Function at 0x4213e0
Capabilities:
Create process on windows
Create thread
Delete file
Enumerate processes
Get common file path
Get file attributes
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x221c
call fcn.00430a80
mov eax, dword [0x468004]
xor eax, esp
mov dword [esp + 0x2218], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x805]
push 0
push eax
mov byte [esp + 0x80c], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0xd25]
push 0
push ecx
mov byte [esp + 0xd2c], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0xc2d]
push 0
push edx
mov byte [esp + 0xc34], 0
call fcn.0042eb30
push 0x103
lea eax, [esp + 0xa31]
push 0
push eax
mov byte [esp + 0xa38], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0xb41]
push 0
push ecx
mov byte [esp + 0xb48], 0
call fcn.0042eb30
push 0x128
lea edx, [esp + 0x80]
push 0
push edx
call fcn.0042eb30
add esp, 0x48
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x425fa9
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x48], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x425fa9
mov ebx, dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x64]
push ecx
call fcn.004303aa
lea edx, [esp + 0x68]
push str._SYSTEM_PROCESS_
push edx
call fcn.0045315b
add esp, 0xc
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.SYSTEM
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.SERVICES.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.LSASS.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.LSM.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.SMSS.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.TASKHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.WINLOGON.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.AUDIODG.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.DWM.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.SEARCHFILTERHOST.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.SEARCHINDEXER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.DLLHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.MSMSGS.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.WUAUCLT.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.EMAILSCN.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.NPPRTFRW.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push 0x45ebdc
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.NPPROT.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.NPHOST.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.ZVMONNT.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.ZVMOUNT.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.SESSMGR.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.DASHOST.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.MSMPENG.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.NISSRV.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.RUNTIMEBROKER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.SEARCHFILTERHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.SEARCHPROTOCOLHOST.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.TASKHOSTEX.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.WMIPRVSE.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.IEXPLORE.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.CHROME.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.FIREFOX.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.SAFARI.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.ZVCMD64.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.APCONSVC.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.NPAVIDS.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea ecx, [esp + 0x64]
push str.EMON.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.LANMON3.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
mov eax, dword [esp + 0x48]
push eax
call fcn.00408800
add esp, 4
cmp al, 1
je 0x425f92
lea ecx, [esp + 0x64]
push str.RUNDLL32.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x421970
lea edx, [esp + 0x64]
push str.REGASM.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x421970
lea eax, [esp + 0x64]
push str.REGSVC.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x421970
lea ecx, [esp + 0x64]
push str.REGSVCS.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x421edc
push 0x7ff
lea edx, [esp + 0x1a2d]
push 0
push edx
mov byte [esp + 0x1a34], 0
call fcn.0042eb30
push 0x7ff
lea eax, [esp + 0x1239]
push 0
push eax
mov byte [esp + 0x1240], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x60]
add esp, 0x18
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4219d2
lea edx, [esp + 0x1a28]
push edx
push eax
call fcn.0040f9a0
add esp, 8
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004308a5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push str..DLL
lea ecx, [esp + 0x122c]
push ecx
call ebp
mov edi, eax
test edi, edi
je 0x421edc
push 0x45eaa4
lea edx, [esp + 0x122c]
push edx
call ebp
test eax, eax
je 0x421edc
push 0xc7
lea eax, [esp + 0x2f1]
push 0
push eax
mov byte [esp + 0x2f8], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0x915]
push 0
push ecx
mov byte [esp + 0x91c], 0
call fcn.0042eb30
lea edx, [esp + 0x1240]
push 0x5c
push edx
call fcn.0042f060
mov esi, eax
add esp, 0x20
cmp edi, esi
jbe 0x421edc
test esi, esi
je 0x421edc
inc esi
sub edi, esi
add edi, 4
push edi
lea eax, [esp + 0x2f0]
push esi
push eax
call fcn.00430c70
lea ecx, [esp + 0x2f8]
push 0x5f
push ecx
call fcn.0042f060
add esp, 0x14
test eax, eax
je 0x421edc
test esi, esi
je 0x421edc
lea edx, [esp + 0x1228]
push 0x3a
dec esi
push edx
mov byte [esi], 0
call fcn.0042efa0
dec eax
lea edx, [esp + 0x90c]
add esp, 8
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x421af0
lea eax, [esp + 0x904]
push eax
mov byte [esi], 0x5c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x17
je 0x421b1b
cmp eax, 0x2017
jne 0x421edc
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ecc6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x1c9]
push 0
push ecx
mov byte [esp + 0x1d0], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x71d]
push 0
push edx
mov byte [esp + 0x724], 0
call fcn.0042eb30
lea eax, [esp + 0x314]
push eax
lea ecx, [esp + 0x930]
push ecx
push str._s_s
lea edx, [esp + 0x730]
push 0x104
push edx
call fcn.0042ed5f
lea eax, [esp + 0x940]
push eax
call fcn.0040aeb0
lea ecx, [esp + 0x73c]
add esp, 0x40
push ecx
call fcn.0040aeb0
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x1bc]
push str.NPAV4_s
push eax
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x58]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PED_LNK.NPAV4.25022022
push str.NPAV4PED_LNK.NPAV4.25022022
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1dc]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
mov eax, dword [esp + 0x78]
push str..np4
push 1
push eax
call fcn.00428940
push 0xff
lea ecx, [esp + 0x431]
push 0
push ecx
mov byte [esp + 0x438], 0
call fcn.0042eb30
add esp, 0x48
lea edx, [esp + 0x6fc]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x704]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x421cbf
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x700]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x421cbf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
push 0x103
lea edx, [esp + 0x1ed]
push 0
push edx
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov eax, dword [esp + 0x54]
push eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x1fc]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [esp + 0x204]
push str.WORM.PED_LNK.NPAV4.25022022
push eax
call fcn.0040a000
lea ecx, [esp + 0x88]
push ecx
call fcn.0040c960
mov ebp, dword [0x46f734]
add esp, 0x28
test ebp, ebp
je 0x421d9c
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x421d40
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x421ebf
mov eax, dword [0x47017c]
test eax, eax
je 0x421ddd
push str.WORM.PED_LNK.NPAV4.25022022
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.PED_LNK.NPAV4.25022022
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x421e15
mov eax, 0x46f978
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x421e30
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x421e54
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x421e65
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x421e81
mov ax, word [0x45ea50]
push 0x46f738
mov word [edi], ax
call fcn.00407460
add esp, 4
test eax, eax
jne 0x421ebf
cmp dword [0x470144], eax
je 0x421ebf
lea ecx, [esp + 0x38]
push ecx
push eax
push eax
push 0x40e800
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.RUNDLL32.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x42284b
push 0x7ff
push eax
mov byte [esp + 0x1a30], al
lea eax, [esp + 0x1a31]
push eax
call fcn.0042eb30
push 0x7ff
lea ecx, [esp + 0x1239]
push 0
push ecx
mov byte [esp + 0x1240], 0
call fcn.0042eb30
mov edx, dword [esp + 0x60]
xor eax, eax
add esp, 0x18
push edx
push eax
push 0x410
mov byte [esp + 0x1c0], 0
mov dword [esp + 0x1c1], eax
mov dword [esp + 0x1c5], eax
mov dword [esp + 0x1c9], eax
mov dword [esp + 0x1cd], eax
mov dword [esp + 0x1d1], eax
mov dword [esp + 0x1d5], eax
mov dword [esp + 0x1d9], eax
mov dword [esp + 0x1dd], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x421fbe
push str.GetCommandLine_in_cmdline
call fcn.004073f0
lea eax, [esp + 0x1a2c]
push eax
push esi
call fcn.0040f9a0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x421fbe
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x1a28]
push ecx
push edx
call dword [0x46a1e4]
add esp, 8
push 0x45ea30
lea eax, [esp + 0x1a2c]
push eax
call ebp
test eax, eax
je 0x42251b
push str..DLL
lea ecx, [esp + 0x1a2c]
push ecx
call ebp
test eax, eax
je 0x42251b
push 0x45ea2c
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x42251b
push str.rundll32
lea eax, [esp + 0x1a2c]
push eax
call ebp
test eax, eax
je 0x422029
push str.AppDataLocalTemp_
lea ecx, [esp + 0x1a2c]
push ecx
call ebp
test eax, eax
jne 0x422040
push str.Program_Files
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x42284b
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004308a5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push 0x103
lea ecx, [esp + 0x2f1]
push 0
push ecx
mov byte [esp + 0x2f8], 0
call fcn.0042eb30
lea edx, [esp + 0x1234]
push edx
call fcn.004073f0
push str.Waiting_in_cmdline
call fcn.004073f0
push 3
lea eax, [esp + 0x304]
push eax
lea ecx, [esp + 0x1244]
push ecx
call fcn.0041f940
lea edx, [esp + 0x30c]
push edx
call fcn.004073f0
lea eax, [esp + 0x310]
push eax
call fcn.0040eb40
push 0x103
lea ecx, [esp + 0x521]
push 0
push ecx
mov esi, eax
mov byte [esp + 0x528], 0
call fcn.0042eb30
push esi
lea edx, [esp + 0x52c]
push str.File_date_creation_diff___d
push edx
call fcn.0040dcc0
lea eax, [esp + 0x534]
add esp, 0x40
push eax
call fcn.004073f0
add esp, 4
cmp esi, 5
ja 0x42284b
push str.new_cmdline_found
call fcn.004073f0
mov eax, dword [0x470170]
add esp, 4
test eax, eax
je 0x42284b
lea ecx, [esp + 0x1b4]
push ecx
lea edx, [esp + 0x2f0]
push edx
call eax
lea eax, [esp + 0x1bc]
push eax
call fcn.0040b650
add esp, 0xc
test al, al
je 0x42284b
mov eax, dword [0x470168]
test eax, eax
je 0x42284b
lea ecx, [esp + 0x2ec]
push ecx
call eax
add esp, 4
cmp eax, 1
je 0x42284b
lea edx, [esp + 0x2ec]
push edx
call dword [0x47016c]
add esp, 4
test al, al
jne 0x42284b
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
push 0x31
lea eax, [esp + 0x189]
push 0
push eax
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x194]
push str.NPAV4_s
push edx
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea edx, [esp + 0x1260]
push edx
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push str.NPAV4WORM.RUN_DLL.NPAV4.13122023
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
mov ecx, dword [esp + 0x90]
add esp, 0x48
push str..np4
push 1
push ecx
call fcn.00428940
push 0xff
lea edx, [esp + 0x401]
push 0
push edx
mov byte [esp + 0x408], 0
call fcn.0042eb30
lea eax, [esp + 0x304]
push eax
lea ecx, [esp + 0x40c]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0x24
push 1
lea edx, [esp + 0x3f4]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4222f2
lea ecx, [esp + 0x3f0]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4222f2
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x204]
push str.WORM.RUN_DLL.NPAV4.13122023
push ecx
call fcn.0040a000
lea edx, [esp + 0x88]
push edx
call fcn.0040c960
push str.TASKKILL__F__IM_RUNDLL32.EXE
call fcn.00430b8d
mov ebp, dword [0x46f734]
add esp, 0x2c
test ebp, ebp
je 0x4223dc
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x422380
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422380
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.RUN_DLL.NPAV4.13122023
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x422841
mov eax, dword [0x47017c]
test eax, eax
je 0x422420
push str.WORM.RUN_DLL.NPAV4.13122023
lea edx, [esp + 0x122c]
push edx
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.RUN_DLL.NPAV4.13122023
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x422460
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422460
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422475
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4224a0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4224b1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4224d0
mov ax, word [0x45ea50]
push 0x46f738
mov word [edi], ax
call fcn.00407460
add esp, 4
test eax, eax
jne 0x422841
cmp dword [0x470144], eax
je 0x422841
lea ecx, [esp + 0x2c]
push ecx
push eax
push eax
push 0x40e800
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x422841
push 0x45ea30
lea edx, [esp + 0x1a2c]
push edx
call ebp
test eax, eax
je 0x42284b
lea eax, [esp + 0x1a28]
push eax
lea ecx, [esp + 0x122c]
push 0x800
push ecx
call fcn.004308a5
add esp, 0xc
push 0x800
lea edx, [esp + 0x122c]
push edx
lea eax, [esp + 0x1a30]
push eax
call ebx
push 0x103
lea ecx, [esp + 0x3f5]
push 0
push ecx
mov byte [esp + 0x3fc], 0
call fcn.0042eb30
lea edx, [esp + 0x1234]
push edx
call fcn.004073f0
push str.Waiting_in_cmdline
call fcn.004073f0
push 3
lea eax, [esp + 0x408]
push eax
lea ecx, [esp + 0x1244]
push ecx
call fcn.0041f940
lea edx, [esp + 0x410]
push edx
call fcn.004073f0
lea eax, [esp + 0x414]
push eax
call fcn.0040eb40
add esp, 0x28
cmp eax, 5
ja 0x42284b
mov eax, dword [0x470170]
test eax, eax
je 0x42284b
lea ecx, [esp + 0x1b4]
push ecx
lea edx, [esp + 0x3f4]
push edx
call eax
lea eax, [esp + 0x1bc]
push eax
call fcn.0040b650
add esp, 0xc
test al, al
je 0x42284b
mov eax, dword [0x470168]
test eax, eax
je 0x42284b
lea ecx, [esp + 0x3f0]
push ecx
call eax
add esp, 4
cmp eax, 1
je 0x42284b
lea edx, [esp + 0x3f0]
push edx
call dword [0x47016c]
add esp, 4
test al, al
jne 0x42284b
xor eax, eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov word [esp + 0x170], ax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x16c]
push str.pid__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x174]
push edx
call fcn.004073f0
push 0x31
lea eax, [esp + 0x189]
push 0
push eax
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x194]
push str.NPAV4_s
push edx
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea edx, [esp + 0x1260]
push edx
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push str.NPAV4AUD.RUN_DLL.NPAV4.28082023
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x4f9]
push 0
push ecx
mov byte [esp + 0x500], 0
call fcn.0042eb30
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x508]
push str._s__d
push ecx
call fcn.0042ecc6
add esp, 0x1c
cmp dword [0x470154], 0
jne 0x422841
mov eax, dword [0x47017c]
test eax, eax
je 0x422783
push str.AUD.RUN_DLL.NPAV4.28082023
lea edx, [esp + 0x122c]
push edx
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x508]
push edx
push 1
call eax
add esp, 0x1c
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.AUD.RUN_DLL.NPAV4.28082023
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4227c0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4227d5
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422800
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422811
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422830
mov ax, word [0x45ea50]
mov word [edi], ax
mov dword [0x470154], 1
lea ecx, [esp + 0x64]
push str.PROCESSHACKER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea edx, [esp + 0x64]
push str.MIMIKATZ.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea eax, [esp + 0x64]
push str.NS.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea ecx, [esp + 0x64]
push str.NC.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea edx, [esp + 0x64]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea eax, [esp + 0x64]
push str.NPSETUP.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea ecx, [esp + 0x64]
push str.STOPNPAV.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea edx, [esp + 0x64]
push str.TASKMGR.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea eax, [esp + 0x64]
push str.STARTNP.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea ecx, [esp + 0x64]
push str.PROCXP64.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea edx, [esp + 0x64]
push str.PROCXP.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
push 6
lea eax, [esp + 0x68]
push str.NLBRUT
push eax
call fcn.004309be
add esp, 0xc
test eax, eax
je 0x422a2b
push 0xd
lea ecx, [esp + 0x68]
push str.PROCESSHACKER
push ecx
call fcn.004309be
add esp, 0xc
test eax, eax
je 0x422a2b
push 9
lea edx, [esp + 0x68]
push str.KPORTSCAN
push edx
call fcn.004309be
add esp, 0xc
test eax, eax
je 0x422a2b
lea eax, [esp + 0x64]
push str.ARP.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea ecx, [esp + 0x64]
push str.QUSER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea edx, [esp + 0x64]
push str.WINRS.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea eax, [esp + 0x64]
push str.CURL.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x422a2b
lea ecx, [esp + 0x64]
push str.SHARE.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x422e35
push str.Rdp_hacker_rule
call fcn.004073f0
mov edx, dword [esp + 0x4c]
add esp, 4
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425f92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
push eax
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x422e35
push str.UNDER_RDP_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470174], 0
je 0x425f92
push str.going_to_Export_INIIR_checking_rule
call fcn.004073f0
push 0xd3d
call dword [0x470174]
add esp, 8
cmp eax, 1
jne 0x422e35
push str.going_to_checking_rule
call fcn.004073f0
mov ecx, dword [esp + 0x4c]
push ecx
xor eax, eax
lea edx, [esp + 0x170]
push str.pid__d
push edx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov word [esp + 0x180], ax
call fcn.0042ecc6
lea eax, [esp + 0x178]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x18d]
push 0
push ecx
mov byte [esp + 0x194], 0
call fcn.0042eb30
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x198]
push str.NPAV4_s
push eax
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x74]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RDPHACKER.NPAV4.10052018
push str.NPAV4RDPHACKER.NPAV4.10052018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b8]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x204]
push str.WORM.RDPHACKER.NPAV4.10052018
push ecx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422bf3
push str.WORM.RDPHACKER.NPAV4.10052018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x1fc]
push ecx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x422c7f
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x422c20
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422c20
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x64]
push str.TASKMGR.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea edx, [esp + 0x64]
push str.STARTNP.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
lea eax, [esp + 0x64]
push str.STOPNPAV.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f470
push 0
push 0
call ebx
lea ecx, [esp + 0x64]
push ecx
call fcn.0040c960
call fcn.0040c260
mov edx, dword [esp + 0x4c]
push 1
push edx
call fcn.00408550
mov eax, dword [0x470178]
add esp, 0xc
test eax, eax
je 0x422d0d
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [0x470154], 0
jne 0x422e1e
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str._WORM.RDPHACKER.NPAV4.10052018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x422d80
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x422d95
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x422dc0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x422dd1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x422df0
cmp dword [0x470144], 0
mov ax, word [0x45ea50]
mov word [edi], ax
je 0x422e1e
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0x40e800
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.CLEANUNINSTALL.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4231a5
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425f92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x4231a5
mov edx, dword [esp + 0x48]
xor eax, eax
push edx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
lea eax, [esp + 0x16c]
push str.pid__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x174]
push ecx
call fcn.004073f0
push 0x31
lea edx, [esp + 0x189]
push 0
push edx
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x194]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4CLEANUN_RDP.NPAV4.070619
inc eax
push str.NPAV4CLEANUN_RDP.NPAV4.070619
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x1ed]
push 0
push ecx
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1fc]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x204]
push str.WORM.CLEANUN_RDP.NPAV4.070619
push edx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x422fc5
push str.WORM.CLEANUN_RDP.NPAV4.070619
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x42304e
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x422ff0
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f470
push 0
push 0
call ebx
lea edx, [esp + 0x64]
push edx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x423082
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [0x470154], 0
jne 0x42318e
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.CLEANUN_RDP.NPAV4.070619
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4230f0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423105
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423130
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423141
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423160
cmp dword [0x470144], 0
mov ax, word [0x45ea50]
mov word [edi], ax
je 0x42318e
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0x40e800
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea edx, [esp + 0x64]
push str.IOBITT.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
lea eax, [esp + 0x64]
push str.IOBIT.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
lea ecx, [esp + 0x64]
push str.GMER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
lea edx, [esp + 0x64]
push str.IOBITUNINSTALER.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
lea eax, [esp + 0x64]
push str.IUSERVICE.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
push 0xd
lea ecx, [esp + 0x68]
push str.PROCESSHACKER
push ecx
call fcn.004309be
add esp, 0xc
test eax, eax
je 0x42329f
push 0x17
lea edx, [esp + 0x68]
push str.CONCURRENT_RDP_PATCHER.
push edx
call fcn.004309be
add esp, 0xc
test eax, eax
je 0x42329f
lea eax, [esp + 0x64]
push str.NETSCAN.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42329f
push 9
lea ecx, [esp + 0x68]
push str.UNLOCKER_
push ecx
call fcn.0045329f
add esp, 0xc
test eax, eax
je 0x42329f
lea edx, [esp + 0x64]
push str.IOBITUNLOCKER.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4236a3
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425f92
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x4236a3
mov edx, dword [esp + 0x48]
xor eax, eax
push edx
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
lea eax, [esp + 0x16c]
push str.pid__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x174]
push ecx
call fcn.004073f0
push 0x31
lea edx, [esp + 0x189]
push 0
push edx
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x194]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4HACKT_RDP.NPAV4.180722
inc eax
push str.NPAV4HACKT_RDP.NPAV4.180722
mov dword [0x46ff94], eax
lea eax, [esp + 0x1b4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x48
push 0x103
lea ecx, [esp + 0x1ed]
push 0
push ecx
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1fc]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x204]
push str.WORM.HACKT_RDP.NPAV4.180722
push edx
call fcn.0040a000
mov eax, dword [0x47017c]
add esp, 0x24
test eax, eax
je 0x423415
push str.WORM.HACKT_RDP.NPAV4.180722
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x42349c
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x423440
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423440
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40f470
push 0
push 0
call ebx
lea edx, [esp + 0x64]
push edx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x470178]
test eax, eax
je 0x4234d0
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [0x470154], 0
jne 0x42368c
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
push 0x104
push 0
mov ecx, 7
mov esi, str.WORM.HACKT_RDP.NPAV4.180722
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x423540
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x423555
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x423580
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423591
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4235b0
mov ax, word [0x45ea50]
push 0x103
lea ecx, [esp + 0x909]
push 0
push ecx
mov word [edi], ax
mov byte [esp + 0x910], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x505]
push 0
push edx
mov byte [esp + 0x50c], 0
call fcn.0042eb30
add esp, 0x18
push 0x800
lea eax, [esp + 0x4f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x4f4]
push 0x5c
push ecx
call fcn.0042f060
add esp, 8
test eax, eax
je 0x42366f
push str.TASKKILL__F__IM_ANYDESK.EXE
mov byte [eax], 0
call fcn.00430b8d
lea edx, [esp + 0x4f8]
push edx
lea eax, [esp + 0x90c]
push str._sZVSCANPANTAGENT.EXE
push eax
call fcn.0042ecc6
add esp, 0x10
push 0
push 0
push str._AutoStart
lea ecx, [esp + 0x910]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [0x470144], 0
je 0x42368c
lea edx, [esp + 0x3c]
push edx
push 0
push 0
push 0x40e800
push 0
push 0
call ebx
push str.Sig_found_and_Terminate_
call fcn.004073f0
add esp, 4
mov dword [0x470154], 1
lea eax, [esp + 0x64]
push str.CSRSS.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x423bff
push 0x12c
push eax
push 0x46fba8
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045315b
add esp, 0x1c
test eax, eax
je 0x425f92
mov edx, dword [esp + 0x48]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425f92
push 0x104
lea eax, [esp + 0x5fc]
push 0
push eax
call fcn.0042eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 0x5fc]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5f8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423750
sub eax, edx
je 0x425f92
lea edx, [esp + 0x5f8]
push edx
call fcn.004303aa
lea eax, [esp + 0x5fc]
push str.SYSTEM32_
push eax
call fcn.0042f090
add esp, 0xc
test eax, eax
jne 0x423bff
lea ecx, [esp + 0x5f8]
push str.WINSXS_
push ecx
call fcn.0042f090
add esp, 8
test eax, eax
jne 0x423bff
mov edx, dword [esp + 0x48]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x423bff
push 0x104
push 0
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4237e1
sub eax, edx
je 0x423bff
push str.SYSTEM
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.CSRSS.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423840
sub eax, edx
je 0x423bff
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x423bff
call fcn.0040c260
push str.WORM.ETERNALB.NPAV4.30102018_Terminated_csrsss.EXE_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x170]
push str.pid__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x178]
push edx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ETERNALB.NPAV4.30102018
push str.NPAV4ETERNALB.NPAV4.30102018
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4CSRSS.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x838]
push 0
push edx
call fcn.0042eb30
mov ecx, dword [esp + 0x88]
add esp, 0x40
lea eax, [esp + 0x800]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x1f5]
push 0
push edx
mov byte [esp + 0x1fc], 0
call fcn.0042eb30
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0x818]
push ecx
lea edx, [esp + 0x204]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [esp + 0x20c]
push str.WORM.ETERNALB.NPAV4.30102018
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x44
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x4239b0
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4239c5
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4239f0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x423a01
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x423a20
mov ebp, dword [0x46f734]
mov ax, word [0x45ea50]
mov word [edi], ax
test ebp, ebp
je 0x423ab0
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x423a51
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ETERNALB.NPAV4.30102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470154], 0
jne 0x423ada
cmp dword [0x470144], 0
je 0x423ada
lea eax, [esp + 0x30]
push eax
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [esp + 0x3f5]
push 0
push ecx
mov dword [0x470154], 1
mov byte [esp + 0x3fc], 0
call fcn.0042eb30
push 0xff
lea edx, [esp + 0x2fd]
push 0
push edx
mov byte [esp + 0x304], 0
call fcn.0042eb30
mov eax, dword [esp + 0x60]
push eax
call fcn.0040e840
add esp, 0x1c
test eax, eax
je 0x423bbc
lea edx, [esp + 0x2ec]
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x423b40
lea ecx, [esp + 0x2ec]
push ecx
lea edx, [esp + 0x3f4]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0xc
push 1
lea eax, [esp + 0x3f4]
push eax
lea ecx, [esp + 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x423bbc
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0x2f0]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x423bae
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x423bbc
lea ecx, [esp + 0x2ec]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x48]
push 1
push edx
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x423bff
push str.WORM.ETERNALB.NPAV4.30102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x608]
push ecx
lea edx, [esp + 0x1fc]
push edx
push 1
call eax
add esp, 0x1c
lea eax, [esp + 0x64]
push str.POWERSHELL.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x423e38
mov ecx, dword [esp + 0x48]
push ecx
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425f92
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov esi, dword [0x46a1e4]
test esi, esi
je 0x425f92
push 0x7ff
lea edx, [esp + 0x122d]
push 0
push edx
mov byte [esp + 0x1234], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x1234]
push eax
push ecx
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0x14
push str._NOP
lea edx, [esp + 0x122c]
push edx
call esi
test eax, eax
je 0x423e3e
push str.__NONI
lea eax, [esp + 0x122c]
push eax
call esi
test eax, eax
je 0x423e3e
push str._HIDDEN
lea ecx, [esp + 0x122c]
push ecx
call esi
test eax, eax
je 0x423e3e
push str..DownloadFile
lea edx, [esp + 0x122c]
push edx
call esi
test eax, eax
je 0x423e3e
push str..ShellExecute
lea eax, [esp + 0x122c]
push eax
call esi
test eax, eax
je 0x423e3e
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ecc6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PS.NPAV4.05062018
push str.NPAV4PS.NPAV4.05062018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x4f9]
push 0
push eax
mov byte [esp + 0x500], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x508]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x510]
push str._WORM.PS.NPAV4.05062018
push ecx
call fcn.0040a000
lea edx, [esp + 0x88]
push edx
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 0x28
test eax, eax
je 0x423e3e
push str.WORM.PS.NPAV4.05062018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x508]
push edx
push 1
call eax
add esp, 0x1c
jmp 0x423e3e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x64]
push str.TIMEOUT.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x423ec6
lea ecx, [esp + 0x64]
push str.NS.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x423ec6
lea edx, [esp + 0x64]
push str.IOBITT.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x423ec6
lea eax, [esp + 0x64]
push str.IOBITUNLOCKER.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x423ec6
lea ecx, [esp + 0x64]
push str.IOBIT.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x423ec6
lea edx, [esp + 0x64]
push str.NC.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x424116
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425f92
push eax
call ebx
cmp dword [0x470154], 0
jne 0x423f16
lea ecx, [esp + 0x64]
push str.TIMEOUT.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x423f16
call fcn.0040c260
mov dword [0x470154], 1
jmp 0x425f92
mov edx, dword [esp + 0x48]
push edx
call fcn.0040c6f0
push eax
call fcn.0040c710
add esp, 8
cmp eax, 3
jne 0x424116
lea eax, [esp + 0x64]
push str.TIMEOUT.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x424116
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ecc6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x31
lea ecx, [esp + 0x189]
push 0
push ecx
mov byte [esp + 0x190], 0
call fcn.0042eb30
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x194]
push str.NPAV4_s
push eax
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x70]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4MALPRO.NPAV4.01102018
push str.NPAV4MALPRO.NPAV4.01102018
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1b4]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x48
push 0x103
lea eax, [esp + 0x1ed]
push 0
push eax
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x1fc]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x204]
push str._WORM.MALPRO.NPAV4.01102018
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x24
test ebp, ebp
je 0x4240d0
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424071
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.MALPRO.NPAV4.01102018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
lea ecx, [esp + 0x64]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
mov eax, dword [0x47017c]
test eax, eax
je 0x424116
push str.WORM.MALPRO.NPAV4.01102018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x1fc]
push ecx
push 1
call eax
add esp, 0x1c
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x424570
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425f92
push 0x104
lea ecx, [esp + 0x5fc]
push 0
push ecx
call fcn.0042eb30
add esp, 0xc
push 0x104
lea edx, [esp + 0x5fc]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call ebx
lea eax, [esp + 0x5f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424185
sub eax, edx
je 0x425f92
lea eax, [esp + 0x5f8]
push eax
call fcn.004303aa
lea ecx, [esp + 0x5fc]
push str.TEMP_
push ecx
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x424570
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x64]
push edx
push eax
mov byte [0x46fec6], 1
mov byte [0x46fec7], 1
call fcn.00408b60
add esp, 8
test al, al
je 0x424570
mov ecx, dword [0x46ff94]
mov eax, dword [esp + 0x48]
mov dword [ecx*4 + 0x4693b8], eax
inc ecx
push 0
push eax
mov dword [0x46ff94], ecx
call fcn.00408550
lea ecx, [esp + 0x6c]
push str.WORM.CTB_LOCK.210115
push ecx
call fcn.0040a000
mov ebp, dword [0x46f734]
add esp, 0x10
test ebp, ebp
je 0x4242cc
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424240
mov edx, dword [str.WORM.CTB_LOCK.210115]
mov eax, dword [0x45d984]
mov ecx, dword [0x45d988]
mov dword [0x46a03e], edx
mov edx, dword [0x45d98c]
mov dword [0x46a042], eax
mov eax, dword [0x45d990]
mov dword [0x46a046], ecx
mov cl, byte [0x45d994]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov byte [0x46a052], cl
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d984]
mov eax, dword [0x45d988]
mov dword [0x46f738], ecx
mov ecx, dword [0x45d98c]
mov dword [0x46f73c], edx
mov edx, dword [0x45d990]
mov dword [0x46f744], ecx
mov ecx, dword [esp + 0x54]
mov dword [0x46f740], eax
mov al, byte [0x45d994]
push ecx
mov dword [0x46f748], edx
mov byte [0x46f74c], al
xor eax, eax
lea edx, [esp + 0x1b8]
push str.pid__d
push edx
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1c4], eax
mov word [esp + 0x1c8], ax
call fcn.0042ecc6
push 0x104
push 0
push 0x46f978
call fcn.0042eb30
add esp, 0x24
xor eax, eax
jmp 0x424370
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424370
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424385
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x1a8]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4243b0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4243c1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4243e0
mov ax, word [0x45ea50]
push 0x104
lea ecx, [esp + 0xd18]
push 0
push ecx
mov word [edi], ax
call fcn.0042eb30
push 0x104
lea edx, [esp + 0xc20]
push 0
push edx
call fcn.0042eb30
push 0x104
lea eax, [esp + 0xa24]
push 0
push eax
call fcn.0042eb30
add esp, 0x24
xor eax, eax
jmp 0x424440
mov cl, byte [esp + eax + 0x5f8]
mov byte [esp + eax + 0xa08], cl
inc eax
test cl, cl
jne 0x424440
mov eax, dword [0x469868]
test eax, eax
je 0x424476
push 0x104
lea ecx, [esp + 0xc14]
push ecx
lea edx, [esp + 0xa10]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
test eax, eax
je 0x424494
lea ecx, [esp + 0xd14]
push ecx
lea edx, [esp + 0xa0c]
push edx
call eax
add esp, 8
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea eax, [esp + 0xd20]
push eax
lea ecx, [esp + 0xc20]
push ecx
lea edx, [esp + 0x60c]
push edx
push 0x45caa0
push str.WORM.CTB_LOCK.210115
call fcn.00407310
push 0x104
lea eax, [esp + 0xb30]
push 0
push eax
call fcn.0042eb30
add esp, 0x2c
xor eax, eax
jmp 0x4244f0
mov cl, byte [esp + eax + 0x5f8]
mov byte [esp + eax + 0xb0c], cl
inc eax
test cl, cl
jne 0x4244f0
lea eax, [esp + 0xb0c]
dec eax
jmp 0x424510
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424510
mov ecx, dword [str..np4.vir]
mov edx, dword [0x45bfd4]
mov dword [eax], ecx
mov cl, byte [0x45bfd8]
mov dword [eax + 4], edx
push 1
lea edx, [esp + 0xb10]
mov byte [eax + 8], cl
push edx
lea eax, [esp + 0x600]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.00408eb0
cmp dword [0x470144], 0
je 0x424570
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x46fec4], 0
jne 0x42499a
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x42499a
mov eax, dword [esp + 0x48]
push eax
call fcn.00408800
add esp, 4
test al, al
jne 0x42499a
push 0x104
push 0
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4245d2
sub eax, edx
je 0x42499a
push 0x12c
push 0
push 0x46fba8
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045315b
add esp, 0x1c
test eax, eax
jne 0x424629
cmp dword [0x46ff2c], eax
jne 0x424629
mov edx, dword [esp + 0x48]
mov dword [0x46ff2c], edx
push str.SYSTEM
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424676
sub eax, edx
je 0x42499a
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x42499a
push str.CryptoDefense:_Suspended_svchost.exe_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x170]
push str.pid__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x178]
push edx
call fcn.004073f0
mov eax, dword [esp + 0x5c]
push 0
push eax
call fcn.00408550
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x64]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x228]
push 0
push edx
call fcn.0042eb30
add esp, 0x48
push 0x104
lea eax, [esp + 0x1ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x1e8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424768
sub eax, ecx
je 0x4247ab
lea eax, [esp + 0x1e8]
dec eax
jmp 0x424780
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424780
mov ecx, dword [str._svchost.exe]
mov edx, dword [0x45da60]
mov dword [eax], ecx
mov ecx, dword [0x45da64]
mov dword [eax + 4], edx
mov dl, byte [0x45da68]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [esp + 0x1e8]
push str.WORM.CRYPTO.05052014
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov edx, dword [0x45da4c]
mov ecx, dword [0x45da48]
mov eax, dword [0x45da50]
mov ebx, dword [str.WORM.CRYPTO.05052014]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45da54]
mov dword [0x46f740], edx
mov dl, byte [0x45da58]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042eb30
add esp, 0x20
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424830
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424845
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424870
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424881
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4248a0
mov ebp, dword [0x46f734]
mov ax, word [0x45ea50]
mov word [edi], ax
test ebp, ebp
je 0x42496b
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x4248e0
mov cl, byte [esp + eax + 0x1e8]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x4248e0
mov ecx, dword [0x45da48]
mov edx, dword [0x45da4c]
mov eax, dword [0x45da50]
mov dword [0x46a042], ecx
mov ecx, dword [0x45da54]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dl, byte [0x45da58]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x42499a
call fcn.00407a90
cmp dword [0x470144], 0
je 0x42499a
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x64]
push str.WININIT.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x424f5b
push 0x12c
push eax
push 0x46fba8
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push 0x46fba8
push ecx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045315b
add esp, 0x1c
test eax, eax
je 0x425f92
mov edx, dword [esp + 0x48]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425f92
push 0x104
lea eax, [esp + 0x5fc]
push 0
push eax
call fcn.0042eb30
add esp, 0xc
push 0x104
lea ecx, [esp + 0x5fc]
push ecx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424a46
sub eax, edx
je 0x425f92
lea edx, [esp + 0x5f8]
push edx
call fcn.004303aa
lea eax, [esp + 0x5fc]
push str.SYSTEM32_
push eax
call fcn.0042f090
add esp, 0xc
test eax, eax
jne 0x424f5b
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x424f5b
push 0x104
push 0
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424ac0
sub eax, edx
je 0x424f5b
push str.SYSTEM
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.wininit.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x424b20
sub eax, edx
je 0x424f5b
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x424f5b
push str.WORM.Bancteian.CB4_Terminated_wininit.exe_Process
call fcn.004073f0
mov edx, dword [esp + 0x4c]
xor eax, eax
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
lea eax, [esp + 0x170]
push str.pid__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x178]
push ecx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4wininit.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [esp + 0x838]
push 0
push eax
call fcn.0042eb30
mov edx, dword [esp + 0x88]
add esp, 0x40
lea ecx, [esp + 0x800]
push ecx
push edx
call fcn.00408710
push 0x103
lea eax, [esp + 0x709]
push 0
push eax
mov byte [esp + 0x710], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x5c]
push ecx
lea edx, [esp + 0x818]
push edx
lea eax, [esp + 0x718]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x720]
push str.WORM.Bancteian.01122016
push ecx
call fcn.0040a000
lea eax, [esp + 0x728]
add esp, 0x2c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424c58
sub eax, ecx
je 0x424c9b
lea eax, [esp + 0x6fc]
dec eax
jmp 0x424c70
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424c70
mov edx, dword [str.wininit.exe]
mov ecx, dword [0x45e3c0]
mov dword [eax], edx
mov edx, dword [0x45e3c4]
mov dword [eax + 4], ecx
mov cl, byte [0x45e3c8]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [esp + 0x6fc]
push str.WORM.Bancteian.01122016
push edx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov eax, dword [0x45e3d0]
mov ecx, dword [0x45e3d4]
mov edx, dword [0x45e3d8]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], eax
mov eax, dword [0x45e3dc]
mov dword [0x46f740], ecx
mov ecx, dword [0x45e3e0]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042eb30
add esp, 0x20
xor eax, eax
jmp 0x424d20
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x424d20
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x424d35
mov dx, word [0x45ea54]
mov cl, byte [0x45ea56]
mov word [eax], dx
mov byte [eax + 2], cl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x424d60
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x424d71
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x424d90
mov ebp, dword [0x46f734]
mov dx, word [0x45ea50]
mov word [edi], dx
test ebp, ebp
je 0x424e59
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x424dd0
mov cl, byte [esp + eax + 0x6fc]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x424dd0
mov eax, dword [0x45e3d0]
mov ecx, dword [0x45e3d4]
mov edx, dword [0x45e3d8]
mov dword [0x46a042], eax
mov eax, dword [0x45e3dc]
mov dword [0x46a046], ecx
mov ecx, dword [0x45e3e0]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x424e7a
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [esp + 0x3f5]
push 0
push edx
mov byte [esp + 0x3fc], 0
call fcn.0042eb30
push 0xff
lea eax, [esp + 0x2fd]
push 0
push eax
mov byte [esp + 0x304], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040e840
add esp, 0x1c
test eax, eax
je 0x424f4c
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x424ed0
lea edx, [esp + 0x2ec]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x424f4c
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x2f0]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x424f3e
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x424f4c
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x48]
push 1
push eax
call fcn.00408550
add esp, 8
lea ecx, [esp + 0x64]
push str.SPOOLSV.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4254bd
push 0x12c
push eax
push 0x46fba8
call fcn.0042eb30
mov edx, dword [esp + 0x54]
push 0x46fba8
push edx
call fcn.00408430
push str.SYSTEM
push 0x46fba8
call fcn.0045315b
add esp, 0x1c
test eax, eax
je 0x425f92
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425f92
push 0x104
lea ecx, [esp + 0x5fc]
push 0
push ecx
call fcn.0042eb30
add esp, 0xc
push 0x104
lea edx, [esp + 0x5fc]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425007
sub eax, edx
je 0x425f92
lea eax, [esp + 0x5f8]
push eax
call fcn.004303aa
lea ecx, [esp + 0x5fc]
push str.SYSTEM32_
push ecx
call fcn.0042f090
add esp, 0xc
test eax, eax
jne 0x4254bd
mov edx, dword [esp + 0x48]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x4254bd
push 0x104
push 0
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
jmp 0x425080
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425080
sub eax, edx
je 0x4254bd
push str.SYSTEM
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
je 0x425f92
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.SPOOLSV.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4250e0
sub eax, edx
je 0x4254bd
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4254bd
push str.WORM.Bancteian.CB4_Terminated_SPOOLSV.EXE_Process
call fcn.004073f0
xor eax, eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov word [esp + 0x174], ax
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x170]
push str.pid__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x178]
push edx
call fcn.004073f0
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x5c]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Bancteian.01122016
push str.NPAV4Bancteian.01122016
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4SPOOLSV.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea edx, [esp + 0x838]
push 0
push edx
call fcn.0042eb30
mov ecx, dword [esp + 0x88]
add esp, 0x40
lea eax, [esp + 0x800]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [esp + 0x501]
push 0
push edx
mov byte [esp + 0x508], 0
call fcn.0042eb30
mov eax, dword [esp + 0x5c]
push eax
lea ecx, [esp + 0x818]
push ecx
lea edx, [esp + 0x510]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [esp + 0x518]
push str.WORM.Bancteian.01122016
push eax
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, dword [0x45e3d0]
mov edx, dword [0x45e3d4]
mov eax, dword [0x45e3d8]
mov ebx, dword [str.WORM.Bancteian.01122016]
push 0x104
mov dword [0x46f73c], ecx
mov ecx, dword [0x45e3dc]
mov dword [0x46f740], edx
mov edx, dword [0x45e3e0]
push 0
push 0x46f978
mov dword [0x46f738], ebx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov dword [0x46f74c], edx
call fcn.0042eb30
add esp, 0x44
xor eax, eax
jmp 0x425280
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425280
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425295
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4252c0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4252d1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4252f0
mov ebp, dword [0x46f734]
mov ax, word [0x45ea50]
mov word [edi], ax
test ebp, ebp
je 0x4253bb
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x425330
mov cl, byte [esp + eax + 0x4f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425330
mov ecx, dword [0x45e3d0]
mov edx, dword [0x45e3d4]
mov eax, dword [0x45e3d8]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e3dc]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov edx, dword [0x45e3e0]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov dword [0x46a052], edx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
cmp dword [0x470144], 0
je 0x4253dc
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0x40e800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [esp + 0x3f5]
push 0
push eax
mov byte [esp + 0x3fc], 0
call fcn.0042eb30
push 0xff
lea ecx, [esp + 0x2fd]
push 0
push ecx
mov byte [esp + 0x304], 0
call fcn.0042eb30
mov edx, dword [esp + 0x60]
push edx
call fcn.0040e840
add esp, 0x1c
test eax, eax
je 0x4254ae
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425432
lea eax, [esp + 0x2ec]
push eax
lea ecx, [esp + 0x3f4]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [esp + 0x3f4]
push edx
lea eax, [esp + 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4254ae
lea ecx, [esp + 0x3f0]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4254a0
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4254ae
lea eax, [esp + 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x48]
push 1
push ecx
call fcn.00408550
add esp, 8
lea edx, [esp + 0x64]
push str.EXPLORER.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea eax, [esp + 0x64]
push str.ICSYS.ICN.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea ecx, [esp + 0x64]
push str.EXPLORER.EXE.VIR
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea edx, [esp + 0x64]
push str.EXPLORER.EXE.MAL
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea eax, [esp + 0x64]
push str.SVCHOST.VXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea ecx, [esp + 0x64]
push str.ICSYS.ICN.EXE.VIR
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x42555f
lea edx, [esp + 0x64]
push str.SVCHOST.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x425b51
mov eax, dword [esp + 0x48]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x425f92
push 0x104
lea ecx, [esp + 0x5fc]
push 0
push ecx
call fcn.0042eb30
add esp, 0xc
push 0x104
lea edx, [esp + 0x5fc]
push edx
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4255b8
sub eax, edx
je 0x425f92
lea eax, [esp + 0x5f8]
push eax
call fcn.004303aa
lea ecx, [esp + 0x5fc]
push str.RESOURCES_
push ecx
call fcn.0042f090
add esp, 0xc
test eax, eax
je 0x425b51
push str.File_path_found
call fcn.004073f0
mov edx, dword [esp + 0x4c]
xor eax, eax
push edx
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov word [esp + 0x178], ax
lea eax, [esp + 0x170]
push str.pid__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x178]
push ecx
call fcn.004073f0
push 0x104
lea edx, [esp + 0x818]
push 0
push edx
call fcn.0042eb30
mov ecx, dword [esp + 0x68]
lea eax, [esp + 0x820]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [esp + 0x1a1]
push 0
push edx
mov byte [esp + 0x1a8], 0
call fcn.0042eb30
lea eax, [esp + 0x834]
push eax
lea ecx, [esp + 0x1ac]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov edx, dword [esp + 0x88]
add esp, 0x40
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov dword [eax*4 + 0x4693b8], edx
push str.NPAV4NP4.SWISYSN.26102017
inc eax
push str.NPAV4NP4.SWISYSN.26102017
mov dword [0x46ff94], eax
lea eax, [esp + 0x18c]
push 0x45caa0
push eax
call fcn.00407310
push 0x103
lea ecx, [esp + 0x519]
push 0
push ecx
mov byte [esp + 0x520], 0
call fcn.0042eb30
mov edx, dword [esp + 0x74]
push edx
lea eax, [esp + 0x830]
push eax
lea ecx, [esp + 0x528]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x530]
push str._WORM.NP4.SWISYSN.26102017
push edx
call fcn.0040a000
add esp, 0x44
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str._WORM.NP4.SWISYSN.26102017
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x104
push 0
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x425770
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425770
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425785
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4257b0
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4257c1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4257e0
mov ax, word [0x45ea50]
push 0x103
lea ecx, [esp + 0x1ed]
push 0
push ecx
mov word [edi], ax
mov byte [esp + 0x1f4], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x915]
push 0
push edx
mov byte [esp + 0x91c], 0
call fcn.0042eb30
push 0x103
lea eax, [esp + 0x40d]
push 0
push eax
mov byte [esp + 0x414], 0
call fcn.0042eb30
push 0x103
lea ecx, [esp + 0x725]
push 0
push ecx
mov byte [esp + 0x72c], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x321]
push 0
push edx
mov byte [esp + 0x328], 0
call fcn.0042eb30
push 0x103
lea eax, [esp + 0x1165]
push 0
push eax
mov byte [esp + 0x116c], 0
call fcn.0042eb30
add esp, 0x48
push 0x103
lea ecx, [esp + 0xf21]
push 0
push ecx
mov byte [esp + 0xf28], 0
call fcn.0042eb30
push 0x103
lea edx, [esp + 0x1031]
push 0
push edx
mov byte [esp + 0x1038], 0
call fcn.0042eb30
push 0x103
lea eax, [esp + 0xe35]
push 0
push eax
mov byte [esp + 0xe3c], 0
call fcn.0042eb30
add esp, 0x24
push 0x104
lea ecx, [esp + 0x700]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.RESOURCESTHEMESEXPLORER.EXE
lea edx, [esp + 0x700]
push edx
lea eax, [esp + 0x1f0]
push str._s_s
push eax
call fcn.0040dcc0
push str.RESOURCESSVCHOST.EXE
lea ecx, [esp + 0x710]
push ecx
lea edx, [esp + 0x91c]
push str._s_s
push edx
call fcn.0040dcc0
push str.RESOURCESTHEMESICSYS.ICN.EXE
lea eax, [esp + 0x720]
push eax
push str._s_s
lea ecx, [esp + 0x41c]
push ecx
call fcn.0040dcc0
push str.RESOURCESSPOOLSV.EXE
lea edx, [esp + 0x730]
push edx
lea eax, [esp + 0x324]
push str._s_s
push eax
call fcn.0040dcc0
add esp, 0x40
lea ecx, [esp + 0x1e8]
push ecx
lea edx, [esp + 0x1128]
push str._s.np4
push edx
call fcn.0042ecc6
lea eax, [esp + 0x910]
push eax
lea ecx, [esp + 0xf2c]
push str._s.np4
push ecx
call fcn.0042ecc6
lea edx, [esp + 0x408]
push edx
lea eax, [esp + 0x103c]
push str._s.np4
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x310]
push ecx
lea edx, [esp + 0xe40]
push str._s.np4
push edx
call fcn.0042ecc6
lea eax, [esp + 0x218]
push eax
call fcn.0040aeb0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0x34
push 1
lea ecx, [esp + 0x1128]
push ecx
lea edx, [esp + 0x1f0]
push edx
call esi
lea eax, [esp + 0x904]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xf20]
push ecx
lea edx, [esp + 0x90c]
push edx
call esi
lea eax, [esp + 0x3f0]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0x1024]
push ecx
lea edx, [esp + 0x3f8]
push edx
call esi
lea eax, [esp + 0x2ec]
push eax
call fcn.0040aeb0
add esp, 4
push 1
lea ecx, [esp + 0xe1c]
push ecx
lea edx, [esp + 0x2f4]
push edx
call esi
mov ebp, dword [0x46f734]
test ebp, ebp
je 0x425b0e
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x425ab0
mov cl, byte [esp + eax + 0x4f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425ab0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.NP4.SWISYSN.26102017
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
mov eax, dword [0x47017c]
test eax, eax
je 0x425b42
push str.WORM.NP4.SWISYSN.26102017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea edx, [esp + 0x184]
push edx
lea ecx, [esp + 0x508]
push ecx
push 1
call eax
add esp, 0x1c
mov edx, dword [esp + 0x48]
push 1
push edx
call fcn.00408550
add esp, 8
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str..vir
lea eax, [esp + 0x68]
push eax
call esi
test eax, eax
jne 0x425b9b
push str..mal
lea ecx, [esp + 0x68]
push ecx
call esi
test eax, eax
jne 0x425b9b
push str..np4
lea edx, [esp + 0x68]
push edx
call esi
test eax, eax
jne 0x425b9b
push str.SVCHOST..EXE
lea eax, [esp + 0x68]
push eax
call esi
test eax, eax
je 0x425f92
mov ecx, dword [esp + 0x48]
push ecx
xor eax, eax
lea edx, [esp + 0x16c]
push str.pid__d
push edx
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov word [esp + 0x17c], ax
call fcn.0042ecc6
lea eax, [esp + 0x174]
push eax
call fcn.004073f0
push 0x104
lea ecx, [esp + 0x814]
push 0
push ecx
call fcn.0042eb30
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x81c]
push edx
push eax
call fcn.00408710
push 0x31
lea ecx, [esp + 0x19d]
push 0
push ecx
mov byte [esp + 0x1a4], 0
call fcn.0042eb30
lea edx, [esp + 0x830]
push edx
lea eax, [esp + 0x1a8]
push str.NPAV4_s
push eax
call fcn.0042ecc6
mov eax, dword [0x46ff94]
mov ecx, dword [esp + 0x84]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RECECON.14112017
push str.NPAV4RECECON.14112017
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [esp + 0x1c8]
inc eax
push 0x45caa0
push edx
mov dword [0x46ff94], eax
call fcn.00407310
add esp, 0x5c
push 0x103
lea eax, [esp + 0x4f9]
push 0
push eax
mov byte [esp + 0x500], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x810]
push edx
lea eax, [esp + 0x508]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [esp + 0x510]
push str.WORM.RECECON.14112017
push ecx
call fcn.0040a000
push 0x104
push 0
push 0x46f738
call fcn.0042eb30
mov ebx, dword [str.WORM.RECECON.14112017]
mov edx, dword [0x45e1d0]
mov eax, dword [0x45e1d4]
mov ecx, dword [0x45e1d8]
mov dword [0x46f738], ebx
mov dword [0x46f73c], edx
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov edx, dword [0x45e1dc]
mov ax, word [0x45e1e0]
push 0x104
push 0
push 0x46f978
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042eb30
add esp, 0x3c
xor eax, eax
jmp 0x425d40
mov cl, byte [esp + eax + 0x64]
mov byte [eax + 0x46f978], cl
inc eax
test cl, cl
jne 0x425d40
mov eax, 0x46f978
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x425d55
mov cx, word [0x45ea54]
mov dl, byte [0x45ea56]
mov word [eax], cx
mov byte [eax + 2], dl
lea eax, [esp + 0x168]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425d80
mov edi, 0x46f978
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x425d91
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46f978
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x425db0
mov ebp, dword [0x46f734]
mov ax, word [0x45ea50]
mov word [edi], ax
test ebp, ebp
je 0x425e7d
push 0x1e0
push 0
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x425df0
mov cl, byte [esp + eax + 0x4f4]
mov byte [eax + 0x469f12], cl
inc eax
test cl, cl
jne 0x425df0
mov ecx, dword [0x45e1d0]
mov edx, dword [0x45e1d4]
mov eax, dword [0x45e1d8]
mov dword [0x46a042], ecx
mov ecx, dword [0x45e1dc]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dx, word [0x45e1e0]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a03e], ebx
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call ebp
add esp, 0x1e0
push 0xff
lea edx, [esp + 0x3f5]
push 0
push edx
mov byte [esp + 0x3fc], 0
call fcn.0042eb30
push 0xff
lea eax, [esp + 0x2fd]
push 0
push eax
mov byte [esp + 0x304], 0
call fcn.0042eb30
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040e840
add esp, 0x1c
test eax, eax
je 0x425f4f
lea edx, [esp + 0x2ec]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x425ed3
lea edx, [esp + 0x2ec]
push edx
lea eax, [esp + 0x3f4]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [esp + 0x3f4]
push ecx
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x425f4f
lea eax, [esp + 0x3f0]
push eax
lea ecx, [esp + 0x2f0]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x425f41
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x425f4f
lea edx, [esp + 0x2ec]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x48]
push 1
push eax
call fcn.00408550
mov eax, dword [0x47017c]
add esp, 8
test eax, eax
je 0x425f92
push str.WORM.RECECON.NPAV4.14112017
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [esp + 0x184]
push ecx
lea edx, [esp + 0x508]
push edx
push 1
call eax
add esp, 0x1c
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x40]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4214d1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042eb15
add esp, 0x221c
ret