e2e0
mov eax, dword [esp + 0x5c]
push eax
call fcn.0040e750
add esp, 0x1c
test eax, eax
je 0x42338c
lea edx, [esp + 0x3ec]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x423310
lea ecx, [esp + 0x3ec]
push ecx
lea edx, [esp + 0x2ec]
push str._s.np4
push edx
call fcn.0042e476
add esp, 0xc
push 1
lea eax, [esp + 0x2ec]
push eax
lea ecx, [esp + 0x3f4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x42338c
lea edx, [esp + 0x2e8]
push edx
lea eax, [esp + 0x3f0]
push eax
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x42337e
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x42338c
lea ecx, [esp + 0x3ec]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x44]
push 1
push edx
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x4233cf
push str.WORM.ETERNALB.NPAV4.30102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x500]
push ecx
lea edx, [esp + 0x1f8]
push edx
push 1
call eax
add esp, 0x1c
lea eax, [esp + 0x60]
push str.POWERSHELL.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x423605
mov ecx, dword [esp + 0x44]
push ecx
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425762
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov esi, dword [0x46a1e4]
test esi, esi
je 0x425762
push 0x7ff
lea edx, [esp + 0x1229]
push 0
push edx
mov byte [esp + 0x1230], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x1230]
push eax
push ecx
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x14
push str._NOP
lea edx, [esp + 0x1228]
push edx
call esi
test eax, eax
je 0x42360b
push str.__NONI
lea eax, [esp + 0x1228]
push eax
call esi
test eax, eax
je 0x42360b
push str._HIDDEN
lea ecx, [esp + 0x1228]
push ecx
call esi
test eax, eax
je 0x42360b
push str..DownloadFile
lea edx, [esp + 0x1228]
push edx
call esi
test eax, eax
je 0x42360b
push str..ShellExecute
lea eax, [esp + 0x1228]
push eax
call esi
test eax, eax
je 0x42360b
mov ecx, dword [esp + 0x44]
push ecx
xor eax, eax
lea edx, [esp + 0x168]
push str.pid__d
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
call fcn.0042e476
lea eax, [esp + 0x170]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x185]
push 0
push ecx
mov byte [esp + 0x18c], 0
call fcn.0042e2e0
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x190]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x6c]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4PS.NPAV4.05062018
push str.NPAV4PS.NPAV4.05062018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b0]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x5f9]
push 0
push eax
mov byte [esp + 0x600], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x608]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x610]
push str._WORM.PS.NPAV4.05062018
push ecx
call fcn.0040a000
lea edx, [esp + 0x84]
push edx
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 0x28
test eax, eax
je 0x42360b
push str.WORM.PS.NPAV4.05062018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x180]
push ecx
lea edx, [esp + 0x608]
push edx
push 1
call eax
add esp, 0x1c
jmp 0x42360b
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x60]
push str.TIMEOUT.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423693
lea ecx, [esp + 0x60]
push str.NS.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423693
lea edx, [esp + 0x60]
push str.IOBITT.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423693
lea eax, [esp + 0x60]
push str.IOBITUNLOCKER.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423693
lea ecx, [esp + 0x60]
push str.IOBIT.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423693
lea edx, [esp + 0x60]
push str.NC.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4238e5
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425762
push eax
call ebx
cmp dword [0x470154], 0
jne 0x4236e3
lea ecx, [esp + 0x60]
push str.TIMEOUT.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x4236e3
call fcn.0040c260
mov dword [0x470154], 1
jmp 0x425762
mov edx, dword [esp + 0x44]
push edx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x4238e5
lea eax, [esp + 0x60]
push str.TIMEOUT.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x4238e5
mov ecx, dword [esp + 0x44]
push ecx
xor eax, eax
lea edx, [esp + 0x168]
push str.pid__d
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
call fcn.0042e476
lea eax, [esp + 0x170]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x185]
push 0
push ecx
mov byte [esp + 0x18c], 0
call fcn.0042e2e0
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x190]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x6c]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4MALPRO.NPAV4.01102018
push str.NPAV4MALPRO.NPAV4.01102018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b0]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x1e9]
push 0
push eax
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1f8]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x200]
push str._WORM.MALPRO.NPAV4.01102018
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x24
test ebp, ebp
je 0x42389f
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x423840
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423840
mov edx, dword [str.NPA4]
mov al, byte [0x45ca1c]
mov ecx, 6
mov esi, str.WORM.MALPRO.NPAV4.01102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x60]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x47017c]
test eax, eax
je 0x4238e5
push str.WORM.MALPRO.NPAV4.01102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x1f8]
push ecx
push 1
call eax
add esp, 0x1c
lea edx, [esp + 0x60]
push str.SVCHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x423d40
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425762
push 0x104
lea ecx, [esp + 0x4f4]
push 0
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f4]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call ebx
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423954
sub eax, edx
je 0x425762
lea eax, [esp + 0x4f0]
push eax
call fcn.0042fb5a
lea ecx, [esp + 0x4f4]
push str.TEMP_
push ecx
call fcn.0042e840
add esp, 0xc
test eax, eax
je 0x423d40
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x60]
push edx
push eax
mov byte [0x46fec6], 1
mov byte [0x46fec7], 1
call fcn.00408b60
add esp, 8
test al, al
je 0x423d40
mov ecx, dword [0x46ff94]
mov eax, dword [esp + 0x44]
mov dword [ecx*4 + 0x4693b8], eax
inc ecx
push 0
push eax
mov dword [0x46ff94], ecx
call fcn.00408550
lea ecx, [esp + 0x68]
push str.WORM.CTB_LOCK.210115
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x10
test ebp, ebp
je 0x423a9c
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x423a10
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423a10
mov edx, dword [str.WORM.CTB_LOCK.210115]
mov eax, dword [0x45d824]
mov ecx, dword [0x45d828]
mov dword [0x46a03e], edx
mov edx, dword [0x45d82c]
mov dword [0x46a042], eax
mov eax, dword [0x45d830]
mov dword [0x46a046], ecx
mov cl, byte [0x45d834]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca1c]
mov byte [0x46a052], cl
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d824]
mov eax, dword [0x45d828]
mov dword [0x46f738], ecx
mov ecx, dword [0x45d82c]
mov dword [0x46f73c], edx
mov edx, dword [0x45d830]
mov dword [0x46f744], ecx
mov ecx, dword [esp + 0x50]
mov dword [0x46f740], eax
mov al, byte [0x45d834]
push ecx
mov dword [0x46f748], edx
mov byte [0x46f74c], al
xor eax, eax
lea edx, [esp + 0x1b4]
push str.pid__d
push edx
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], eax
mov word [esp + 0x1c4], ax
call fcn.0042e476
push 0x104
push 0
push 0x46f978
call fcn.0042e2e0
add esp, 0x24
xor eax, eax
jmp 0x423b40
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x423b40
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423b55
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x1a4]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423b80
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423b91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423bb0
mov ax, word [0x45e7d8]
push 0x104
lea ecx, [esp + 0xc10]
push 0
push ecx
mov word [edi], ax
call fcn.0042e2e0
push 0x104
lea edx, [esp + 0xd20]
push 0
push edx
call fcn.0042e2e0
push 0x104
lea eax, [esp + 0xa20]
push 0
push eax
call fcn.0042e2e0
add esp, 0x24
xor eax, eax
jmp 0x423c10
mov cl, byte [esp + eax + 0x4f0]
mov byte [esp + eax + 0xa04], cl
inc eax
test cl, cl
jne 0x423c10
mov eax, dword [0x469868]
test eax, eax
je 0x423c46
push 0x104
lea ecx, [esp + 0xd14]
push ecx
lea edx, [esp + 0xa0c]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
test eax, eax
je 0x423c64
lea ecx, [esp + 0xc0c]
push ecx
lea edx, [esp + 0xa08]
push edx
call eax
add esp, 8
push 0x45ca68
push 0x45ca68
push 0x45ca68
lea eax, [esp + 0xc18]
push eax
lea ecx, [esp + 0xd20]
push ecx
lea edx, [esp + 0x504]
push edx
push 0x45ca48
push str.WORM.CTB_LOCK.210115
call fcn.00407310
push 0x104
lea eax, [esp + 0xb2c]
push 0
push eax
call fcn.0042e2e0
add esp, 0x2c
xor eax, eax
jmp 0x423cc0
mov cl, byte [esp + eax + 0x4f0]
mov byte [esp + eax + 0xb08], cl
inc eax
test cl, cl
jne 0x423cc0
lea eax, [esp + 0xb08]
dec eax
jmp 0x423ce0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423ce0
mov ecx, dword [str..np4.vir]
mov edx, dword [0x45bfd4]
mov dword [eax], ecx
mov cl, byte [0x45bfd8]
mov dword [eax + 4], edx
push 1
lea edx, [esp + 0xb0c]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x4f8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.00408eb0
cmp dword [0x470144], 0
je 0x423d40
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x46fec4], 0
jne 0x42416a
lea edx, [esp + 0x60]
push str.SVCHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x42416a
mov eax, dword [esp + 0x44]
push eax
call fcn.00408800
add esp, 4
test al, al
jne 0x42416a
push 0x104
push 0
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423da2
sub eax, edx
je 0x42416a
push 0x12c
push 0
push 0x46fba8
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045290b
add esp, 0x1c
test eax, eax
jne 0x423df9
cmp dword [0x46ff2c], eax
jne 0x423df9
mov edx, dword [esp + 0x44]
mov dword [0x46ff2c], edx
push str.SYSTEM
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423e46
sub eax, edx
je 0x42416a
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x42416a
push str.CryptoDefense:_Suspended_svchost.exe_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042e476
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
mov eax, dword [esp + 0x58]
push 0
push eax
call fcn.00408550
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x60]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45ca48
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x224]
push 0
push edx
call fcn.0042e2e0
add esp, 0x48
push 0x104
lea eax, [esp + 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x1e4]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423f38
sub eax, ecx
je 0x423f7b
lea eax, [esp + 0x1e4]
dec eax
jmp 0x423f50
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423f50
mov ecx, dword [str._svchost.exe]
mov edx, dword [0x45d900]
mov dword [eax], ecx
mov ecx, dword [0x45d904]
mov dword [eax + 4], edx
mov dl, byte [0x45d908]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x1e4]
push str.WORM.CRYPTO.05052014
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov edx, dword [0x45d8ec]
mov ecx, dword [0x45d8e8]
mov eax, dword [0x45d8f0]
mov ebx, dword [str.WORM.CRYPTO.05052014]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d8f4]
mov dword [0x46f740], edx
mov dl, byte [0x45d8f8]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042e2e0
add esp, 0x20
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424000
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424015
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424040
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424051
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424070
mov ebp, dword [0x46f734]
mov ax, word [0x45e7d8]
mov word [edi], ax
test ebp, ebp
je 0x42413b
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x4240b0
mov cl, byte [esp + eax + 0x1e4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4240b0
mov ecx, dword [0x45d8e8]
mov edx, dword [0x45d8ec]
mov eax, dword [0x45d8f0]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d8f4]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a046], edx
mov dl, byte [0x45d8f8]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x42416a
call fcn.00407a90
cmp dword [0x470144], 0
je 0x42416a
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x60]
push str.WININIT.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x42472b
push 0x12c
push eax
push 0x46fba8
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045290b
add esp, 0x1c
test eax, eax
je 0x425762
mov edx, dword [esp + 0x44]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425762
push 0x104
lea eax, [esp + 0x4f4]
push 0
push eax
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x4f4]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424216
sub eax, edx
je 0x425762
lea edx, [esp + 0x4f0]
push edx
call fcn.0042fb5a
lea eax, [esp + 0x4f4]
push str.SYSTEM32_
push eax
call fcn.0042e840
add esp, 0xc
test eax, eax
jne 0x42472b
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x42472b
push 0x104
push 0
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424290
sub eax, edx
je 0x42472b
push str.SYSTEM
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.wininit.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4242f0
sub eax, edx
je 0x42472b
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x42472b
push str.WORM.Bancteian.CB4_Terminated_wininit.exe_Process
call fcn.004073f0
mov edx, dword [esp + 0x48]
xor eax, eax
push edx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
lea eax, [esp + 0x16c]
push str.pid__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x174]
push ecx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x58]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45ca48
push str.NPAV4wininit.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [esp + 0x834]
push 0
push eax
call fcn.0042e2e0
mov edx, dword [esp + 0x84]
add esp, 0x40
lea ecx, [esp + 0x7fc]
push ecx
push edx
call fcn.00408710
push 0x103
lea eax, [esp + 0x705]
push 0
push eax
mov byte [esp + 0x70c], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x58]
push ecx
lea edx, [esp + 0x814]
push edx
lea eax, [esp + 0x714]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x71c]
push str.WORM.Bancteian.01122016
push ecx
call fcn.0040a000
lea eax, [esp + 0x724]
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424428
sub eax, ecx
je 0x42446b
lea eax, [esp + 0x6f8]
dec eax
jmp 0x424440
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424440
mov edx, dword [str.wininit.exe]
mov ecx, dword [0x45e260]
mov dword [eax], edx
mov edx, dword [0x45e264]
mov dword [eax + 4], ecx
mov cl, byte [0x45e268]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [esp + 0x6f8]
push str.WORM.Bancteian.01122016
push edx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov eax, dword [0x45e270]
mov ecx, dword [0x45e274]
mov edx, dword [0x45e278]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], eax
mov eax, dword [0x45e27c]
mov dword [0x46f740], ecx
mov ecx, dword [0x45e280]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042e2e0
add esp, 0x20
xor eax, eax
jmp 0x4244f0
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4244f0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424505
mov dx, word [0x45e7dc]
mov cl, byte [0x45e7de]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424530
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424541
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424560
mov ebp, dword [0x46f734]
mov dx, word [0x45e7d8]
mov word [edi], dx
test ebp, ebp
je 0x424629
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x4245a0
mov cl, byte [esp + eax + 0x6f8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4245a0
mov eax, dword [0x45e270]
mov ecx, dword [0x45e274]
mov edx, dword [0x45e278]
mov dword [0x46a042], eax
mov eax, dword [0x45e27c]
mov dword [0x46a046], ecx
mov ecx, dword [0x45e280]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca1c]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x42464a
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [esp + 0x2ed]
push 0
push edx
mov byte [esp + 0x2f4], 0
call fcn.0042e2e0
push 0xff
lea eax, [esp + 0x3fd]
push 0
push eax
mov byte [esp + 0x404], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0040e750
add esp, 0x1c
test eax, eax
je 0x42471c
lea edx, [esp + 0x3ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4246a0
lea edx, [esp + 0x3ec]
push edx
lea eax, [esp + 0x2ec]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [esp + 0x2ec]
push ecx
lea edx, [esp + 0x3f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x42471c
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x3f0]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x42470e
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x42471c
lea edx, [esp + 0x3ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x44]
push 1
push eax
call fcn.00408550
add esp, 8
lea ecx, [esp + 0x60]
push str.SPOOLSV.EXE
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x424c8d
push 0x12c
push eax
push 0x46fba8
call fcn.0042e2e0
mov edx, dword [esp + 0x50]
push 0x46fba8
push edx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045290b
add esp, 0x1c
test eax, eax
je 0x425762
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425762
push 0x104
lea ecx, [esp + 0x4f4]
push 0
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f4]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4247d7
sub eax, edx
je 0x425762
lea eax, [esp + 0x4f0]
push eax
call fcn.0042fb5a
lea ecx, [esp + 0x4f4]
push str.SYSTEM32_
push ecx
call fcn.0042e840
add esp, 0xc
test eax, eax
jne 0x424c8d
mov edx, dword [esp + 0x44]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x424c8d
push 0x104
push 0
push 0x469cd8
call fcn.0042e2e0
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
jmp 0x424850
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424850
sub eax, edx
je 0x424c8d
push str.SYSTEM
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
je 0x425762
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.SPOOLSV.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4248b0
sub eax, edx
je 0x424c8d
push 0x46fba8
push 0x469cd8
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x424c8d
push str.WORM.Bancteian.CB4_Terminated_SPOOLSV.EXE_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042e476
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x58]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45ca48
push str.NPAV4SPOOLSV.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x834]
push 0
push edx
call fcn.0042e2e0
mov ecx, dword [esp + 0x84]
add esp, 0x40
lea eax, [esp + 0x7fc]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x601]
push 0
push edx
mov byte [esp + 0x608], 0
call fcn.0042e2e0
mov eax, dword [esp + 0x58]
push eax
lea ecx, [esp + 0x814]
push ecx
lea edx, [esp + 0x610]
push str._s__d
push edx
call fcn.0042e476
lea eax, [esp + 0x618]
push str.WORM.Bancteian.01122016
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, dword [0x45e270]
mov edx, dword [0x45e274]
mov eax, dword [0x45e278]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45e27c]
mov dword [0x46f740], edx
mov edx, dword [0x45e280]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov dword [0x46f74c], edx
call fcn.0042e2e0
add esp, 0x44
xor eax, eax
jmp 0x424a50
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424a50
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424a65
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424a90
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424aa1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424ac0
mov ebp, dword [0x46f734]
mov ax, word [0x45e7d8]
mov word [edi], ax
test ebp, ebp
je 0x424b8b
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x424b00
mov cl, byte [esp + eax + 0x5f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424b00
mov ecx, dword [0x45e270]
mov edx, dword [0x45e274]
mov eax, dword [0x45e278]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e27c]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a046], edx
mov edx, dword [0x45e280]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a052], edx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x424bac
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0x40e710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [esp + 0x2ed]
push 0
push eax
mov byte [esp + 0x2f4], 0
call fcn.0042e2e0
push 0xff
lea ecx, [esp + 0x3fd]
push 0
push ecx
mov byte [esp + 0x404], 0
call fcn.0042e2e0
mov edx, dword [esp + 0x5c]
push edx
call fcn.0040e750
add esp, 0x1c
test eax, eax
je 0x424c7e
lea edx, [esp + 0x3ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424c02
lea eax, [esp + 0x3ec]
push eax
lea ecx, [esp + 0x2ec]
push str._s.np4
push ecx
call fcn.0042e476
add esp, 0xc
push 1
lea edx, [esp + 0x2ec]
push edx
lea eax, [esp + 0x3f4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x424c7e
lea ecx, [esp + 0x2e8]
push ecx
lea edx, [esp + 0x3f0]
push edx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x424c70
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x424c7e
lea eax, [esp + 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x44]
push 1
push ecx
call fcn.00408550
add esp, 8
lea edx, [esp + 0x60]
push str.EXPLORER.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea eax, [esp + 0x60]
push str.ICSYS.ICN.EXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea ecx, [esp + 0x60]
push str.EXPLORER.EXE.VIR
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea edx, [esp + 0x60]
push str.EXPLORER.EXE.MAL
push edx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea eax, [esp + 0x60]
push str.SVCHOST.VXE
push eax
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea ecx, [esp + 0x60]
push str.ICSYS.ICN.EXE.VIR
push ecx
call fcn.0045290b
add esp, 8
test eax, eax
je 0x424d2f
lea edx, [esp + 0x60]
push str.SVCHOST.EXE
push edx
call fcn.0045290b
add esp, 8
test eax, eax
jne 0x425321
mov eax, dword [esp + 0x44]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425762
push 0x104
lea ecx, [esp + 0x4f4]
push 0
push ecx
call fcn.0042e2e0
add esp, 0xc
push 0x104
lea edx, [esp + 0x4f4]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424d88
sub eax, edx
je 0x425762
lea eax, [esp + 0x4f0]
push eax
call fcn.0042fb5a
lea ecx, [esp + 0x4f4]
push str.RESOURCES_
push ecx
call fcn.0042e840
add esp, 0xc
test eax, eax
je 0x425321
push str.File_path_found
call fcn.004073f0
mov edx, dword [esp + 0x48]
xor eax, eax
push edx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
lea eax, [esp + 0x16c]
push str.pid__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x174]
push ecx
call fcn.004073f0
push 0x104
lea edx, [esp + 0x814]
push 0
push edx
call fcn.0042e2e0
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x81c]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [esp + 0x19d]
push 0
push edx
mov byte [esp + 0x1a4], 0
call fcn.0042e2e0
lea eax, [esp + 0x830]
push eax
lea ecx, [esp + 0x1a8]
push str.NPAV4_s
push ecx
call fcn.0042e476
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x84]
add esp, 0x40
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4NP4.SWISYSN.26102017
inc eax
push str.NPAV4NP4.SWISYSN.26102017
mov dword [0x46ff94], eax
lea eax, [esp + 0x188]
push 0x45ca48
push eax
call fcn.00407310
push 0x103
lea ecx, [esp + 0x619]
push 0
push ecx
mov byte [esp + 0x620], 0
call fcn.0042e2e0
mov edx, dword [esp + 0x70]
push edx
lea eax, [esp + 0x82c]
push eax
lea ecx, [esp + 0x628]
push str._s__d
push ecx
call fcn.0042e476
lea edx, [esp + 0x630]
push str._WORM.NP4.SWISYSN.26102017
push edx
call fcn.0040a000
add esp, 0x44
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ecx, 6
mov esi, str._WORM.NP4.SWISYSN.26102017
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042e2e0
add esp, 0x18
xor eax, eax
jmp 0x424f40
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424f40
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424f55
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424f80
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424f91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424fb0
mov ax, word [0x45e7d8]
push 0x103
lea ecx, [esp + 0x1e9]
push 0
push ecx
mov word [edi], ax
mov byte [esp + 0x1f0], 0
call fcn.0042e2e0
push 0x103
lea edx, [esp + 0x911]
push 0
push edx
mov byte [esp + 0x918], 0
call fcn.0042e2e0
push 0x103
lea eax, [esp + 0x305]
push 0
push eax
mov byte [esp + 0x30c], 0
call fcn.0042e2e0
push 0x103
lea ecx, [esp + 0x721]
push 0
push ecx
mov byte [esp + 0x728], 0
call fcn.0042e2e0
push 0x103
lea edx, [esp + 0x421]
push 0
push edx
mov byte [esp + 0x428], 0
call fcn.0042e2e0
push 0x103
lea eax, [esp + 0x1161]
push 0
push eax
mov byte [esp + 0x1168], 0
call fcn.0042e2e0
add esp, 0x48
push 0x103
lea ecx, [esp + 0xf1d]
push 0
push ecx
mov byte [esp + 0xf24], 0
call fcn.0042e2e0
push 0x103
lea edx, [esp + 0x102d]
push 0
push edx
mov byte [esp + 0x1034], 0
call fcn.0042e2e0
push 0x103
lea eax, [esp + 0xe31]
push 0
push eax
mov byte [esp + 0xe38], 0
call fcn.0042e2e0
add esp, 0x24
push 0x104
lea ecx, [esp + 0x6fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RESOURCESTHEMESEXPLORER.EXE
lea edx, [esp + 0x6fc]
push edx
lea eax, [esp + 0x1ec]
push str._s_s
push eax
call fcn.0040dbf0
push str.RESOURCESSVCHOST.EXE
lea ecx, [esp + 0x70c]
push ecx
lea edx, [esp + 0x918]
push str._s_s
push edx
call fcn.0040dbf0
push str.RESOURCESTHEMESICSYS.ICN.EXE
lea eax, [esp + 0x71c]
push eax
push str._s_s
lea ecx, [esp + 0x314]
push ecx
call fcn.0040dbf0
push str.RESOURCESSPOOLSV.EXE
lea edx, [esp + 0x72c]
push edx
lea eax, [esp + 0x424]
push str._s_s
push eax
call fcn.0040dbf0
add esp, 0x40
lea ecx, [esp + 0x1e4]
push ecx
lea edx, [esp + 0x1124]
push str._s.np4
push edx
call fcn.0042e476
lea eax, [esp + 0x90c]
push eax
lea ecx, [esp + 0xf28]
push str._s.np4
push ecx
call fcn.0042e476
lea edx, [esp + 0x300]
push edx
lea eax, [esp + 0x1038]
push str._s.np4
push eax
call fcn.0042e476
lea ecx, [esp + 0x410]
push ecx
lea edx, [esp + 0xe3c]
push str._s.np4
push edx
call fcn.0042e476
lea eax, [esp + 0x214]
push eax
call fcn.0040aeb0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x34
push 1
lea ecx, [esp + 0x1124]
push ecx
lea edx, [esp + 0x1ec]
push edx
call esi
lea eax, [esp + 0x900]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xf1c]
push ecx
lea edx, [esp + 0x908]
push edx
call esi
lea eax, [esp + 0x2e8]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0x1020]
push ecx
lea edx, [esp + 0x2f0]
push edx
call esi
lea eax, [esp + 0x3ec]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xe18]
push ecx
lea edx, [esp + 0x3f4]
push edx
call esi
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x4252de
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x425280
mov cl, byte [esp + eax + 0x5f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425280
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.NP4.SWISYSN.26102017
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca1c]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov eax, dword [0x47017c]
test eax, eax
je 0x425312
push str.WORM.NP4.SWISYSN.26102017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x180]
push edx
lea ecx, [esp + 0x608]
push ecx
push 1
call eax
add esp, 0x1c
mov edx, dword [esp + 0x44]
push 1
push edx
call fcn.00408550
add esp, 8
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str..vir
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
jne 0x42536b
push str..mal
lea ecx, [esp + 0x64]
push ecx
call esi
test eax, eax
jne 0x42536b
push str..np4
lea edx, [esp + 0x64]
push edx
call esi
test eax, eax
jne 0x42536b
push str.SVCHOST..EXE
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
je 0x425762
mov ecx, dword [esp + 0x44]
push ecx
xor eax, eax
lea edx, [esp + 0x168]
push str.pid__d
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
call fcn.0042e476
lea eax, [esp + 0x170]
push eax
call fcn.004073f0
push 0x104
lea ecx, [esp + 0x810]
push 0
push ecx
call fcn.0042e2e0
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x818]
push edx
push eax
call fcn.00408710
push 0x31
lea ecx, [esp + 0x199]
push 0
push ecx
mov byte [esp + 0x1a0], 0
call fcn.0042e2e0
lea edx, [esp + 0x82c]
push edx
lea eax, [esp + 0x1a4]
push str.NPAV4_s
push eax
call fcn.0042e476
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x80]
push 0x45ca68
push 0x45ca68
push 0x45ca68
push 0x45ca68
push str.NPAV4RECECON.14112017
push str.NPAV4RECECON.14112017
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1c4]
inc eax
push 0x45ca48
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x5c
push 0x103
lea eax, [esp + 0x5f9]
push 0
push eax
mov byte [esp + 0x600], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x80c]
push edx
lea eax, [esp + 0x608]
push str._s__d
push eax
call fcn.0042e476
lea ecx, [esp + 0x610]
push str.WORM.RECECON.14112017
push ecx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042e2e0
mov ebx, dword [str.WORM.RECECON.14112017]
mov edx, dword [0x45e070]
mov eax, dword [0x45e074]
mov ecx, dword [0x45e078]
mov dword [0x46f738], ebx
mov dword [0x46f73c], edx
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov edx, dword [0x45e07c]
mov ax, word [0x45e080]
push 0x104
push 0
push 0x46f978
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042e2e0
add esp, 0x3c
xor eax, eax
jmp 0x425510
mov cl, byte [esp + eax + 0x60]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425510
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425525
mov cx, word [0x45e7dc]
mov dl, byte [0x45e7de]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x164]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425550
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x425561
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x425580
mov ebp, dword [0x46f734]
mov ax, word [0x45e7d8]
mov word [edi], ax
test ebp, ebp
je 0x42564d
push 0x1e0
push 0
push 0x469f00
call fcn.0042e2e0
add esp, 0xc
xor eax, eax
jmp 0x4255c0
mov cl, byte [esp + eax + 0x5f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4255c0
mov ecx, dword [0x45e070]
mov edx, dword [0x45e074]
mov eax, dword [0x45e078]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e07c]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca1c]
mov dword [0x46a046], edx
mov dx, word [0x45e080]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0xff
lea edx, [esp + 0x2ed]
push 0
push edx
mov byte [esp + 0x2f4], 0
call fcn.0042e2e0
push 0xff
lea eax, [esp + 0x3fd]
push 0
push eax
mov byte [esp + 0x404], 0
call fcn.0042e2e0
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.0040e750
add esp, 0x1c
test eax, eax
je 0x42571f
lea edx, [esp + 0x3ec]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4256a3
lea edx, [esp + 0x3ec]
push edx
lea eax, [esp + 0x2ec]
push str._s.np4
push eax
call fcn.0042e476
add esp, 0xc
push 1
lea ecx, [esp + 0x2ec]
push ecx
lea edx, [esp + 0x3f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x42571f
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x3f0]
push ecx
call fcn.004300bd
add esp, 8
test eax, eax
jne 0x425711
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x42571f
lea edx, [esp + 0x3ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x44]
push 1
push eax
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x425762
push str.WORM.RECECON.NPAV4.14112017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x180]
push ecx
lea edx, [esp + 0x608]
push edx
push 1
call eax
add esp, 0x1c
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4212e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e2c5
add esp, 0x2218
ret