Function at 0x63245480
Capabilities:
Create thread
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x63256ab4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x118], ecx
mov eax, 1
test eax, eax
je 0x632454a4
jmp 0x632454b1
push str.StartXGuard___START
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 1
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
test ecx, ecx
je 0x632454ce
jmp 0x632454db
push str.Check_Bypass
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce48
call fcn.6323a150
push 0x6324e874
push 0x87
push 0x6324e87c
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242310
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.6320feb0
add esp, 0xc
push str.npxgb.zip
push 0x6325ce48
push 0x6324e894
push 0x104
lea eax, [ebp - 0x110]
push eax
call fcn.6320fb38
add esp, 0x14
push 0x6324b95f
push 0x6325ce48
lea ecx, [ebp - 0x110]
push ecx
mov ecx, 0x6325ce48
call fcn.63239d20
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x6324558d
push 4
push 0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x6325cf4c
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63243d60
cmp eax, 1
je 0x632455e0
mov ecx, 1
test ecx, ecx
je 0x632455b3
jmp 0x632455c0
push str._ERROR_:_NPXGERROR_APP_DETACHFILEINFO_FAIL
call fcn.63201050
add esp, 4
mov ecx, 0x6325d9f0
call fcn.63237e90
push 0x6325cf4c
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63243d60
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242d90
push 0x6325d8bc
call fcn.63238d20
mov ecx, eax
call fcn.63238bf0
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx], 0
push 0x6324b96d
call fcn.63238d20
mov eax, dword [eax]
add eax, 4
push eax
call fcn.6320fabd
add esp, 8
push 0x6324b96e
call fcn.63238d20
mov ecx, dword [eax]
add ecx, 0x10c
push ecx
call fcn.6320fabd
add esp, 8
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx + 0x108], 0x1001
push 0x6325d8bc
mov ecx, 0x6325ce48
call fcn.63239e00
push 0x6325d8bc
mov ecx, 0x6325ce48
call fcn.63239890
mov ecx, 0x6325ce48
call fcn.63239580
cmp eax, 1
jne 0x6324568c
push 1
mov ecx, 0x6325ce48
call fcn.63239380
mov ecx, 0x6325d9c8
call fcn.632385e0
test eax, eax
jne 0x632456d8
mov eax, 1
test eax, eax
je 0x632456a5
jmp 0x632456b2
push str.Begine_Thread_UpdateModules
call fcn.63201050
add esp, 4
push 0
push 0
push 0x6325d9f0
push 0x63238080
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xe64], eax
mov ecx, 0x6325ce48
call fcn.632393e0
test eax, eax
jne 0x63245728
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63244640
cmp eax, 1
je 0x63245728
mov edx, 1
test edx, edx
je 0x63245707
jmp 0x63245714
push str._ERROR_:_NPXGERROR_APP_VERIFYFILE_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 0x104
jmp 0x63245b3a
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x778]
push ecx
push 0x6325cf4c
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242cf0
cmp eax, 1
je 0x6324577c
mov edx, 1
test edx, edx
je 0x6324575b
jmp 0x63245768
push str._ERROR_:_NPXGERROR_APP_DETACHCLIENT_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], pe_nt_image_headers32
jmp 0x63245b3a
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.63242480
cmp eax, 3
jne 0x632457b6
mov eax, 1
test eax, eax
je 0x6324579d
jmp 0x632457aa
push str.Execute_File
call fcn.63201050
add esp, 4
push 1
mov ecx, 0x6325ce48
call fcn.63239380
mov ecx, 0x6325ce48
call fcn.63239100
cmp eax, 1
jne 0x632457f2
mov ecx, 1
test ecx, ecx
je 0x632457d0
jmp 0x632457dd
push str.GetCheckUpdateMode_:_TRUE
call fcn.63201050
add esp, 4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xe64]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x6325d8bc
mov ecx, 0x6325ce48
call fcn.63239060
mov ecx, 0x6325ce48
call fcn.632395d0
test eax, eax
jne 0x632458bc
mov ecx, 0x6325ce48
call fcn.632393c0
test eax, eax
jne 0x632458bc
call fcn.63201040
mov ecx, dword [eax + 0x48]
push ecx
push 0x6325cf4c
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x778]
push eax
mov ecx, dword [ebp - 0x118]
add ecx, 0xe54
call fcn.63241f50
cmp eax, 1
je 0x63245882
mov ecx, 1
test ecx, ecx
je 0x63245861
jmp 0x6324586e
push str._ERROR_:_NPXGERROR_APP_DYNAMICFORKING_FAIL
call fcn.63201050
add esp, 4
mov dword [ebp - 0x114], 0x101
jmp 0x63245b3a
push 0x1f4
mov edx, dword [0x6325d49c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x632458bc
mov eax, 1
test eax, eax
je 0x632458a3
jmp 0x632458b0
push str._ERROR_WaitForSingleObject_WAIT_OBJECT_0
call fcn.63201050
add esp, 4
push 1
mov ecx, 0x6325ce48
call fcn.63239380
mov ecx, 0x6325ce48
call fcn.632395d0
cmp eax, 1
je 0x632458de
mov ecx, 0x6325ce48
call fcn.632393c0
cmp eax, 1
jne 0x632459d3
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x778]
push edx
mov ecx, dword [ebp - 0x118]
add ecx, 0xe54
call fcn.63242130
cmp eax, 1
je 0x63245965
mov eax, 1
test eax, eax
je 0x6324590c
jmp 0x63245919
push str._ERROR_:_NPXGERROR_DF_WIN98_FAIL
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce48
call fcn.63239160
cmp eax, 1
jne 0x6324595b
push 0
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x778]
push edx
mov ecx, dword [ebp - 0x118]
add ecx, 0xe54
call fcn.632411a0
cmp eax, 0x301
je 0x63245959
mov dword [ebp - 0x114], 0x300
jmp 0x63245965
mov dword [ebp - 0x114], 0x300
push 0x1f4
mov eax, dword [0x6325d49c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x632459d3
mov ecx, 1
test ecx, ecx
je 0x63245985
jmp 0x63245992
push str._Update_Execute_File
call fcn.63201050
add esp, 4
push 0
push str.nProtect_X_Guard
push 0x6325d7b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x6325d8bc
mov ecx, 0x6325ce48
call fcn.632396d0
mov ecx, 0x6325d9f0
call fcn.63237c70
mov dword [ebp - 0x114], 0x302
jmp 0x63245b3a
mov edx, 1
test edx, edx
je 0x632459de
jmp 0x632459eb
push str.Begine_Thread_Check_Process_invalide
call fcn.63201050
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x118]
push eax
push 0x63245070
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0xe68], eax
mov edx, 1
test edx, edx
je 0x63245a1e
jmp 0x63245a2b
push str.Begine_Thread_Check_Process
call fcn.63201050
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x118]
add eax, 0xe54
push eax
push fcn.63240ff0
push 0
push 0
call fcn.6320fdb2
add esp, 0x18
mov ecx, dword [ebp - 0x118]
mov dword [ecx + 0x77c], eax
mov ecx, 0x6325ce48
call fcn.632395d0
test eax, eax
jne 0x63245b3a
mov ecx, 0x6325ce48
call fcn.632393a0
test eax, eax
jne 0x63245b29
mov edx, 1
test edx, edx
je 0x63245a87
jmp 0x63245a94
push str.MemGuard_Start
call fcn.63201050
add esp, 4
mov ecx, 0x6325ce48
call fcn.63239100
test eax, eax
jne 0x63245acf
mov eax, 1
test eax, eax
je 0x63245aad
jmp 0x63245aba
push str.GetCheckUpdateMode_:_FLASE
call fcn.63201050
add esp, 4
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0xe64]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x6325d9c8
call fcn.632388e0
mov ecx, 0x6325d9c8
call fcn.632387c0
mov ecx, dword [ebp - 0x118]
add ecx, 0x148
call fcn.632430c0
mov ecx, 0x6325d9c8
call fcn.63238550
cmp eax, 1
jne 0x63245b16
call fcn.63238d20
mov eax, dword [eax]
mov dword [eax + 0x108], 0x1002
jmp 0x63245b27
call fcn.63238d20
mov ecx, dword [eax]
mov dword [ecx + 0x108], 0x1000
jmp 0x63245b3a
call fcn.63238d20
mov edx, dword [eax]
mov dword [edx + 0x108], 0x1003
mov eax, 1
test eax, eax
je 0x63245b45
jmp 0x63245b52
push str.StartXGuard___END
call fcn.63201050
add esp, 4
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.6320fb73
mov esp, ebp
pop ebp
ret