Function at 0x45ab90
Capabilities:
Check if file exists
Check mutex on windows
Delete file
Enumerate processes
Set current directory
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ae96
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x5caea4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
push 0x20000
push 1
mov dword [ebp - 0x2b4], ebx
call fcn.00534ced
push eax
call fcn.0053ad4d
add esp, 8
push eax
call fcn.0053ab6d
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_12
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x5d1ac0
mov dword [0x5d1adc], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00459e40
push str.Decryptor_6.3
call fcn.0045a000
add esp, 4
push str.Decrypt_tool
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
push str.___Process_init...
mov dword [0x5d12e4], eax
call fcn.0045a000
add esp, 4
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x45ac61
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x45ac81
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push edi
call esi
push str.NtQueryInformationProcess
push edi
mov dword [0x5d12ec], eax
call esi
mov dword [0x5d12e8], eax
call fcn.00461880
push str.___Set_Privileges...
call fcn.0045a000
add esp, 4
call fcn.00460a10
cmp dword [ebp + 8], 2
mov esi, 1
jne 0x45ad5e
mov edx, dword [ebx + 4]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45acc3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.0044a1c0
mov ebx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x30]
mov esi, dword [ebp - 0x30]
cmp ebx, 8
mov edi, dword [ebp - 0x20]
mov edx, 3
cmovae ecx, esi
mov eax, edi
cmp edi, edx
cmova eax, edx
mov edx, 0x5bf828
push eax
call fcn.00452920
add esp, 4
test eax, eax
jne 0x45ad25
cmp edi, 3
jb 0x45ad25
movzx eax, byte [0x5d12e3]
mov ecx, 1
cmovbe eax, ecx
mov byte [0x5d12e3], al
cmp ebx, 8
jb 0x45ad59
lea ecx, [ebx*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x45ad4f
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb24
push ecx
push esi
call fcn.00518d68
add esp, 8
mov esi, 1
push str.YourBunnyWrote
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x45ad8e
push str.___CLONE_INFO:_Im_a_clone_
call fcn.0045a000
add esp, 4
mov eax, esi
jmp 0x45bb08
push str.___CLONE_INFO:_Im_original_process_
call fcn.0045a000
push str.___Get_White_process...
call fcn.0045a000
add esp, 8
mov dword [ebp - 0x2f0], str.spoolsv.exe
mov dword [ebp - 0x2ec], str.explorer.exe
mov dword [ebp - 0x2e8], str.sihost.exe
mov dword [ebp - 0x2e4], str.fontdrvhost.exe
push 0
push 2
mov dword [ebp - 0x2e0], str.cmd.exe
mov dword [ebp - 0x2dc], str.dwm.exe
mov dword [ebp - 0x2d8], str.LogonUI.exe
mov dword [ebp - 0x2d4], str.SearchUI.exe
mov dword [ebp - 0x2d0], str.lsass.exe
mov dword [ebp - 0x2cc], str.csrss.exe
mov dword [ebp - 0x2c8], str.smss.exe
mov dword [ebp - 0x2c4], str.winlogon.exe
mov dword [ebp - 0x2c0], str.services.exe
mov dword [ebp - 0x2bc], str.conhost.exe
mov dword [ebp - 0x2b8], str.everything.exe
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
je 0x45af0f
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x45af08
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
nop dword [eax + eax]
xor esi, esi
push dword [ebp + esi*4 - 0x2f0]
lea eax, [ebp - 0x274]
push eax
call edi
test eax, eax
je 0x45ae9e
inc esi
cmp esi, 0xf
jl 0x45ae82
jmp 0x45aef2
push 4
call fcn.00518d38
mov ecx, dword [ebp - 0x290]
add esp, 4
mov dword [ebp - 0x29c], eax
mov dword [eax], ecx
lea eax, [ebp - 0x29c]
mov esi, dword [0x5d1a94]
push eax
mov ebx, dword [esi + 4]
push ebx
push esi
call fcn.00459db0
mov edx, dword [0x5d1a98]
mov ecx, 0x15555554
sub ecx, edx
cmp ecx, 1
jb 0x45bb2e
inc edx
mov dword [0x5d1a98], edx
mov dword [esi + 4], eax
mov dword [ebx], eax
mov ebx, dword [ebp - 0x34]
lea eax, [ebp - 0x298]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x45ae80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.___Kill_Cryptor...
call fcn.0045a000
add esp, 4
call fcn.0045d690
call fcn.004607f0
call fcn.0045d690
call fcn.004607f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0045d690
call fcn.004607f0
push str.___Delete_session_key...
call fcn.0045a000
add esp, 4
push 0x5d12f0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.___Set_current_dir...
call fcn.0045a000
add esp, 4
push 0x5d1370
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.___Init_CRC...
call fcn.0045a000
add esp, 4
push 0x5d1aa0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 0x18
mov byte [0x5d1991], 1
mov ecx, esp
xor eax, eax
push 0xc
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.hashlist.txt
mov word [ecx], ax
call fcn.0044a1c0
xor ecx, ecx
call fcn.00455290
mov ecx, esp
xor eax, eax
push 0xd
push str.md5_check.txt
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.0044a1c0
mov ecx, 1
call fcn.00455290
add esp, 0x18
lea ecx, [ebp - 0x6c]
push 0x5cbba4
call fcn.0044baa0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
cmp dword [ebp - 0x58], 8
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45b032
push str.___Loading_hash_list...
call fcn.0045a000
add esp, 4
call fcn.00455420
mov byte [0x5d12e2], 1
jmp 0x45b04b
cmp dword [ebp - 0x58], 8
lea eax, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x6c]
push eax
push str.___Hash_list_not_found:__s
call fcn.0045a000
add esp, 8
push str.___Read_tail...
call fcn.0045a000
mov ecx, dword [0x5cbb80]
add esp, 4
test ecx, ecx
jne 0x45b06d
call fcn.00455000
mov ecx, dword [0x5cbb80]
cmp dword [0x5cbb84], 8
mov eax, 0x5cbb70
push ecx
cmovae eax, dword [0x5cbb70]
lea ecx, [ebp - 0x30]
xor edx, edx
mov dword [ebp - 0x20], 0
push eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], dx
call fcn.0044a1c0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00453bd0
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x45b0e8
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b0de
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb29
push edx
push ecx
call fcn.00518d68
add esp, 8
call fcn.0045e5a0
push str.___Embedded_settings:
call fcn.0045a000
push str._____________________
call fcn.0045a000
push dword [0x5d19d0]
push str.___Secret_keys_count:__i
call fcn.0045a000
add esp, 0x10
cmp dword [0x5d19d0], 1
jne 0x45b1a1
mov ecx, dword [0x5cbb0c]
mov esi, 0x5cbaf8
mov edx, dword [0x5cbaf8]
cmp ecx, 8
cmovae esi, edx
cmp dword [0x5d12e4], 0
je 0x45b188
push esi
mov dword [ebp - 0x2a4], 5
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x29c], esi
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x2a4]
push eax
push 0
push 0x4a
push dword [0x5d12e4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x5cbb0c]
mov edx, dword [0x5cbaf8]
cmp ecx, 8
mov eax, 0x5cbaf8
cmovae eax, edx
push eax
push str.___Secret_key:_________s
call fcn.0045a000
add esp, 8
cmp dword [0x5cbb3c], 8
mov eax, 0x5cbb28
cmovae eax, dword [0x5cbb28]
push eax
push str.___Note_filename:______s
call fcn.0045a000
add esp, 8
mov dword [ebp - 0x44], 0
cmp dword [0x5cbac4], 0x10
lea ecx, [ebp - 0x54]
mov esi, 0x5cbab0
mov dword [ebp - 0x40], 7
cmovae esi, dword [0x5cbab0]
mov ebx, 0x5cbab0
add esi, dword [0x5cbac0]
cmp dword [0x5cbac4], 0x10
cmovae ebx, dword [0x5cbab0]
xor eax, eax
mov word [ebp - 0x54], ax
mov eax, esi
sub eax, ebx
push eax
call fcn.0044b490
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x54]
push esi
push ebx
call fcn.0044b770
mov byte [ebp - 4], 2
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 8
cmovae eax, dword [ebp - 0x54]
push eax
push str.___Extension:__________s
call fcn.0045a000
add esp, 8
lea ecx, [ebp - 0x3c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
push 0x5d1a04
call fcn.00454a30
xorps xmm0, xmm0
mov byte [ebp - 4], 3
push 0x5d1a14
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
call fcn.00454a30
mov byte [ebp - 4], 4
push dword [ebp - 0x38]
push str.___Services_to_kill__count_:___i
call fcn.0045a000
push dword [ebp - 0x14]
push str.___Processes_to_kill__count_:__i
call fcn.0045a000
push str._____________________
call fcn.0045a000
add esp, 0x14
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x30]
mov word [ebp - 0x30], ax
push 0x11
push str.SearchIndexer.exe
call fcn.0044a1c0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov edx, dword [ebp - 0x14]
mov esi, 0x7fffffe
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45bb2e
inc edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b329
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b31f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb38
push edx
push ecx
call fcn.00518d68
add esp, 8
push 0x16
xor eax, eax
mov dword [ebp - 0x20], 0
push str.SearchProtocolHost.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044a1c0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov edx, dword [ebp - 0x14]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45bb3d
inc edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b3b8
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b3ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb47
push edx
push ecx
call fcn.00518d68
add esp, 8
push 0xd
xor eax, eax
mov dword [ebp - 0x20], 0
push str.SearchApp.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044a1c0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov edx, dword [ebp - 0x14]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45bb4c
inc edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b447
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b43d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb56
push edx
push ecx
call fcn.00518d68
add esp, 8
push 0x13
xor eax, eax
mov dword [ebp - 0x20], 0
push str.CompatTelRunner.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044a1c0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov edx, dword [ebp - 0x14]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45bb5b
inc edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b4d6
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b4cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb65
push edx
push ecx
call fcn.00518d68
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x20], 0
push str.wsqmcons.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044a1c0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov edx, dword [ebp - 0x14]
mov ecx, esi
sub ecx, edx
cmp ecx, 1
jb 0x45bb6a
inc edx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b565
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b55b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb74
push edx
push ecx
call fcn.00518d68
add esp, 8
push 0xe
xor eax, eax
mov dword [ebp - 0x20], 0
push str.everything.exe
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.0044a1c0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 0x18]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00454e50
mov ecx, dword [ebp - 0x14]
sub esi, ecx
cmp esi, 1
jb 0x45bb79
inc ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov dword [edi + 4], eax
mov dword [ebx], eax
cmp edx, 8
jb 0x45b5f2
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b5e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb83
push edx
push ecx
call fcn.00518d68
add esp, 8
push str.___Find_Services...
call fcn.0045a000
add esp, 4
lea ecx, [ebp - 0x3c]
call fcn.0045de50
cmp byte [0x5d12e3], 0
je 0x45b62d
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
call fcn.0045a540
push str.Unlock_finished
call fcn.0045a000
add esp, 4
jmp 0x45ba54
push str.___Kill_Services...
call fcn.0045a000
lea ecx, [ebp - 0x3c]
call fcn.0045ced0
push str.___Wait_10_sec...
call fcn.0045a000
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x2710
call ebx
push str.___Kill_Processes...
call fcn.0045a000
add esp, 4
lea ecx, [ebp - 0x18]
call fcn.0045d8c0
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x2a0], xmm0
push 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0
call fcn.0044aad0
mov dword [ebp - 0x2a0], eax
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0xb
call fcn.0045da60
lea ecx, [ebp - 0x2a0]
call fcn.0045d8c0
push str.___Wait_10_sec...
call fcn.0045a000
add esp, 4
push 0x2710
call ebx
push str.___Local_Search...
call fcn.0045a000
add esp, 4
cmp dword [ebp + 8], 2
jne 0x45b894
mov edx, dword [ebp - 0x2b4]
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov edx, dword [edx + 4]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b703
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.0044a1c0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x20], 1
jne 0x45b72f
push 2
push 0x5bf178
jmp 0x45b782
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x2b4], esp
push 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x5bed60
mov word [ecx], ax
call fcn.0044a1c0
sub esp, 0x18
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.0044baa0
mov byte [ebp - 4], 0xc
call fcn.0045ff80
add esp, 0x30
test eax, eax
jne 0x45b78a
push 1
push 0x5bed60
lea ecx, [ebp - 0x30]
call fcn.004517a0
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
push str.___Starting_search_on:___s_
call fcn.0045a000
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 8
cmovae esi, ecx
cmp dword [0x5d12e4], 0
je 0x45b7fe
push esi
mov dword [ebp - 0x2b0], 1
call edi
mov dword [ebp - 0x2a8], esi
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b0]
push eax
push 0
push 0x4a
push dword [0x5d12e4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
cmp eax, 8
lea edx, [ebp - 0x30]
cmovae edx, ecx
sub esp, 0x18
mov esi, esp
mov ecx, edx
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x2b4], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45b830
sub ecx, dword [ebp - 0x2b4]
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0044a1c0
call fcn.0045f180
mov byte [ebp - 4], 0xb
add esp, 0x18
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x45b8a9
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b888
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb88
push edx
push ecx
call fcn.00518d68
add esp, 8
jmp 0x45b8a9
mov ecx, 0x5d1a6c
call fcn.004598b0
call fcn.0045f8b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [0x5cbb0c], 8
mov esi, 0x5cbaf8
cmovae esi, dword [0x5cbaf8]
cmp dword [0x5d12e4], 0
je 0x45b900
push esi
mov dword [ebp - 0x2b0], 5
call edi
mov dword [ebp - 0x2a8], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b0]
push eax
push 0
push 0x4a
push dword [0x5d12e4]
call esi
jmp 0x45b906
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push str.___Mapped_drives_Search__user_context_...
call fcn.0045a000
add esp, 4
call fcn.0045fb20
push str.___Network_Search...
call fcn.0045a000
add esp, 4
call fcn.0045cb60
cmp dword [0x5d12e4], 0
je 0x45b96e
push 0x5be168
mov dword [ebp - 0x2b0], 6
call edi
mov dword [ebp - 0x2a8], 0x5be168
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2b0]
push eax
push 0
push 0x4a
push dword [0x5d12e4]
call esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x18]
call fcn.0045a540
call fcn.0045fcf0
cmp byte [0x5d12e2], 0
je 0x45b9f2
test byte [0x5d1a9c], 4
je 0x45b99d
push str._If_this_report_empty__all_checksum_match_
call fcn.004554d0
add esp, 4
cmp byte [0x5d1991], 0
je 0x45b9f2
push 0x5d1aa0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov ecx, 0x5d1ab8
xchg dword [ecx], eax
mov eax, dword [0x5cbba0]
cmp eax, 0xffffffff
je 0x45b9d5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5cbba0], 0xffffffff
push 0x5d1aa0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x5d1aa0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [0x5d1991], 0
push str.Decryption_finished._n_n
call fcn.0045a000
push str.System_should_be_rebooted_in_30_seconds..._n
call fcn.0045a000
add esp, 8
mov esi, 0x1e
nop
push 0x3e8
call ebx
mov edx, 0x5be168
mov ecx, 0x5d0248
call fcn.00457b70
sub esi, 1
jne 0x45ba10
push esi
push 1
push 1
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
lea ecx, [ebp - 0x2a0]
call fcn.0044a4d0
push 0x20
push dword [ebp - 0x2a0]
call fcn.00518d68
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.0044a4d0
push 0x20
push dword [ebp - 0x18]
call fcn.00518d68
add esp, 8
lea ecx, [ebp - 0x3c]
call fcn.0044a4d0
push 0x20
push dword [ebp - 0x3c]
call fcn.00518d68
mov edx, dword [ebp - 0x40]
add esp, 8
cmp edx, 8
jb 0x45bab8
mov ecx, dword [ebp - 0x54]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45baae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb8d
push edx
push ecx
call fcn.00518d68
add esp, 8
mov edx, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
cmp edx, 8
jb 0x45bb06
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45bafc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45bb92
push edx
push ecx
call fcn.00518d68
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00518b27
mov esp, ebp
pop ebp
ret
call fcn.005343f1
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
push str.list_T__too_long
call fcn.005164bf
call fcn.005343f1
call fcn.005343f1
call fcn.005343f1
call fcn.005343f1
int3