Function at 0x4108f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Get common file path
Move file
Set registry value
Suspend thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459ee0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10388
call fcn.00430a80
mov eax, dword [0x468004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x555b]
push ebx
push eax
mov dword [ebp - 0x10218], esi
mov dword [ebp - 0x1029c], ebx
mov byte [ebp - 0x555c], bl
call fcn.0042eb30
push 0x103
lea ecx, [ebp - 0x575f]
push ebx
push ecx
mov byte [ebp - 0x5760], bl
call fcn.0042eb30
push 0x103
lea edx, [ebp - 0xedf]
push ebx
push edx
mov byte [ebp - 0xee0], bl
call fcn.0042eb30
push 0x103
lea eax, [ebp - 0x3813]
push ebx
push eax
mov byte [ebp - 0x3814], bl
call fcn.0042eb30
mov al, 0x5d
mov dl, 0x74
mov cl, 0x61
add esp, 0x30
mov byte [ebp - 0x10250], 0x55
mov byte [ebp - 0x1024f], 0x89
mov byte [ebp - 0x1024c], 0x55
mov byte [ebp - 0x1024b], 0x8b
mov byte [ebp - 0x1025c], 0x51
mov byte [ebp - 0x1025b], 0x83
mov byte [ebp - 0x10260], 0x6a
mov byte [ebp - 0x1025f], bl
mov byte [ebp - 0x1e0], 0x72
mov byte [ebp - 0x1df], 0x6d
mov byte [ebp - 0x1de], 0x6e
mov byte [ebp - 0x1dd], 0x73
mov byte [ebp - 0x1dc], 0x6f
mov byte [ebp - 0x1db], 0x66
mov byte [ebp - 0x1da], dl
mov byte [ebp - 0x1d9], 0x2e
mov byte [ebp - 0x1d8], 0x64
mov byte [ebp - 0x1d7], 0x6c
mov byte [ebp - 0x1d6], 0x6c
mov byte [ebp - 0x1d5], bl
mov byte [ebp - 0x88], 0xe8
mov byte [ebp - 0x87], bl
mov byte [ebp - 0x86], bl
mov byte [ebp - 0x85], bl
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], al
mov byte [ebp - 0x82], 0x81
mov byte [ebp - 0x58], 0xe8
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], bl
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], al
mov byte [ebp - 0x52], 0x8b
mov byte [ebp - 0x98], 0xc8
mov byte [ebp - 0x97], bl
mov byte [ebp - 0x96], bl
mov byte [ebp - 0x95], bl
mov byte [ebp - 0x94], 0x8b
mov byte [ebp - 0x93], 0x6d
mov byte [ebp - 0x92], 8
mov byte [ebp - 0x10254], 0x55
mov byte [ebp - 0x10253], 0x8b
mov byte [ebp - 0x10252], 0xec
mov byte [ebp - 0x124], cl
mov byte [ebp - 0x123], bl
mov byte [ebp - 0x122], 0x76
mov byte [ebp - 0x121], bl
mov byte [ebp - 0x120], 0x70
mov al, 0x65
mov byte [ebp - 0x11f], bl
mov byte [ebp - 0x11e], 0x2e
mov byte [ebp - 0x11d], bl
mov byte [ebp - 0x11c], al
mov byte [ebp - 0x11b], bl
mov byte [ebp - 0x11a], 0x78
mov byte [ebp - 0x119], bl
mov byte [ebp - 0x118], al
mov byte [ebp - 0x160], cl
mov byte [ebp - 0x15f], bl
mov byte [ebp - 0x15e], 0x76
mov byte [ebp - 0x15d], bl
mov byte [ebp - 0x15c], 0x69
mov byte [ebp - 0x15b], bl
mov byte [ebp - 0x15a], 0x72
mov byte [ebp - 0x159], bl
mov byte [ebp - 0x158], cl
mov byte [ebp - 0x157], bl
mov byte [ebp - 0x156], 0x2e
mov byte [ebp - 0x155], bl
mov byte [ebp - 0x154], 0x63
mov byte [ebp - 0x153], bl
mov byte [ebp - 0x152], 0x6f
mov byte [ebp - 0x151], bl
mov byte [ebp - 0x150], 0x6d
mov byte [ebp - 0x10258], 0x55
mov byte [ebp - 0x10257], 0x8b
mov byte [ebp - 0x10256], 0xec
mov byte [ebp - 0xe8], 0x8b
mov byte [ebp - 0xe7], 0xff
mov byte [ebp - 0xe6], 0x55
mov byte [ebp - 0xe5], 0x8b
mov byte [ebp - 0xe4], 0xec
mov byte [ebp - 0x2c0], 0x73
mov byte [ebp - 0x2bf], bl
mov byte [ebp - 0x2be], 0x68
mov byte [ebp - 0x2bd], bl
mov byte [ebp - 0x2bc], al
mov byte [ebp - 0x2bb], bl
mov byte [ebp - 0x2ba], 0x6c
mov byte [ebp - 0x2b9], bl
mov byte [ebp - 0x2b8], 0x6c
mov byte [ebp - 0x2b7], bl
mov byte [ebp - 0x2b6], 0x2e
mov byte [ebp - 0x2b5], bl
mov byte [ebp - 0x2b4], 0x7b
mov byte [ebp - 0x2b3], bl
mov byte [ebp - 0x2b2], 0x31
mov byte [ebp - 0x2b1], bl
mov byte [ebp - 0x2b0], 0x37
mov byte [ebp - 0x2af], bl
mov byte [ebp - 0x2ae], 0x45
mov byte [ebp - 0x2ad], bl
mov byte [ebp - 0x2ac], 0x33
mov byte [ebp - 0x2ab], bl
mov byte [ebp - 0x2aa], 0x30
mov byte [ebp - 0x2a9], bl
mov byte [ebp - 0x2a8], 0x31
mov byte [ebp - 0x2a7], bl
mov byte [ebp - 0x2a6], 0x46
mov byte [ebp - 0x2a5], bl
mov byte [ebp - 0x2a4], 0x35
mov byte [ebp - 0x2a3], bl
mov byte [ebp - 0x2a2], 0x2d
mov byte [ebp - 0x2a1], bl
mov byte [ebp - 0x2a0], 0x32
mov byte [ebp - 0x29f], bl
mov byte [ebp - 0x29e], 0x33
mov byte [ebp - 0x29d], bl
mov byte [ebp - 0x29c], 0x43
mov byte [ebp - 0x29b], bl
mov byte [ebp - 0x29a], 0x35
mov byte [ebp - 0x299], bl
mov byte [ebp - 0x298], 0x2d
mov byte [ebp - 0x297], bl
mov byte [ebp - 0x296], 0x43
mov byte [ebp - 0x295], bl
mov byte [ebp - 0x294], 0x45
mov byte [ebp - 0x293], bl
mov byte [ebp - 0x292], 0x30
mov byte [ebp - 0x291], bl
mov byte [ebp - 0x290], 0x30
mov byte [ebp - 0x28f], bl
mov byte [ebp - 0x28e], 0x2d
mov byte [ebp - 0x28d], bl
mov byte [ebp - 0x28c], 0x41
mov byte [ebp - 0x28b], bl
mov byte [ebp - 0x28a], 0x36
mov byte [ebp - 0x289], bl
mov byte [ebp - 0x288], 0x38
mov byte [ebp - 0x287], bl
mov byte [ebp - 0x286], 0x43
mov byte [ebp - 0x285], bl
mov byte [ebp - 0x284], 0x2d
mov byte [ebp - 0x283], bl
mov byte [ebp - 0x282], 0x36
mov byte [ebp - 0x281], bl
mov byte [ebp - 0x280], 0x46
mov byte [ebp - 0x27f], bl
mov byte [ebp - 0x27e], 0x39
mov byte [ebp - 0x27d], bl
mov byte [ebp - 0x27c], 0x34
mov byte [ebp - 0x27b], bl
mov byte [ebp - 0x27a], 0x41
mov byte [ebp - 0x279], bl
mov byte [ebp - 0x278], 0x41
mov byte [ebp - 0x277], bl
mov byte [ebp - 0x276], 0x36
mov byte [ebp - 0x275], bl
mov byte [ebp - 0x274], 0x38
mov byte [ebp - 0x273], bl
mov byte [ebp - 0x272], 0x35
mov byte [ebp - 0x271], bl
mov byte [ebp - 0x270], 0x32
mov byte [ebp - 0x26f], bl
mov byte [ebp - 0x26e], 0x35
mov byte [ebp - 0x26d], bl
mov byte [ebp - 0x26c], 0x44
mov byte [ebp - 0x26b], bl
mov byte [ebp - 0x26a], 0x7d
mov byte [ebp - 0xa8], 0x55
mov byte [ebp - 0xa7], 0x8b
mov byte [ebp - 0xa6], 0xec
mov byte [ebp - 0xa5], 0x6a
mov byte [ebp - 0xa4], 0xff
mov byte [ebp - 0xa3], 0x68
mov byte [ebp - 0xa2], 0xb0
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x6c
mov byte [ebp - 0x196], 0x6f
mov byte [ebp - 0x195], 0x62
mov byte [ebp - 0x194], cl
mov byte [ebp - 0x193], 0x6c
mov byte [ebp - 0x192], 0x5c
mov byte [ebp - 0x191], 0x53
mov byte [ebp - 0x190], 0x59
mov byte [ebp - 0x18f], 0x53
mov byte [ebp - 0x18e], 0x5f
mov byte [ebp - 0x18d], 0x45
mov byte [ebp - 0x18c], 0x30
mov byte [ebp - 0x18b], 0x41
mov byte [ebp - 0x18a], 0x39
mov byte [ebp - 0x189], 0x31
mov byte [ebp - 0x188], 0x33
mov byte [ebp - 0x187], 0x38
mov byte [ebp - 0x50], 0x5c
mov byte [ebp - 0x4f], 0x63
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x79
mov byte [ebp - 0x4c], 0x73
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x5c
mov byte [ebp - 0xf4], 0x5c
mov byte [ebp - 0xf3], 0x70
mov byte [ebp - 0xf2], cl
mov byte [ebp - 0xf1], 0x79
mov byte [ebp - 0xf0], 0x6c
mov byte [ebp - 0xef], 0x6f
mov byte [ebp - 0xee], cl
mov byte [ebp - 0xed], 0x64
mov byte [ebp - 0xec], 0x2e
mov byte [ebp - 0xeb], 0x70
mov byte [ebp - 0xea], 0x64
mov byte [ebp - 0xe9], 0x62
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x8b
mov byte [ebp - 0x2e], 0xec
mov byte [ebp - 0x2d], 0x83
mov byte [ebp - 0x2c], 0xe4
mov byte [ebp - 0x2b], 0xf8
mov byte [ebp - 0xd0], 0x81
mov byte [ebp - 0xcf], 0xec
mov byte [ebp - 0xce], 0x4c
mov byte [ebp - 0xcd], 1
mov byte [ebp - 0xcc], bl
mov byte [ebp - 0xcb], bl
mov byte [ebp - 0xc0], 0x8b
mov byte [ebp - 0xbf], 0x54
mov byte [ebp - 0xbe], 0x24
mov byte [ebp - 0xbd], 4
mov byte [ebp - 0xbc], 0x8b
mov byte [ebp - 0xbb], 0x42
mov byte [ebp - 0xc8], 0x83
mov byte [ebp - 0xc7], 0xec
mov byte [ebp - 0xc6], 0xc
mov byte [ebp - 0xc5], 0x55
mov byte [ebp - 0xc4], 0x56
mov byte [ebp - 0xc3], 0x57
mov byte [ebp - 0x16c], 0x55
mov byte [ebp - 0x16b], 0x8b
mov byte [ebp - 0x16a], 0xec
mov byte [ebp - 0x169], 0x83
mov byte [ebp - 0x168], 0xe4
mov byte [ebp - 0x167], 0xf8
mov byte [ebp - 0x166], 0x53
mov byte [ebp - 0x165], 0x8b
mov byte [ebp - 0x164], 0x1d
mov byte [ebp - 0xb8], 0x55
mov byte [ebp - 0xb7], 0x8b
mov byte [ebp - 0xb6], 0xec
mov byte [ebp - 0xb5], 0xb9
mov byte [ebp - 0xb4], 0x1b
mov byte [ebp - 0xb3], bl
mov byte [ebp - 0xb2], bl
mov byte [ebp - 0x300], 0x56
mov byte [ebp - 0x2ff], bl
mov byte [ebp - 0x2fe], 0x42
mov byte [ebp - 0x2fd], bl
mov byte [ebp - 0x2fc], 0x6f
mov byte [ebp - 0x2fb], bl
mov byte [ebp - 0x2fa], 0x78
mov byte [ebp - 0x2f9], bl
mov byte [ebp - 0x2f8], 0x53
mov byte [ebp - 0x2f7], bl
mov byte [ebp - 0x2f6], al
mov byte [ebp - 0x2f5], bl
mov byte [ebp - 0x2f4], 0x72
mov byte [ebp - 0x2f3], bl
mov byte [ebp - 0x2f2], 0x76
mov byte [ebp - 0x2f1], bl
mov byte [ebp - 0x2f0], 0x69
mov byte [ebp - 0x2ef], bl
mov byte [ebp - 0x2ee], 0x63
mov byte [ebp - 0x2ed], bl
mov byte [ebp - 0x2ec], al
mov byte [ebp - 0x2eb], bl
mov byte [ebp - 0x2ea], 0x2e
mov byte [ebp - 0x2e9], bl
mov byte [ebp - 0x2e8], al
mov byte [ebp - 0x2e7], bl
mov byte [ebp - 0x2e6], 0x78
mov byte [ebp - 0x2e5], bl
mov byte [ebp - 0x2e4], al
mov byte [ebp - 0x2e3], bl
mov byte [ebp - 0x2e2], bl
mov byte [ebp - 0xe0], 0x55
mov byte [ebp - 0xdf], 0x8b
mov byte [ebp - 0xde], 0xec
mov byte [ebp - 0xdd], 0x81
mov byte [ebp - 0xdc], 0xec
mov byte [ebp - 0x324], 0x50
mov byte [ebp - 0x323], bl
mov byte [ebp - 0x322], 0x75
mov byte [ebp - 0x321], bl
mov byte [ebp - 0x320], 0x62
mov byte [ebp - 0x31f], bl
mov byte [ebp - 0x31e], 0x6c
mov byte [ebp - 0x31d], bl
mov byte [ebp - 0x31c], 0x69
mov byte [ebp - 0x31b], bl
mov byte [ebp - 0x31a], 0x63
mov byte [ebp - 0x319], bl
mov byte [ebp - 0x318], 0x5c
mov byte [ebp - 0x317], bl
mov byte [ebp - 0x316], 0x77
mov byte [ebp - 0x315], bl
mov byte [ebp - 0x314], 0x69
mov byte [ebp - 0x313], bl
mov byte [ebp - 0x312], 0x6e
mov byte [ebp - 0x311], bl
mov byte [ebp - 0x310], 0x64
mov byte [ebp - 0x30f], bl
mov byte [ebp - 0x30e], 0x6f
mov byte [ebp - 0x30d], bl
mov byte [ebp - 0x30c], 0x77
mov byte [ebp - 0x30b], bl
mov byte [ebp - 0x30a], 0x2e
mov byte [ebp - 0x309], bl
mov byte [ebp - 0x308], 0x62
mov byte [ebp - 0x307], bl
mov byte [ebp - 0x306], cl
mov byte [ebp - 0x305], bl
mov byte [ebp - 0x304], dl
mov byte [ebp - 0x60], 0x6a
mov byte [ebp - 0x5f], 0x60
mov byte [ebp - 0x5e], 0x68
mov byte [ebp - 0x5d], 0x70
mov byte [ebp - 0x5c], 0x71
mov byte [ebp - 0x5b], 0x40
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x1f8], 0x64
mov byte [ebp - 0x1f7], 0x77
mov byte [ebp - 0x1f6], 0x6f
mov byte [ebp - 0x1f5], 0x6b
mov byte [ebp - 0x1f4], 0x6e
mov byte [ebp - 0x1f3], 0x71
mov byte [ebp - 0x1f2], 0x64
mov byte [ebp - 0x1f1], 0x71
mov byte [ebp - 0x1f0], 0x2d
mov byte [ebp - 0x1ef], 0x64
mov byte [ebp - 0x1ee], 0x77
mov byte [ebp - 0x1ed], 0x64
mov byte [ebp - 0x178], 0x4d
mov byte [ebp - 0x177], 0x69
mov byte [ebp - 0x176], 0x63
mov byte [ebp - 0x175], 0x72
mov byte [ebp - 0x174], 0x6f
mov byte [ebp - 0x173], 0x73
mov byte [ebp - 0x172], 0x6f
mov byte [ebp - 0x171], 0x66
mov byte [ebp - 0x170], dl
mov byte [ebp - 0x14c], 0x3c
mov byte [ebp - 0x14b], 0x70
mov byte [ebp - 0x14a], 0x72
mov byte [ebp - 0x149], 0x6f
mov byte [ebp - 0x148], 0x67
mov byte [ebp - 0x147], 0x72
mov byte [ebp - 0x146], cl
mov byte [ebp - 0x145], 0x6d
mov byte [ebp - 0x70], 0x6a
mov byte [ebp - 0x6f], 0x60
mov byte [ebp - 0x6e], 0x68
mov byte [ebp - 0x6d], pe_nt_image_headers32
mov byte [ebp - 0x6c], 0xb7
mov byte [ebp - 0x6b], 0x42
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x250], dl
mov byte [ebp - 0x24f], 0x77
mov byte [ebp - 0x24e], 0x69
mov byte [ebp - 0x24d], dl
mov byte [ebp - 0x24c], dl
mov byte [ebp - 0x24b], al
mov byte [ebp - 0x24a], 0x72
mov byte [ebp - 0x249], bl
mov byte [ebp - 0x248], 0x73
mov byte [ebp - 0x247], 0x76
mov byte [ebp - 0x246], 0x63
mov byte [ebp - 0x245], 0x68
mov byte [ebp - 0x244], 0x6f
mov byte [ebp - 0x243], 0x73
mov byte [ebp - 0x242], dl
mov byte [ebp - 0x241], 0x2e
mov byte [ebp - 0x240], al
mov byte [ebp - 0x23f], 0x78
mov byte [ebp - 0x23e], al
mov byte [ebp - 0x1c8], 0x44
mov byte [ebp - 0x1c7], al
mov byte [ebp - 0x1c6], 0x73
mov byte [ebp - 0x1c5], 0x6b
mov byte [ebp - 0x1c4], dl
mov byte [ebp - 0x1c3], 0x6f
mov byte [ebp - 0x1c2], 0x70
mov byte [ebp - 0x1c1], bl
mov byte [ebp - 0x1c0], 0x2e
mov byte [ebp - 0x1bf], 0x73
mov byte [ebp - 0x1be], 0x63
mov byte [ebp - 0x1bd], 0x72
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x133], cl
mov byte [ebp - 0x132], 0x6b
mov byte [ebp - 0x131], al
mov byte [ebp - 0x130], 0x6f
mov byte [ebp - 0x12f], 0x77
mov byte [ebp - 0x12e], 0x6e
mov byte [ebp - 0xd8], 0x55
mov byte [ebp - 0xd7], 0x8b
mov byte [ebp - 0xd6], 0xec
mov byte [ebp - 0xd5], 0x83
mov byte [ebp - 0xd4], 0xc4
mov byte [ebp - 0x268], bl
mov byte [ebp - 0x267], bl
mov byte [ebp - 0x266], bl
mov byte [ebp - 0x265], 0x52
mov byte [ebp - 0x264], bl
mov byte [ebp - 0x263], al
mov byte [ebp - 0x262], bl
mov byte [ebp - 0x261], cl
mov byte [ebp - 0x260], bl
mov byte [ebp - 0x25f], 0x64
mov byte [ebp - 0x25e], bl
mov byte [ebp - 0x25d], 0x4d
mov byte [ebp - 0x25c], bl
mov byte [ebp - 0x25b], al
mov byte [ebp - 0x25a], bl
mov byte [ebp - 0x259], 0x2e
mov byte [ebp - 0x258], bl
mov byte [ebp - 0x257], 0x54
mov byte [ebp - 0x256], bl
mov byte [ebp - 0x255], 0x78
mov byte [ebp - 0x254], bl
mov byte [ebp - 0x253], 0x54
mov byte [ebp - 0xb0], 0xe9
mov byte [ebp - 0xaf], 0x6a
mov byte [ebp - 0xae], 0xe3
mov byte [ebp - 0xad], bl
mov byte [ebp - 0xac], bl
mov byte [ebp - 0xab], 0xe9
mov byte [ebp - 0xaa], 0xa5
mov byte [ebp - 0x28], 0x5f
mov byte [ebp - 0x27], 0x41
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x72
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x78
mov byte [ebp - 0x21], 0x79
mov byte [ebp - 0x80], 0x91
mov byte [ebp - 0x7f], 0x40
mov byte [ebp - 0x7e], bl
mov byte [ebp - 0x7d], 0xf
mov byte [ebp - 0x7c], 0x57
mov byte [ebp - 0x7b], 0xc0
mov byte [ebp - 0x7a], 0x66
mov byte [ebp - 0xa0], 0x8d
mov byte [ebp - 0x9f], 0x45
mov byte [ebp - 0x9e], 0xac
mov byte [ebp - 0x9d], 0x53
mov byte [ebp - 0x9c], 0x50
mov byte [ebp - 0x9b], 0xe8
mov byte [ebp - 0x9a], 0xfe
mov byte [ebp - 0x90], 0xb6
mov byte [ebp - 0x8f], 0xe9
mov byte [ebp - 0x8e], 0x33
mov byte [ebp - 0x8d], 0x34
mov byte [ebp - 0x8c], 0xad
mov byte [ebp - 0x8b], 0x40
mov byte [ebp - 0x8a], 0xb2
mov byte [ebp - 0x114], 0x47
mov byte [ebp - 0x113], bl
mov byte [ebp - 0x112], cl
mov byte [ebp - 0x111], bl
mov byte [ebp - 0x110], 0x6e
mov byte [ebp - 0x10f], bl
mov byte [ebp - 0x10e], 0x64
mov byte [ebp - 0x10d], bl
mov byte [ebp - 0x10c], 0x43
mov byte [ebp - 0x10b], bl
mov byte [ebp - 0x10a], 0x72
mov byte [ebp - 0x109], bl
mov byte [ebp - 0x108], cl
mov byte [ebp - 0x107], bl
mov byte [ebp - 0x106], 0x62
mov byte [ebp - 0x105], bl
mov byte [ebp - 0x104], 0x21
mov byte [ebp - 0x144], 0x47
mov byte [ebp - 0x143], bl
mov byte [ebp - 0x142], 0x41
mov byte [ebp - 0x141], bl
mov byte [ebp - 0x140], 0x4e
mov byte [ebp - 0x13f], bl
mov byte [ebp - 0x13e], 0x44
mov byte [ebp - 0x13d], bl
mov byte [ebp - 0x13c], 0x43
mov byte [ebp - 0x13b], bl
mov byte [ebp - 0x13a], 0x52
mov byte [ebp - 0x139], bl
mov byte [ebp - 0x138], 0x41
mov byte [ebp - 0x137], bl
mov byte [ebp - 0x136], 0x42
mov byte [ebp - 0x68], bl
mov byte [ebp - 0x67], bl
mov byte [ebp - 0x66], 0x10
mov byte [ebp - 0x65], bl
mov byte [ebp - 0x64], dl
mov byte [ebp - 0x63], 0x4d
mov byte [ebp - 0x62], 0x83
mov byte [ebp - 0x78], 0x55
mov byte [ebp - 0x77], 0x8b
mov byte [ebp - 0x76], 0xec
mov byte [ebp - 0x75], 0x83
mov byte [ebp - 0x74], 0xec
mov byte [ebp - 0x73], 0x30
mov byte [ebp - 0x72], 0xc7
mov byte [ebp - 0x228], 0x73
mov byte [ebp - 0x227], bl
mov byte [ebp - 0x226], 0x68
mov byte [ebp - 0x225], bl
mov byte [ebp - 0x224], 0x75
mov byte [ebp - 0x223], bl
mov byte [ebp - 0x222], dl
mov byte [ebp - 0x221], bl
mov byte [ebp - 0x220], 0x64
mov byte [ebp - 0x21f], bl
mov byte [ebp - 0x21e], 0x6f
mov byte [ebp - 0x21d], bl
mov byte [ebp - 0x21c], 0x77
mov byte [ebp - 0x21b], bl
mov byte [ebp - 0x21a], 0x6e
mov byte [ebp - 0x48], 0x6a
mov byte [ebp - 0x47], 0x10
mov byte [ebp - 0x46], 0x68
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], 0xe8
mov byte [ebp - 0x42], 0x8d
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], 0x8b
mov byte [ebp - 0x3e], 0x7d
mov byte [ebp - 0x3d], 8
mov byte [ebp - 0x3c], 0x85
mov byte [ebp - 0x218], 0x46
mov byte [ebp - 0x217], 0x69
mov byte [ebp - 0x216], 0x6e
mov byte [ebp - 0x215], 0x64
mov byte [ebp - 0x214], 0x46
mov byte [ebp - 0x213], 0x69
mov byte [ebp - 0x212], 0x72
mov byte [ebp - 0x211], 0x73
mov byte [ebp - 0x210], dl
mov byte [ebp - 0x20f], 0x46
mov byte [ebp - 0x20e], 0x69
mov byte [ebp - 0x20d], 0x6c
mov byte [ebp - 0x20c], al
mov byte [ebp - 0x20b], 0x57
mov byte [ebp - 0x208], 0x46
mov byte [ebp - 0x207], 0x69
mov byte [ebp - 0x206], 0x6e
mov byte [ebp - 0x205], 0x64
mov byte [ebp - 0x204], 0x4e
mov byte [ebp - 0x203], al
mov byte [ebp - 0x202], 0x78
mov byte [ebp - 0x201], dl
mov byte [ebp - 0x200], 0x46
mov byte [ebp - 0x1ff], 0x69
mov byte [ebp - 0x1fe], 0x6c
mov byte [ebp - 0x1fd], al
mov byte [ebp - 0x1fc], 0x57
mov byte [ebp - 0x184], 0x57
mov byte [ebp - 0x183], 0x72
mov byte [ebp - 0x182], 0x69
mov byte [ebp - 0x181], dl
mov byte [ebp - 0x180], al
mov byte [ebp - 0x17f], 0x46
mov byte [ebp - 0x17e], 0x69
mov byte [ebp - 0x17d], 0x6c
mov byte [ebp - 0x17c], al
mov byte [ebp - 0x2e0], 0xff
mov byte [ebp - 0x2df], 0x15
mov byte [ebp - 0x2de], 0xec
mov byte [ebp - 0x2dd], 1
mov byte [ebp - 0x2dc], 0x41
mov byte [ebp - 0x2db], bl
mov byte [ebp - 0x2da], 0x85
mov byte [ebp - 0x2d9], 0xc0
mov byte [ebp - 0x2d8], 0xf
mov byte [ebp - 0x2d7], 0x84
mov byte [ebp - 0x2d6], 0x28
mov byte [ebp - 0x2d5], 1
mov byte [ebp - 0x2d4], bl
mov byte [ebp - 0x2d3], bl
mov byte [ebp - 0x2d2], 0xb9
mov byte [ebp - 0x2d1], 0xc
mov byte [ebp - 0x2d0], 0xe
mov byte [ebp - 0x2cf], bl
mov byte [ebp - 0x2ce], bl
mov byte [ebp - 0x2cd], 0xe8
mov byte [ebp - 0x2cc], 0xb5
mov byte [ebp - 0x2cb], 0x36
mov byte [ebp - 0x2ca], bl
mov byte [ebp - 0x2c9], bl
mov byte [ebp - 0x2c8], 0x89
mov byte [ebp - 0x2c7], 0x45
mov byte [ebp - 0x2c6], 0xfc
mov byte [ebp - 0x2c5], 0x83
mov byte [ebp - 0x2c4], 0x7d
mov byte [ebp - 0x2c3], 0xfc
mov byte [ebp - 0x1d4], 0x78
mov byte [ebp - 0x1d3], 0x78
mov byte [ebp - 0x1d2], 0x78
mov byte [ebp - 0x1d1], cl
mov byte [ebp - 0x1d0], 0x72
mov byte [ebp - 0x1cf], dl
mov byte [ebp - 0x1ce], 0x2e
mov byte [ebp - 0x1cd], 0x70
mov byte [ebp - 0x1af], al
mov byte [ebp - 0x1ac], al
mov byte [ebp - 0x237], al
mov byte [ebp - 0x230], al
mov byte [ebp - 0x22c], al
mov byte [ebp - 0x1e4], al
mov eax, dword [esi + 4]
mov byte [ebp - 0x1cc], 0x70
mov byte [ebp - 0x1cb], 0x2e
mov byte [ebp - 0x1ca], 0x75
mov byte [ebp - 0x1c9], cl
mov byte [ebp - 0x1b0], 0x64
mov byte [ebp - 0x1ae], 0x6c
mov byte [ebp - 0x1ad], 0x73
mov byte [ebp - 0x1ab], 0x6c
mov byte [ebp - 0x1aa], 0x66
mov byte [ebp - 0x1a9], 0x2e
mov byte [ebp - 0x1a8], 0x62
mov byte [ebp - 0x1a7], cl
mov byte [ebp - 0x1a6], dl
mov byte [ebp - 0x1a4], 0x43
mov byte [ebp - 0x1a3], 0x52
mov byte [ebp - 0x1a2], 0x59
mov byte [ebp - 0x1a1], 0x50
mov byte [ebp - 0x1a0], 0x54
mov byte [ebp - 0x19f], 0x4f
mov byte [ebp - 0x19e], 0x47
mov byte [ebp - 0x19d], 0x41
mov byte [ebp - 0x19c], 0x4d
mov byte [ebp - 0x19b], 0x53
mov byte [ebp - 0x19a], 0x20
mov byte [ebp - 0x1bc], 0x44
mov byte [ebp - 0x1bb], 0x45
mov byte [ebp - 0x1ba], 0x41
mov byte [ebp - 0x1b9], 0x54
mov byte [ebp - 0x1b8], 0x48
mov byte [ebp - 0x1b7], 0x52
mov byte [ebp - 0x1b6], cl
mov byte [ebp - 0x1b5], 0x6e
mov byte [ebp - 0x1b4], 0x73
mov byte [ebp - 0x1b3], 0x6f
mov byte [ebp - 0x1b2], 0x6d
mov byte [ebp - 0x23c], 0x44
mov byte [ebp - 0x23b], 0x6f
mov byte [ebp - 0x23a], 0x63
mov byte [ebp - 0x239], 0x75
mov byte [ebp - 0x238], 0x6d
mov byte [ebp - 0x236], 0x6e
mov byte [ebp - 0x235], dl
mov byte [ebp - 0x234], 0x50
mov byte [ebp - 0x233], 0x72
mov byte [ebp - 0x232], 0x6f
mov byte [ebp - 0x231], 0x70
mov byte [ebp - 0x22f], 0x72
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], 0x69
mov byte [ebp - 0x22b], 0x73
mov byte [ebp - 0x12c], dl
mov byte [ebp - 0x12b], 0x72
mov byte [ebp - 0x12a], 0x75
mov byte [ebp - 0x129], 0x73
mov byte [ebp - 0x128], cl
mov byte [ebp - 0x127], 0x6a
mov byte [ebp - 0x126], 0x7c
mov byte [ebp - 0x1ec], 0x46
mov byte [ebp - 0x1eb], 0x79
mov byte [ebp - 0x1ea], 0x6c
mov byte [ebp - 0x1e9], 0x75
mov byte [ebp - 0x1e8], 0x5c
mov byte [ebp - 0x1e7], 0x6c
mov byte [ebp - 0x1e6], 0x7a
mov byte [ebp - 0x1e5], cl
mov byte [ebp - 0x1e3], cl
mov byte [ebp - 0x1e2], bl
mov byte [ebp - 0x1e1], bl
cmp eax, ebx
je 0x41dce9
cmp eax, 4
je 0x41dce9
push eax
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x470164], ebx
mov ecx, dword [esi]
push ecx
push ebx
mov edi, eax
push 0x1fffff
mov dword [ebp - 0x10220], edi
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x10224], eax
cmp edi, ebx
je 0x41b2bf
cmp eax, ebx
je 0x41dce2
mov edx, eax
push edx
call fcn.00407740
push 0x1c
lea ecx, [ebp - 0x10244]
push ecx
push eax
mov dword [ebp - 0x1022c], ebx
push edi
mov dword [ebp - 0x10228], eax
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x10244], ebx
mov dword [ebp - 0x10240], ebx
mov dword [ebp - 0x1023c], ebx
mov dword [ebp - 0x10238], ebx
mov dword [ebp - 0x10234], ebx
mov dword [ebp - 0x10230], ebx
mov dword [ebp - 0x1022c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x411bd8
cmp dword [ebp - 0x10238], 0x30000
jb 0x411bd8
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x411bd8
cmp dword [ebp - 0x1023c], eax
jne 0x411bd8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 6
lea edx, [ebp - 0x434]
push str.CLASS
push edx
call fcn.004309be
add esp, 0x20
test eax, eax
jne 0x411bd8
mov eax, dword [ebp - 0x10224]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push edi
call esi
jmp 0x41dce9
cmp dword [ebp - 0x10238], 0xe8000
jne 0x412031
cmp dword [ebp - 0x10230], 0x40
jne 0x412d51
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d51
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412031
push str.0XE8000
call fcn.004073f0
mov eax, dword [ebp - 0x10228]
add esp, 4
lea ecx, [ebp - 0x1021c]
push ecx
push 8
lea edx, [ebp - 0x49c]
push edx
push eax
push edi
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [ebp - 0xb0]
jne 0x412031
mov eax, dword [ebp - 0x498]
cmp byte [ebp - 0xac], al
jne 0x412031
cmp byte [ebp - 0xab], ah
jne 0x412031
mov dl, byte [ebp - 0xaa]
cmp dl, byte [ebp - 0x496]
jne 0x412031
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
push 0xf
lea ecx, [ebp - 0x514]
push ecx
add edx, 0xbcd9
push edx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov dword [ebp - 0x50c], ebx
mov word [ebp - 0x508], bx
mov byte [ebp - 0x506], bl
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xf
jne 0x412031
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xf
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x514]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412031
push str.match_8_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x85f]
push ebx
push edx
mov byte [ebp - 0x860], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x860]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4RAPID.NPAV4.23012018
push str.NPAV4RAPID.NPAV4.23012018
lea edx, [ebp - 0x860]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x7ab3]
push ebx
push eax
mov byte [ebp - 0x7ab4], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7ab4]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x7ab4]
push str.WORM.RAPID.NPAV4.23012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4e4b]
push ebx
push edx
mov byte [ebp - 0x4e4c], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x16ff]
push ebx
push eax
mov byte [ebp - 0x1700], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x411ed5
lea edx, [ebp - 0x1700]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x411e60
lea edx, [ebp - 0x1700]
push edx
lea eax, [ebp - 0x4e4c]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4e4c]
push ecx
lea edx, [ebp - 0x1700]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x411ed5
lea eax, [ebp - 0x4e4c]
push eax
lea ecx, [ebp - 0x1700]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x411ec8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x411ed5
lea edx, [ebp - 0x1700]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x411f6e
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x7ab4]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x411f08
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x411fec
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.RAPID.NPAV4.23012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x411fb0
cmp dword [0x470144], ebx
je 0x411fe0
lea edx, [ebp - 0x10344]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10238], 0x13000
jne 0x412491
cmp dword [ebp - 0x10230], 0x40
jne 0x412d51
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d51
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412491
push str.0X13000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4b8]
push ecx
push edx
push edi
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x80]
jne 0x412491
mov eax, dword [ebp - 0x4b4]
cmp byte [ebp - 0x7c], al
jne 0x412491
cmp byte [ebp - 0x7b], ah
jne 0x412491
mov cl, byte [ebp - 0x7a]
cmp cl, byte [ebp - 0x4b2]
jne 0x412491
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x544]
push eax
add ecx, 0xb048
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x544], ebx
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x53c], ebx
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], ebx
mov word [ebp - 0x530], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x412491
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x544]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412491
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 2
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc07]
push ebx
push edx
mov byte [ebp - 0xc08], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc08]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.1
push str.NPAV4GDCB.NPAV4.30012018.1
lea edx, [ebp - 0xc08]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x647b]
push ebx
push eax
mov byte [ebp - 0x647c], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x647c]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x647c]
push str.WORM.GDCB.NPAV4.30012018.1
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x698b]
push ebx
push edx
mov byte [ebp - 0x698c], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x2dff]
push ebx
push eax
mov byte [ebp - 0x2e00], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x41233c
lea edx, [ebp - 0x2e00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4122a7
lea edx, [ebp - 0x2e00]
push edx
lea eax, [ebp - 0x698c]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x698c]
push ecx
lea edx, [ebp - 0x2e00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41233c
lea eax, [ebp - 0x698c]
push eax
lea ecx, [ebp - 0x2e00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41232f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41233c
lea edx, [ebp - 0x2e00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4123cb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x647c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412370
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412440
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412410
cmp dword [0x470144], ebx
je 0x412440
lea edx, [ebp - 0x102f8]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x12000
jne 0x4128f1
cmp dword [ebp - 0x10230], 0x40
jne 0x412d51
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d51
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x4128f1
push str.0X12000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x48c]
push ecx
push edx
push edi
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0xa0]
jne 0x4128f1
mov eax, dword [ebp - 0x488]
cmp byte [ebp - 0x9c], al
jne 0x4128f1
cmp byte [ebp - 0x9b], ah
jne 0x4128f1
mov cl, byte [ebp - 0x9a]
cmp cl, byte [ebp - 0x486]
jne 0x4128f1
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x52c]
push eax
add ecx, 0x9d45
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov word [ebp - 0x518], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x4128f1
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x52c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4128f1
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 4
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8c7]
push ebx
push edx
mov byte [ebp - 0x8c8], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8c8]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.2
push str.NPAV4GDCB.NPAV4.30012018.2
lea edx, [ebp - 0x8c8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x74a3]
push ebx
push eax
mov byte [ebp - 0x74a4], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x74a4]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x74a4]
push str.WORM.GDCB.NPAV4.30012018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x504f]
push ebx
push edx
mov byte [ebp - 0x5050], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x19ff]
push ebx
push eax
mov byte [ebp - 0x1a00], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x41279c
lea edx, [ebp - 0x1a00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412713
lea edx, [ebp - 0x1a00]
push edx
lea eax, [ebp - 0x5050]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5050]
push ecx
lea edx, [ebp - 0x1a00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41279c
lea eax, [ebp - 0x5050]
push eax
lea ecx, [ebp - 0x1a00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41278f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41279c
lea edx, [ebp - 0x1a00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41282b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x74a4]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4127d0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4128a0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412870
cmp dword [0x470144], ebx
je 0x4128a0
lea edx, [ebp - 0x102b8]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x14000
jne 0x412d51
cmp dword [ebp - 0x10230], 0x40
jne 0x412d51
cmp dword [ebp - 0x1023c], 0x80
jne 0x412d51
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x412d51
push str.0X14000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4c0]
push ecx
push edx
push edi
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c0]
cmp eax, dword [ebp - 0x90]
jne 0x412d51
mov eax, dword [ebp - 0x4bc]
cmp byte [ebp - 0x8c], al
jne 0x412d51
cmp byte [ebp - 0x8b], ah
jne 0x412d51
mov cl, byte [ebp - 0x8a]
cmp cl, byte [ebp - 0x4ba]
jne 0x412d51
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0x16
lea eax, [ebp - 0x55c]
push eax
add ecx, 0xc1ee
push ecx
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x558], ebx
mov dword [ebp - 0x554], ebx
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x54c], ebx
mov word [ebp - 0x548], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x16
jne 0x412d51
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x16
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x55c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x412d51
push str.match_17_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 6
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb03]
push ebx
push edx
mov byte [ebp - 0xb04], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb04]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GDCB.NPAV4.30012018.3
push str.NPAV4GDCB.NPAV4.30012018.3
lea edx, [ebp - 0xb04]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x6683]
push ebx
push eax
mov byte [ebp - 0x6684], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6684]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x6684]
push str.WORM.GDCB.NPAV4.30012018.3
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x6a8b]
push ebx
push edx
mov byte [ebp - 0x6a8c], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x25ff]
push ebx
push eax
mov byte [ebp - 0x2600], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x412bfc
lea edx, [ebp - 0x2600]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412b73
lea edx, [ebp - 0x2600]
push edx
lea eax, [ebp - 0x6a8c]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x6a8c]
push ecx
lea edx, [ebp - 0x2600]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412bfc
lea eax, [ebp - 0x6a8c]
push eax
lea ecx, [ebp - 0x2600]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x412bef
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412bfc
lea edx, [ebp - 0x2600]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x412c8b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6684]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x412c30
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x412d00
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.GDCB.NPAV4.30012018.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x412cd0
cmp dword [0x470144], ebx
je 0x412d00
lea edx, [ebp - 0x102dc]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x413511
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x413511
cmp dword [ebp - 0x1023c], eax
jne 0x413511
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0xa8b4]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0x14
lea ecx, [ebp - 0x1021c]
push ecx
push 0x500
lea edx, [ebp - 0xa8b4]
push edx
add eax, 0xa760
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x500
jne 0x413131
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xa8b4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413131
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 8
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x92f]
push ebx
push edx
mov byte [ebp - 0x930], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x930]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GRAB.NPAV4.0803018.4
push str.NPAV4GRAB.NPAV4.0803018.4
lea edx, [ebp - 0x930]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x688b]
push ebx
push eax
mov byte [ebp - 0x688c], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x688c]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x688c]
push str.WORM.GRAB.NPAV4.0803018.4
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x5253]
push ebx
push edx
mov byte [ebp - 0x5254], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x1bff]
push ebx
push eax
mov byte [ebp - 0x1c00], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x412fdc
lea edx, [ebp - 0x1c00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x412f53
lea edx, [ebp - 0x1c00]
push edx
lea eax, [ebp - 0x5254]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5254]
push ecx
lea edx, [ebp - 0x1c00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x412fdc
lea eax, [ebp - 0x5254]
push eax
lea ecx, [ebp - 0x1c00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x412fcf
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x412fdc
lea edx, [ebp - 0x1c00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41306a
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x688c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413010
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4130e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.0803018.4
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4130b0
cmp dword [0x470144], ebx
je 0x4130e0
lea edx, [ebp - 0x1031c]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x413511
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x413511
cmp dword [ebp - 0x1023c], eax
jne 0x413511
push str.REW_and_REW
call fcn.004073f0
push str.0X12000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0xbcb4]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0x14
lea ecx, [ebp - 0x1021c]
push ecx
push 0x500
lea edx, [ebp - 0xbcb4]
push edx
add eax, 0xae30
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x500
jne 0x413511
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x11
push 0x500
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xbcb4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413511
push str.match_17_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0xa
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xb6b]
push ebx
push edx
mov byte [ebp - 0xb6c], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xb6c]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4GRAB.NPAV4.16052018.5
push str.NPAV4GRAB.NPAV4.16052018.5
lea edx, [ebp - 0xb6c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x4c47]
push ebx
push eax
mov byte [ebp - 0x4c48], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4c48]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x4c48]
push str.WORM.GRAB.NPAV4.16052018.5
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x76a7]
push ebx
push edx
mov byte [ebp - 0x76a8], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x2bff]
push ebx
push eax
mov byte [ebp - 0x2c00], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x4133bc
lea edx, [ebp - 0x2c00]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413333
lea edx, [ebp - 0x2c00]
push edx
lea eax, [ebp - 0x76a8]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x76a8]
push ecx
lea edx, [ebp - 0x2c00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4133bc
lea eax, [ebp - 0x76a8]
push eax
lea ecx, [ebp - 0x2c00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4133af
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4133bc
lea edx, [ebp - 0x2c00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41344b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4c48]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4133f0
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4134c0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.GRAB.NPAV4.16052018.5
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413490
cmp dword [0x470144], ebx
je 0x4134c0
lea edx, [ebp - 0x102b4]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x16000
jne 0x413983
push str.mbi_._RegionSize__0X16000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x413983
cmp dword [ebp - 0x1023c], 0x80
jne 0x413983
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x413983
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X16000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 8
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x4c8]
push ecx
push edx
push edi
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4c4], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x68]
jne 0x413983
mov eax, dword [ebp - 0x4c4]
cmp byte [ebp - 0x64], al
jne 0x413983
cmp byte [ebp - 0x63], ah
jne 0x413983
mov cl, byte [ebp - 0x62]
cmp cl, byte [ebp - 0x4c2]
jne 0x413983
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea edx, [ebp - 0x1034]
push ebx
push edx
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov edx, dword [ebp - 0x10228]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x50
lea ecx, [ebp - 0x1034]
push ecx
add edx, 0x10bc0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x413983
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x1034]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413983
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0xc
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x7c3]
push ebx
push eax
mov byte [ebp - 0x7c4], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x7c4]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.05072018.1
push str.NPAV4KRAB.NPAV4.05072018.1
lea eax, [ebp - 0x7c4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x54
push 0x103
lea ecx, [ebp - 0x4d4b]
push ebx
push ecx
mov byte [ebp - 0x4d4c], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4d4c]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x4d4c]
push str.WORM.KRAB.NPAV4.05072018.1
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x5457]
push ebx
push eax
mov byte [ebp - 0x5458], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x1dff]
push ebx
push ecx
mov byte [ebp - 0x1e00], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x413829
lea edx, [ebp - 0x1e00]
nop
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4137a0
lea eax, [ebp - 0x1e00]
push eax
lea ecx, [ebp - 0x5458]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x5458]
push edx
lea eax, [ebp - 0x1e00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413829
lea ecx, [ebp - 0x5458]
push ecx
lea edx, [ebp - 0x1e00]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41381c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413829
lea eax, [ebp - 0x1e00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4138bd
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4d4c]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413860
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x413932
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.05072018.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413902
cmp dword [0x470144], ebx
je 0x413932
lea eax, [ebp - 0x10324]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x20000
jne 0x413dd1
push str.mbi_._RegionSize__0X20000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x413dd1
cmp dword [ebp - 0x1023c], 0x80
jne 0x413dd1
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x413dd1
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X20000
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xfe4]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov ecx, dword [ebp - 0x10228]
add esp, 0x18
lea edx, [ebp - 0x1021c]
push edx
push 0x50
lea eax, [ebp - 0xfe4]
push eax
add ecx, 0x11b9d
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x413dd1
push str.read_successful_and_act_bytes_dwActualReadBytes__0X50
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x144]
push edx
lea eax, [ebp - 0xfe4]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x413dd1
push str.match_15_bytes
call fcn.004073f0
push str.match_KRAB_main_sig
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [ebp - 4], 0xe
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x6f3]
push ebx
push edx
mov byte [ebp - 0x6f4], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6f4]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.10082018.2
push str.NPAV4KRAB.NPAV4.10082018.2
lea edx, [ebp - 0x6f4]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x54
push 0x103
lea eax, [ebp - 0x3d1f]
push ebx
push eax
mov byte [ebp - 0x3d20], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x3d20]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x3d20]
push str.WORM.KRAB.NPAV4.10082018.2
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x4533]
push ebx
push edx
mov byte [ebp - 0x4534], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x27ff]
push ebx
push eax
mov byte [ebp - 0x2800], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x413c39
lea edx, [ebp - 0x2800]
mov edi, edi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x413bb0
lea edx, [ebp - 0x2800]
push edx
lea eax, [ebp - 0x4534]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4534]
push ecx
lea edx, [ebp - 0x2800]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x413c39
lea eax, [ebp - 0x4534]
push eax
lea ecx, [ebp - 0x2800]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x413c2c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x413c39
lea edx, [ebp - 0x2800]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x413ccb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x3d20]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x413c70
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x413cff
push str.WORM.KRAB.NPAV4.10082018.2
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x4534]
push edx
lea ecx, [ebp - 0x6f4]
push ecx
lea edx, [ebp - 0x3d20]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x413d80
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.KRAB.NPAV4.10082018.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x413d50
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x413d50
cmp dword [0x470144], ebx
je 0x413d80
lea eax, [ebp - 0x102f4]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
mov ecx, dword [ebp - 0x10238]
add ecx, 0xfffe5000
cmp ecx, 0xe000
ja 0x41422a
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41422a
cmp dword [ebp - 0x1023c], 0x80
jne 0x41422a
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41422a
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
add esp, 8
lea edx, [ebp - 0x1021c]
push edx
push 0x20
lea eax, [ebp - 0x5bc]
push eax
push 0x4030df
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x5bc], ebx
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 0x5b4], ebx
mov dword [ebp - 0x5b0], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x20
jne 0x41422a
push str.read_successful_and_act_bytes_dwActualReadBytes__32
call fcn.004073f0
push 0x1e
push 0x20
lea ecx, [ebp - 0x2e0]
push ecx
lea edx, [ebp - 0x5bc]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41422a
push str.match_30_bytes
call fcn.004073f0
push str.match_KRAB_G_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 8
push eax
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x78f]
push ebx
push edx
mov byte [ebp - 0x790], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x790]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4KRAB.NPAV4.28082018.V3G
push str.NPAV4KRAB.NPAV4.28082018.V3G
lea edx, [ebp - 0x790]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x473b]
push ebx
push eax
mov byte [ebp - 0x473c], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x473c]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x473c]
push str.WORM.KRAB.NPAV4.28082018.V3G
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x370f]
push ebx
push edx
mov byte [ebp - 0x3710], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x1fff]
push ebx
push eax
mov byte [ebp - 0x2000], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x4140ac
lea edx, [ebp - 0x2000]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414023
lea edx, [ebp - 0x2000]
push edx
lea eax, [ebp - 0x3710]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x3710]
push ecx
lea edx, [ebp - 0x2000]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4140ac
lea eax, [ebp - 0x3710]
push eax
lea ecx, [ebp - 0x2000]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41409f
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4140ac
lea edx, [ebp - 0x2000]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414139
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x473c]
mov edx, 0x469f12
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4140e0
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41416d
push str.WORM.KRAB.NPAV4.28082018.V3G
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x3710]
push edx
lea ecx, [ebp - 0x790]
push ecx
lea edx, [ebp - 0x473c]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x4141e8
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.KRAB.NPAV4.28082018.V3G
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4141c0
cmp dword [0x470144], ebx
je 0x4141e8
lea eax, [ebp - 0x10350]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x414217
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x29000
jne 0x4147f1
push str.mbi_._RegionSize__0X29000
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x4147f1
cmp dword [ebp - 0x1023c], 0x80
jne 0x4147f1
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x4147f1
push str.mbi_._Type__MEM_IMAGE
call fcn.004073f0
push str.0X29000
call fcn.004073f0
mov eax, dword [ebp - 0x10228]
add esp, 8
lea ecx, [ebp - 0x1021c]
push ecx
push 0x14
lea edx, [ebp - 0x4b0]
push edx
push eax
push edi
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x4a0], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x4b0]
cmp byte [ebp - 0x48], al
jne 0x4147f1
cmp byte [ebp - 0x47], ah
jne 0x4147f1
mov cl, byte [ebp - 0x46]
cmp cl, byte [ebp - 0x4ae]
jne 0x4147f1
push str.match_FIRST_Princes1_sig
call fcn.004073f0
mov dl, byte [ebp - 0x45]
add esp, 4
cmp dl, byte [ebp - 0x4ab]
jne 0x4147f1
mov al, byte [ebp - 0x44]
cmp al, byte [ebp - 0x4aa]
jne 0x4147f1
mov cl, byte [ebp - 0x43]
cmp cl, byte [ebp - 0x4a9]
jne 0x4147f1
push str.match_SECOND_Princes1_sig
call fcn.004073f0
mov edx, dword [ebp - 0x4a7]
add esp, 4
cmp edx, dword [ebp - 0x42]
jne 0x4147f1
mov al, byte [ebp - 0x3e]
cmp al, byte [ebp - 0x4a3]
jne 0x4147f1
mov cl, byte [ebp - 0x3d]
cmp cl, byte [ebp - 0x4a2]
jne 0x4147f1
mov dl, byte [ebp - 0x3c]
cmp dl, byte [ebp - 0x4a1]
jne 0x4147f1
push str.match_THIRD_Princes1_sig
call fcn.004073f0
push 0xd60
lea eax, [ebp - 0xe214]
push ebx
push eax
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0xd60
lea edx, [ebp - 0xe214]
push edx
add eax, 0x1e4c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xd60
jne 0x4147f1
push str.read_successful_and_act_bytes_dwActualReadBytes__0XD60
call fcn.004073f0
push 0xe
push 0xd60
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0xe214]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4147f1
push str.match_14_bytes
call fcn.004073f0
push str.match_Princes_Find1stFileW_sig
call fcn.004073f0
push 0xd
push 0xd60
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xe208]
push ecx
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x4147f1
push str.match_13_bytes
call fcn.004073f0
push str.match_Princes_Find2ndFileW_sig
call fcn.004073f0
push 9
push 0xd60
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0xe208]
push eax
call fcn.00408390
add esp, 0x18
cmp eax, 1
jne 0x4147f1
push str.match_9_bytes
call fcn.004073f0
push str.match_Princes_WriteFile_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 8
push ecx
mov dword [ebp - 4], 0x12
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x5ef]
push ebx
push eax
mov byte [ebp - 0x5f0], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x5f0]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PRINCE.NPAV4.20082018
push str.NPAV4PRINCE.NPAV4.20082018
lea eax, [ebp - 0x5f0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x3f27]
push ebx
push ecx
mov byte [ebp - 0x3f28], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3f28]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x3f28]
push str.WORM.PRINCE.NPAV4.20082018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x6c8f]
push ebx
push eax
mov byte [ebp - 0x6c90], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x2fff]
push ebx
push ecx
mov byte [ebp - 0x3000], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x414659
lea edx, [ebp - 0x3000]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4145d0
lea eax, [ebp - 0x3000]
push eax
lea ecx, [ebp - 0x6c90]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x6c90]
push edx
lea eax, [ebp - 0x3000]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414659
lea ecx, [ebp - 0x6c90]
push ecx
lea edx, [ebp - 0x3000]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41464c
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414659
lea eax, [ebp - 0x3000]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4146ed
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x3f28]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414690
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41471f
push str.WORM.PRINCE.NPAV4.20082018
push 0x45c58c
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x5f0]
push ecx
lea edx, [ebp - 0x3f28]
push edx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x4147a0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.PRINCE.NPAV4.20082018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x414770
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414770
cmp dword [0x470144], ebx
je 0x4147a0
lea eax, [ebp - 0x10300]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x414be3
cmp dword [ebp - 0x10230], 0x40
jne 0x414be3
cmp dword [ebp - 0x1023c], 0x40
jne 0x414be3
push str.REW_and_REW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x12000
jb 0x414be3
push str.0X12000
call fcn.004073f0
push 0x50
lea ecx, [ebp - 0xf94]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov ecx, dword [ebp - 0x10228]
add esp, 0x10
lea edx, [ebp - 0x1021c]
push edx
push 0x50
lea eax, [ebp - 0xf94]
push eax
add ecx, 0x2350
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x50
jne 0x414be3
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xf
push 0x50
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0xf94]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x414be3
push str.match_15_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x14
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x997]
push ebx
push eax
mov byte [ebp - 0x998], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x998]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTON.NPAV4.21052018
push str.NPAV4CRYPTON.NPAV4.21052018
lea eax, [ebp - 0x998]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0x103
lea ecx, [ebp - 0x4f4f]
push ebx
push ecx
mov byte [ebp - 0x4f50], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4f50]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x4f50]
push str.WORM.CRYPTON.NPAV4.21052018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x565b]
push ebx
push eax
mov byte [ebp - 0x565c], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x21ff]
push ebx
push ecx
mov byte [ebp - 0x2200], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x414a81
lea edx, [ebp - 0x2200]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4149f8
lea eax, [ebp - 0x2200]
push eax
lea ecx, [ebp - 0x565c]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x565c]
push edx
lea eax, [ebp - 0x2200]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414a81
lea ecx, [ebp - 0x565c]
push ecx
lea edx, [ebp - 0x2200]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x414a74
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414a81
lea eax, [ebp - 0x2200]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x434]
push ecx
call fcn.0040c960
add esp, 4
call fcn.0040c260
cmp dword [0x46f734], ebx
je 0x414b20
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4f50]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414ac8
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414b92
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
push 0x104
push ebx
mov ecx, 7
mov esi, str.WORM.CRYPTON.NPAV4.21052018
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414b62
cmp dword [0x470144], ebx
je 0x414b92
lea ecx, [ebp - 0x10308]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x2000
jne 0x415041
cmp dword [ebp - 0x10230], 0x20
jne 0x41548d
cmp dword [ebp - 0x1023c], 0x80
jne 0x415496
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x415041
push str.0X2000
call fcn.004073f0
mov ecx, dword [ebp - 0x10228]
add esp, 4
lea edx, [ebp - 0x1021c]
push edx
push 6
lea eax, [ebp - 0x454]
push eax
push ecx
push edi
mov dword [ebp - 0x454], ebx
mov word [ebp - 0x450], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x454]
cmp edx, dword [ebp - 0xd8]
jne 0x415041
mov al, byte [ebp - 0xd4]
cmp al, byte [ebp - 0x450]
jne 0x415041
lea ecx, [ebp - 0x1021c]
push ecx
push 0x1e
lea edx, [ebp - 0x59c]
push edx
push 0x40cec0
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x59c], ebx
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x594], ebx
mov dword [ebp - 0x590], ebx
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x584], ebx
mov word [ebp - 0x580], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1e
jne 0x415041
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x16
push 0x1e
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x59c]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415041
push str.match_22_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x16
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xbd3]
push ebx
push edx
mov byte [ebp - 0xbd4], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xbd4]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4LOCK.NPAV4.16012018
push str.NPAV4LOCK.NPAV4.16012018
lea edx, [ebp - 0xbd4]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x5153]
push ebx
push eax
mov byte [ebp - 0x5154], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5154]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x5154]
push str.WORM.LOCK.NPAV4.16012018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x7cb7]
push ebx
push edx
mov byte [ebp - 0x7cb8], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x29ff]
push ebx
push eax
mov byte [ebp - 0x2a00], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x414ee9
lea edx, [ebp - 0x2a00]
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x414e60
lea edx, [ebp - 0x2a00]
push edx
lea eax, [ebp - 0x7cb8]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x7cb8]
push ecx
lea edx, [ebp - 0x2a00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x414ee9
lea eax, [ebp - 0x7cb8]
push eax
lea ecx, [ebp - 0x2a00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x414edc
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x414ee9
lea edx, [ebp - 0x2a00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x414f79
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5154]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x414f20
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x414ff0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.LOCK.NPAV4.16012018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x414fc0
cmp dword [0x470144], ebx
je 0x414ff0
lea edx, [ebp - 0x10310]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10238], 0x3000
jne 0x41548d
cmp dword [ebp - 0x10230], 0x20
jne 0x41548d
cmp dword [ebp - 0x1023c], 0x80
jne 0x415496
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41548d
push str.0X3000
call fcn.004073f0
mov edx, dword [ebp - 0x10228]
add esp, 4
lea eax, [ebp - 0x1021c]
push eax
push 8
lea ecx, [ebp - 0x494]
push ecx
push edx
push edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x78]
jne 0x41548d
mov eax, dword [ebp - 0x490]
cmp byte [ebp - 0x74], al
jne 0x41548d
cmp byte [ebp - 0x73], ah
jne 0x41548d
mov cl, byte [ebp - 0x72]
cmp cl, byte [ebp - 0x48e]
jne 0x41548d
lea edx, [ebp - 0x1021c]
push edx
push 0xa
lea eax, [ebp - 0x4ec]
push eax
push 0x40d615
push edi
mov dword [ebp - 0x1021c], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov word [ebp - 0x4e4], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0xa
jne 0x41548d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0xa
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x4ec]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41548d
push str.match_8_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x18
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9ff]
push ebx
push edx
mov byte [ebp - 0xa00], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa00]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4JAVA.NPAV4.08022018
push str.NPAV4JAVA.NPAV4.08022018
lea edx, [ebp - 0xa00]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0x103
lea eax, [ebp - 0x5357]
push ebx
push eax
mov byte [ebp - 0x5358], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5358]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x5358]
push str.WORM.JAVA.NPAV4.08022018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x585f]
push ebx
push edx
mov byte [ebp - 0x5860], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x14ff]
push ebx
push eax
mov byte [ebp - 0x1500], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x41532d
lea edx, [ebp - 0x1500]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x4152a4
lea edx, [ebp - 0x1500]
push edx
lea eax, [ebp - 0x5860]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5860]
push ecx
lea edx, [ebp - 0x1500]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41532d
lea eax, [ebp - 0x5860]
push eax
lea ecx, [ebp - 0x1500]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x415320
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41532d
lea edx, [ebp - 0x1500]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x4153b9
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5358]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x415360
mov eax, dword [str.NPA4]
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x415430
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.JAVA.NPAV4.08022018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x415400
cmp dword [0x470144], ebx
je 0x415430
lea edx, [ebp - 0x10318]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040ec20
push str.UmRdpService
call fcn.0040e9d0
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
cmp dword [ebp - 0x10230], 0x40
je 0x4154b0
cmp dword [ebp - 0x1023c], 0x40
jne 0x41584a
cmp byte [0x46fec4], 1
je 0x41584a
mov ecx, dword [esi + 4]
push ecx
call fcn.00408800
add esp, 4
test al, al
jne 0x41584a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4154f2
sub eax, edx
je 0x41584a
lea edx, [ebp - 0x434]
push str.svchost.exe
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41584a
push 0x104
push ebx
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415542
sub eax, edx
je 0x41584a
push 0x12c
push ebx
push 0x46fba8
call fcn.0042eb30
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.svchost.exe_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4155a2
sub eax, edx
je 0x41584a
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41584a
push str.CryptoDefense:_Suspended_svchost.exe_Process
mov dword [0x470164], 1
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
call fcn.00408550
mov eax, dword [0x46ff94]
mov edx, dword [esi + 4]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYPTO.05052014
push str.NPAV4CRYPTO.05052014
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4svchost.exe
mov dword [0x46ff94], eax
call fcn.00407310
push 0x104
lea eax, [ebp - 0x3408]
push ebx
push eax
call fcn.0042eb30
add esp, 0x48
push 0x104
lea ecx, [ebp - 0x3408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x3408]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415680
sub eax, edx
je 0x4156bd
lea eax, [ebp - 0x3408]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x415692
mov edx, dword [str._svchost.exe]
mov ecx, dword [0x45da60]
mov dword [eax], edx
mov edx, dword [0x45da64]
mov dword [eax + 4], ecx
mov cl, byte [0x45da68]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
lea edx, [ebp - 0x3408]
push str.WORM.CRYPTO.05052014
push edx
call fcn.0040a000
add esp, 8
cmp dword [0x46f734], ebx
je 0x415791
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x3408]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x4156f2
mov ecx, dword [0x45da48]
mov eax, dword [str.WORM.CRYPTO.05052014]
mov edx, dword [0x45da4c]
mov dword [0x46a042], ecx
mov ecx, dword [0x45da54]
mov dword [0x46a03e], eax
mov eax, dword [0x45da50]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dl, byte [0x45da58]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov byte [0x46a052], dl
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
call fcn.004079c0
test al, al
jne 0x41584a
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, dword [0x45da4c]
mov edx, dword [str.WORM.CRYPTO.05052014]
mov eax, dword [0x45da48]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45da50]
mov dword [0x46f73c], eax
mov eax, dword [0x45da54]
mov dword [0x46f740], ecx
mov cl, byte [0x45da58]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov byte [0x46f74c], cl
call fcn.0042eb30
mov edx, dword [str.svchost.exe]
mov eax, dword [0x45db08]
mov ecx, dword [0x45db0c]
add esp, 0x18
mov dword [0x46f978], edx
mov dword [0x46f97c], eax
mov dword [0x46f980], ecx
call fcn.00407a90
cmp dword [0x470144], ebx
je 0x41584a
lea edx, [ebp - 0x10328]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x1022c], 0x40000
jne 0x415967
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415873
cmp dword [ebp - 0x1023c], eax
jne 0x415b83
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x3000
jne 0x415967
push str.0x3000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x97c0]
push ebx
push eax
mov dword [ebp - 0x10278], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x10278]
push ecx
push 0x500
lea edx, [ebp - 0x97c0]
push edx
add eax, 0x2100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x97c0]
test ecx, ecx
je 0x415967
cmp dword [ebp - 0x10278], 0x500
jne 0x415967
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x97c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415967
push 0x11
push 0x500
lea ecx, [ebp - 0x160]
push ecx
lea edx, [ebp - 0x97c0]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x415967
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [ebp - 0x1022c], 0x20000
jne 0x415b83
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415990
cmp dword [ebp - 0x1023c], eax
jne 0x415b83
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x3000
jne 0x415b83
push str.0x3000
call fcn.004073f0
push 0x700
lea ecx, [ebp - 0xafb4]
push ebx
push ecx
mov dword [ebp - 0x10280], ebx
call fcn.0042eb30
mov edx, dword [ebp - 0x10238]
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x10280]
push ecx
lea eax, [edx + eax - 0x700]
push 0x700
lea edx, [ebp - 0xafb4]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xafb4]
test eax, eax
je 0x415b83
cmp dword [ebp - 0x10280], 0x700
jne 0x415b83
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x700
lea ecx, [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0xafb4]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x415b83
push str.Sig_found_for_Ramnit_and_terminated_
call fcn.004073f0
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x10224]
inc dword [0x470308]
add esp, 0x18
push ecx
mov dword [0x470304], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415b83
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415b83
cmp dword [0x470308], 2
jg 0x415ce3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415ae0
mov edx, dword [str.Win32.Ramnit.13102015]
mov eax, dword [0x45d9c8]
mov ecx, dword [0x45d9cc]
mov dword [0x46a03e], edx
mov edx, dword [0x45d9d0]
mov dword [0x46a042], eax
mov eax, dword [0x45d9d4]
mov dword [0x46a046], ecx
mov cx, word [0x45d9d8]
mov dword [0x46a04a], edx
mov edx, dword [str.NPAV4]
mov dword [0x46a04e], eax
mov ax, word [0x45d9c0]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov word [0x46a0a7], ax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470308], 2
jne 0x415ce3
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165fc
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x415bb9
cmp dword [ebp - 0x1023c], eax
jne 0x415cf3
push str.private_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2000
jne 0x415ce3
mov ecx, dword [esi + 4]
cmp ecx, dword [0x470304]
jne 0x415ce3
mov edx, dword [ebp - 0x10224]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x415ce3
mov dword [0x470164], 1
cmp dword [0x46f734], ebx
je 0x415ce3
cmp dword [0x470308], 2
jne 0x415ce3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x415c40
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415c40
mov ecx, dword [0x45d9c8]
mov eax, dword [str.Win32.Ramnit.13102015]
mov edx, dword [0x45d9cc]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d9d4]
mov dword [0x46a03e], eax
mov eax, dword [0x45d9d0]
mov dword [0x46a04e], ecx
mov cx, word [0x45d9c0]
mov dword [0x46a046], edx
mov dx, word [0x45d9d8]
mov dword [0x46a04a], eax
mov eax, dword [str.NPAV4]
mov word [0x46a0a7], cx
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10220]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165fc
mov edx, dword [esi]
push edx
call fcn.00408800
add esp, 4
test al, al
jne 0x416016
mov eax, 0x20
cmp dword [ebp - 0x10230], eax
je 0x415d1f
cmp dword [ebp - 0x1023c], eax
jne 0x416016
push 0x45d9b8
call fcn.004073f0
mov eax, dword [0x46ff2c]
add esp, 4
cmp eax, ebx
je 0x416016
cmp eax, dword [esi + 4]
jne 0x416016
mov eax, dword [ebp - 0x10238]
add eax, 0xffffc000
cmp eax, 0x4000
ja 0x416016
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [0x46ff94]
mov edx, dword [esi]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push str.cry_sz_matched
mov dword [0x46ff94], eax
call fcn.004073f0
push 0x103
lea eax, [ebp - 0x360f]
push ebx
push eax
mov byte [ebp - 0x3610], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x3610]
push str.svchost.exe__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x3610]
push str.WORM.CTB_LOCK.210115
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x415e85
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x3610]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x415df0
mov ecx, dword [str.WORM.CTB_LOCK.210115]
mov edx, dword [0x45d984]
mov eax, dword [0x45d988]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d98c]
mov dword [0x46a042], edx
mov edx, dword [0x45d990]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d994]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov edx, dword [0x45d988]
mov eax, dword [str.WORM.CTB_LOCK.210115]
mov ecx, dword [0x45d984]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45d98c]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d990]
mov dword [0x46f740], edx
mov dl, byte [0x45d994]
push ebx
push 0x46f978
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
mov byte [0x46f74c], dl
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x3610]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x415ef0
push 0x104
lea eax, [ebp - 0x555c]
push ebx
push eax
call fcn.0042eb30
push 0x104
lea ecx, [ebp - 0x5760]
push ebx
push ecx
call fcn.0042eb30
push 0x104
lea edx, [ebp - 0x3814]
push ebx
push edx
call fcn.0042eb30
push 0x104
lea eax, [ebp - 0xee0]
push ebx
push eax
call fcn.0042eb30
mov ecx, 8
mov esi, str.c:windows_system32_svchost.exe
lea edi, [ebp - 0xee0]
add esp, 0x30
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x3814], cl
inc eax
cmp cl, bl
jne 0x415f61
mov eax, dword [0x469868]
cmp eax, ebx
je 0x415f95
push 0x104
lea ecx, [ebp - 0x5760]
push ecx
lea edx, [ebp - 0x3814]
push edx
call eax
add esp, 0xc
mov eax, dword [0x470170]
cmp eax, ebx
je 0x415fb1
lea ecx, [ebp - 0x555c]
push ecx
lea edx, [ebp - 0x3814]
push edx
call eax
add esp, 8
call fcn.00408eb0
push 0x45cac0
push 0x45cac0
push 0x45cac0
lea eax, [ebp - 0x555c]
push eax
lea ecx, [ebp - 0x5760]
push ecx
lea edx, [ebp - 0xee0]
push edx
push 0x45caa0
push str.WORM.CTB_LOCK.210115
call fcn.00407310
add esp, 0x20
cmp dword [0x470144], ebx
je 0x41600a
lea eax, [ebp - 0x10330]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
mov edi, dword [ebp - 0x10220]
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41602f
cmp dword [ebp - 0x1023c], eax
jne 0x4165fc
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x416168
cmp eax, 4
je 0x416168
cmp dword [0x467218], eax
je 0x416168
cmp dword [0x46721c], eax
je 0x416168
cmp dword [0x467220], eax
je 0x416168
cmp dword [0x467224], eax
je 0x416168
push str.Priv_rwe
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2000
jne 0x416168
push str.0x2000
call fcn.004073f0
push 0x500
lea ecx, [ebp - 0x97c0]
push ebx
push ecx
mov dword [ebp - 0x10284], ebx
call fcn.0042eb30
mov ecx, dword [ebp - 0x10228]
add esp, 0x10
lea edx, [ebp - 0x10284]
push edx
push 0x500
lea eax, [ebp - 0x97c0]
push eax
add ecx, 0xe00
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x97c0]
test edx, edx
je 0x416168
cmp dword [ebp - 0x10284], 0x500
jne 0x416168
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xd
push 0x500
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x97c0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x416168
push 0x11
push 0x500
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x97c0]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x416168
push str.Sig_found_and_terminated_
mov dword [0x470164], eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x470130], 0x1e
jl 0x4161be
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4161be
cmp eax, 4
je 0x4161be
cmp dword [0x467218], eax
je 0x4161be
cmp dword [0x46721c], eax
je 0x4161be
mov ecx, 1
cmp dword [0x470294], ecx
je 0x4161c3
cmp dword [0x47013c], ebx
je 0x4161c3
mov dword [0x470128], ecx
jmp 0x4161c3
mov ecx, 1
mov eax, dword [ebp - 0x10238]
cmp eax, 0x8000
je 0x41657f
cmp eax, 0x9000
je 0x41657f
cmp eax, 0xe000
je 0x41657f
cmp eax, 0xf000
je 0x41657f
cmp eax, 0x27000
je 0x41657f
cmp eax, 0x28000
je 0x41657f
cmp eax, 0x32000
je 0x41657f
cmp eax, 0x33000
je 0x41657f
cmp eax, 0xd000
jne 0x416290
lea eax, [ebp - 0x10294]
push eax
xor edx, edx
push 8
lea ecx, [ebp - 0x38]
mov word [ebp - 0x38], dx
mov edx, dword [ebp - 0x10228]
push ecx
push edx
push edi
mov dword [ebp - 0x10294], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x1025c], al
jne 0x416269
mov cl, byte [ebp - 0x1025b]
cmp cl, byte [ebp - 0x37]
je 0x416284
cmp byte [ebp - 0x1024c], al
jne 0x4165fc
mov dl, byte [ebp - 0x37]
cmp byte [ebp - 0x1024b], dl
jne 0x4165fc
mov eax, dword [ebp - 0x10224]
push eax
jmp 0x4165df
cmp eax, 0x7000
jne 0x4162e8
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x10290]
push ecx
push 8
lea edx, [ebp - 0x38]
push edx
push eax
push edi
mov dword [ebp - 0x10290], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x10260]
cmp cl, byte [ebp - 0x38]
jne 0x4165fc
mov dl, byte [ebp - 0x1025f]
cmp dl, byte [ebp - 0x37]
jne 0x4165fc
mov eax, dword [ebp - 0x10224]
push eax
jmp 0x4165df
add eax, 0xff000000
cmp eax, 0x1000000
ja 0x4163c3
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165fc
cmp dword [ebp - 0x10230], 0x40
jne 0x4165fc
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x10298]
push ecx
push 5
lea edx, [ebp - 0x4d4]
push edx
push eax
push edi
mov dword [ebp - 0x10298], ebx
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4d0], ebx
mov word [ebp - 0x4cc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov cl, byte [ebp - 0x10254]
cmp cl, byte [ebp - 0x4d4]
jne 0x4165fc
mov dl, byte [ebp - 0x10253]
cmp dl, byte [ebp - 0x4d3]
jne 0x4165fc
mov al, byte [ebp - 0x10252]
cmp al, byte [ebp - 0x4d2]
jne 0x4165fc
mov eax, 1
add dword [0x470120], eax
cmp dword [0x470124], eax
jne 0x4163ac
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4165fc
cmp dword [0x470120], 8
jl 0x4165fc
mov dword [0x470124], eax
jmp 0x4165fc
cmp dword [0x470124], ecx
jne 0x4165fc
mov ecx, dword [ebp - 0x10228]
lea edx, [ebp - 0x1021c]
push edx
push 0xa
lea eax, [ebp - 0x100]
push eax
push ecx
push edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov word [ebp - 0xf8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x100]
mov cl, byte [ebp - 0xfc]
cmp eax, dword [ebp - 0x88]
jne 0x41643c
cmp byte [ebp - 0x84], cl
jne 0x41643c
mov dl, byte [ebp - 0x83]
cmp dl, byte [ebp - 0xfb]
jne 0x41643c
mov dl, byte [ebp - 0x82]
cmp dl, byte [ebp - 0xfa]
je 0x416498
cmp eax, dword [ebp - 0x58]
jne 0x41645c
cmp byte [ebp - 0x54], cl
jne 0x41645c
mov dl, byte [ebp - 0xfb]
cmp byte [ebp - 0x53], dl
jne 0x41645c
mov dl, byte [ebp - 0x52]
cmp dl, byte [ebp - 0xfa]
je 0x416498
cmp eax, dword [ebp - 0x98]
jne 0x4165fc
cmp byte [ebp - 0x94], cl
jne 0x4165fc
mov al, byte [ebp - 0xfb]
cmp byte [ebp - 0x93], al
jne 0x4165fc
mov cl, byte [ebp - 0xfa]
cmp byte [ebp - 0x92], cl
jne 0x4165fc
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4165fc
cmp dword [ebp - 0x10230], 0x40
jne 0x4165fc
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1000
je 0x4164cd
cmp eax, 0x2000
jne 0x4165fc
mov edx, dword [ebp - 0x10224]
push edx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc3b]
push ebx
push edx
mov byte [ebp - 0xc3c], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc3c]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SALITY.22022012
push str.NPAV4SALITY.22022012
lea edx, [ebp - 0xc3c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
jmp 0x4165fc
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x102a0]
push eax
push 8
lea ecx, [ebp - 0x38]
push ecx
push edx
push edi
mov dword [ebp - 0x102a0], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov al, byte [ebp - 0x38]
cmp byte [ebp - 0x10250], al
jne 0x4165c5
mov cl, byte [ebp - 0x1024f]
cmp cl, byte [ebp - 0x37]
jne 0x4165c5
mov edx, dword [ebp - 0x10224]
push edx
jmp 0x4165df
cmp byte [ebp - 0x1024c], al
jne 0x4165fc
mov al, byte [ebp - 0x37]
cmp byte [ebp - 0x1024b], al
jne 0x4165fc
mov ecx, dword [ebp - 0x10224]
push ecx
mov dword [0x470164], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [0x470150], ebx
jne 0x4165fc
call fcn.00407f90
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x1a
cmp eax, 0x6000
je 0x41661b
cmp eax, 0x9000
jne 0x4168fb
cmp dword [ebp - 0x1022c], 0x20000
jne 0x4168fb
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x4168fb
cmp dword [ebp - 0x1023c], eax
jne 0x4168fb
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416676
sub eax, edx
je 0x4168fb
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4168fb
push 0x104
push ebx
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4166c6
sub eax, edx
je 0x4168fb
push 0x12c
push ebx
push 0x46fba8
call fcn.0042eb30
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416726
sub eax, edx
je 0x4168fb
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x4168fb
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4168fb
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov edi, 1
push str.NPAV4GAMERU.19072016
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.19072016
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45caa0
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x5963]
push ebx
push eax
mov byte [ebp - 0x5964], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x5964]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x5964]
push str.WORM.GAMERU.19072016
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x4168fb
cmp dword [0x46f734], ebx
je 0x4168fb
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5964]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416862
mov ecx, dword [str.WORM.GAMERU.19072016]
mov edx, dword [0x45d890]
mov eax, dword [0x45d894]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d898]
mov dword [0x46a042], edx
mov edx, dword [0x45d89c]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d8a0]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x4168fb
cmp dword [ebp - 0x10238], 0x30000
mov dword [ebp - 4], 0x1c
jbe 0x416b65
cmp dword [ebp - 0x1022c], 0x20000
jne 0x416b65
cmp dword [ebp - 0x10230], 0x40
jne 0x416b65
cmp dword [ebp - 0x1023c], 0x40
jne 0x416b65
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416970
sub eax, edx
je 0x416b65
lea eax, [ebp - 0x434]
push str.POWERSHELL.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x416b65
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.POWERSHELL.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
push str.SMB:_Suspended_POWERSHELL.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x24
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416b65
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4WANNA.NPAV4.30072018
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4WANNA.NPAV4.30072018
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4POWERSHELL.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x3a17]
push ebx
push eax
mov byte [ebp - 0x3a18], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x3a18]
push str.POWERSHELL.EXE__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x3a18]
push str.WORM.WANNA.NPAV4.30072018
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x416b1e
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x3a18]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x416ac2
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.WANNA.NPAV4.30072018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push str.POWERSHELL.EXE
call fcn.0040c960
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x416b65
push str.WORM.WANNA.NPAV4.30072018
push 0x45c58c
push 0x45c58c
push 0x45c58c
push str.NPAV4POWERSHELL.EXE
lea ecx, [ebp - 0x3a18]
push ecx
push 1
call eax
add esp, 0x1c
jmp 0x416b65
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x1e
cmp eax, 0xc000
je 0x416b8b
cmp eax, 0x12000
je 0x416b8b
cmp eax, 0xd000
jne 0x416ef9
cmp dword [ebp - 0x1022c], 0x20000
jne 0x416ef9
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x416bb4
cmp dword [ebp - 0x1023c], eax
jne 0x416ef9
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416be8
sub eax, edx
je 0x416ef9
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x416ef9
push 0x104
push ebx
push 0x469cd8
call fcn.0042eb30
push 0x469cd8
call fcn.00408410
mov eax, 0x469cd8
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416c38
sub eax, edx
je 0x416ef9
push 0x12c
push ebx
push 0x46fba8
call fcn.0042eb30
mov eax, dword [esi + 4]
push 0x46fba8
push eax
call fcn.00408430
push str.current_user_name
call fcn.004073f0
push 0x469cd8
call fcn.004073f0
push str.MSIEXEC.EXE_process_user_name
call fcn.004073f0
push 0x46fba8
call fcn.004073f0
mov eax, 0x46fba8
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x416c98
sub eax, edx
je 0x416ef9
push 0x46fba8
push 0x469cd8
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x416ef9
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0xa
lea edx, [ebp - 0x440]
push edx
push eax
push ecx
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov word [ebp - 0x438], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dl, byte [ebp - 0x10258]
cmp dl, byte [ebp - 0x440]
jne 0x416d22
mov al, byte [ebp - 0x10257]
cmp al, byte [ebp - 0x43f]
jne 0x416d22
mov cl, byte [ebp - 0x10256]
cmp cl, byte [ebp - 0x43e]
je 0x416d46
mov edx, dword [ebp - 0x440]
cmp edx, dword [ebp - 0xe8]
jne 0x416ef9
mov al, byte [ebp - 0xe4]
cmp al, byte [ebp - 0x43c]
jne 0x416ef9
push str.Gameru:_Suspended_MSIEXEC.EXE_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x416ef9
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
mov edi, 1
push str.NPAV4GAMERU.16032017
mov dword [0x470164], edi
mov edx, dword [esi + 4]
push str.NPAV4GAMERU.16032017
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x45caa0
push str.NPAV4MSIEXEC.EXE
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x5b67]
push ebx
push eax
mov byte [ebp - 0x5b68], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x5b68]
push str.MSIEXEC.EXE__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x5b68]
push str.WORM.GAMERU.16032017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x470160], ebx
jne 0x416ef9
cmp dword [0x46f734], ebx
je 0x416ef9
push 0x1e0
push ebx
push 0x469f00
mov dword [0x470160], edi
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5b68]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x416e60
mov ecx, dword [str.WORM.GAMERU.16032017]
mov edx, dword [0x45d7a0]
mov eax, dword [0x45d7a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d7a8]
mov dword [0x46a042], edx
mov edx, dword [0x45d7ac]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov al, byte [0x45d7b0]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a052], al
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x416ef9
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x20
jne 0x4172ff
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x416f29
cmp dword [ebp - 0x1023c], eax
jne 0x4172ff
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x2c000
jne 0x4172ff
push str.0x2C000
call fcn.004073f0
push 0x500
lea eax, [ebp - 0x8ec0]
push ebx
push eax
mov dword [ebp - 0x1027c], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0x10
lea ecx, [ebp - 0x1027c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0x500
lea edx, [ebp - 0x8ec0]
push edx
add eax, 0x2a11e
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8ec0]
test edx, edx
je 0x4172ff
cmp dword [ebp - 0x1027c], 0x500
jne 0x4172ff
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x8ec0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4172ff
push str.match_87_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x4172ff
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xa67]
push ebx
push edx
mov byte [ebp - 0xa68], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa68]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.1
push str.NPAV4CERBER.20092016.1
lea edx, [ebp - 0xa68]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x5d6b]
push ebx
push eax
mov byte [ebp - 0x5d6c], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x5d6c]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x5d6c]
push str.WORM.CERBER.20092016.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41717b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5d6c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417120
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x4171c0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4171c0
cmp dword [0x470144], ebx
je 0x4171f0
lea ecx, [ebp - 0x10338]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x4b43]
push ebx
push edx
mov byte [ebp - 0x4b44], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x23ff]
push ebx
push eax
mov byte [ebp - 0x2400], bl
call fcn.0042eb30
mov ecx, dword [ebp - 0x10218]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x4172c1
lea edx, [ebp - 0x2400]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417242
lea eax, [ebp - 0x2400]
push eax
lea ecx, [ebp - 0x4b44]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x4b44]
push edx
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4172c1
lea ecx, [ebp - 0x4b44]
push ecx
lea edx, [ebp - 0x2400]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4172b4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4172c1
lea eax, [ebp - 0x2400]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x22
jne 0x417705
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41732f
cmp dword [ebp - 0x1023c], eax
jne 0x417705
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x26000
jne 0x417705
push str.0x26000
call fcn.004073f0
push 0x500
lea edx, [ebp - 0x8ec0]
push ebx
push edx
mov dword [ebp - 0x1028c], ebx
call fcn.0042eb30
mov edx, dword [ebp - 0x10228]
add esp, 0x10
lea eax, [ebp - 0x1028c]
push eax
mov eax, dword [ebp - 0x10220]
push 0x500
lea ecx, [ebp - 0x8ec0]
push ecx
add edx, 0x2411e
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8ec0]
test ecx, ecx
je 0x417705
cmp dword [ebp - 0x1028c], 0x500
jne 0x417705
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea edx, [ebp - 0x2c0]
push edx
lea eax, [ebp - 0x8ec0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x417705
push str.match_87_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417705
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xca3]
push ebx
push eax
mov byte [ebp - 0xca4], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xca4]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.2
push str.NPAV4CERBER.20092016.2
lea eax, [ebp - 0xca4]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x5f6f]
push ebx
push ecx
mov byte [ebp - 0x5f70], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x5f70]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x5f70]
push str.WORM.CERBER.20092016.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41758c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x5f70]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417531
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x4175d0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4175d0
cmp dword [0x470144], ebx
je 0x417600
lea edx, [ebp - 0x10340]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x6e93]
push ebx
push eax
mov byte [ebp - 0x6e94], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x15ff]
push ebx
push ecx
mov byte [ebp - 0x1600], bl
call fcn.0042eb30
mov edx, dword [ebp - 0x10218]
mov eax, dword [edx + 4]
push eax
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x4176d1
lea edx, [ebp - 0x1600]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417652
lea ecx, [ebp - 0x1600]
push ecx
lea edx, [ebp - 0x6e94]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0xc
push 1
lea eax, [ebp - 0x6e94]
push eax
lea ecx, [ebp - 0x1600]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4176d1
lea edx, [ebp - 0x6e94]
push edx
lea eax, [ebp - 0x1600]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4176c4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4176d1
lea ecx, [ebp - 0x1600]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x10220]
push 9
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
mov eax, dword [ebp - 0x1022c]
mov dword [ebp - 4], 0x24
cmp eax, 0x20000
je 0x417724
cmp eax, 0x40000
jne 0x417b05
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41773d
cmp dword [ebp - 0x1023c], eax
jne 0x417b05
push str.map_and_RWE
call fcn.004073f0
mov esi, dword [ebp - 0x10238]
add esp, 4
cmp esi, 0x1e00
jb 0x417b05
push 0x500
lea eax, [ebp - 0x8ec0]
push ebx
push eax
mov dword [ebp - 0x10288], ebx
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
add esp, 0xc
lea ecx, [ebp - 0x10288]
push ecx
push 0x500
lea edx, [ebp - 0x8ec0]
push edx
mov edx, dword [ebp - 0x10220]
lea ecx, [esi + eax - 0x1e00]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x8ec0]
test eax, eax
je 0x417b05
cmp dword [ebp - 0x10288], 0x500
jne 0x417b05
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x57
push 0x500
lea ecx, [ebp - 0x2c0]
push ecx
lea edx, [ebp - 0x8ec0]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x417b05
push str.match_87_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417b05
push str.Sig_found_and_suspend_
call fcn.004073f0
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xacf]
push ebx
push edx
mov byte [ebp - 0xad0], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xad0]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CERBER.20092016.3
push str.NPAV4CERBER.20092016.3
lea edx, [ebp - 0xad0]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x6173]
push ebx
push eax
mov byte [ebp - 0x6174], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x6174]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x6174]
push str.WORM.CERBER.20092016.3
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x417993
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6174]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x417938
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CERBER.20092016.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x4179d0
cmp dword [0x470144], ebx
je 0x417a00
lea ecx, [ebp - 0x1034c]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x5a63]
push ebx
push edx
mov byte [ebp - 0x5a64], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x18ff]
push ebx
push eax
mov byte [ebp - 0x1900], bl
call fcn.0042eb30
mov ecx, dword [ebp - 0x10218]
mov edx, dword [ecx + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x417ad1
lea edx, [ebp - 0x1900]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x417a52
lea eax, [ebp - 0x1900]
push eax
lea ecx, [ebp - 0x5a64]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x5a64]
push edx
lea eax, [ebp - 0x1900]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x417ad1
lea ecx, [ebp - 0x5a64]
push ecx
lea edx, [ebp - 0x1900]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x417ac4
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x417ad1
lea eax, [ebp - 0x1900]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1c000
je 0x417b1d
cmp eax, 0x1e000
jne 0x417ee9
cmp dword [ebp - 0x10230], 0x40
je 0x417b36
cmp dword [ebp - 0x1023c], 0x80
jne 0x417ee9
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x1022c]
add esp, 4
cmp eax, 0x1000000
je 0x417b5b
cmp eax, 0x20000
jne 0x417ee9
push str.0X1C000
call fcn.004073f0
mov esi, dword [ebp - 0x10228]
mov ecx, dword [ebp - 0x10220]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 4
lea edx, [ebp - 0x10264]
push edx
push 0xa
lea eax, [ebp - 0x46c]
push eax
push esi
push ecx
mov dword [ebp - 0x10264], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov word [ebp - 0x464], bx
call edi
mov edx, dword [ebp - 0x46c]
cmp edx, dword [ebp - 0xa8]
jne 0x417ee9
mov al, byte [ebp - 0xa4]
cmp al, byte [ebp - 0x468]
jne 0x417ee9
mov cl, byte [ebp - 0xa3]
cmp cl, byte [ebp - 0x467]
jne 0x417ee9
mov dl, byte [ebp - 0xa2]
cmp dl, byte [ebp - 0x466]
jne 0x417ee9
push str.match_7_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10220]
add esp, 4
lea eax, [ebp - 0x10264]
push eax
push 0x200
lea ecx, [ebp - 0x92c0]
push ecx
add esi, 0xc300
push esi
push edx
call edi
lea eax, [ebp - 0x92c0]
test eax, eax
je 0x417ee9
cmp dword [ebp - 0x10264], 0x200
jne 0x417ee9
push str.read_successful_and_act_bytes
call fcn.004073f0
add esp, 4
mov ecx, 0x12
lea eax, [ebp - 0x198]
lea esi, [ebp - 0x9274]
jmp 0x417c60
mov edx, dword [esi]
cmp edx, dword [eax]
jne 0x417c89
sub ecx, 4
add eax, 4
add esi, 4
cmp ecx, 4
jae 0x417c60
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x417c89
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
jne 0x417c89
mov esi, 1
jmp 0x417cb2
push str.going_to_serach_not_match_first_condition
call fcn.004073f0
push 0x12
push 0x200
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x92c0]
push ecx
call fcn.00408390
add esp, 0x14
mov esi, eax
push str.match_1st_Condition
call fcn.004073f0
mov edi, 1
add esp, 4
cmp esi, edi
jne 0x417ee9
push str.match_18_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
mov dword [ebp - 4], 0x26
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x417ee9
push str.Sig_found_and_suspend_
call fcn.004073f0
add esp, 4
mov dword [0x470164], edi
cmp dword [0x470154], ebx
jne 0x417d3b
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x10354]
push eax
push ebx
push ebx
push 0x40c550
push ebx
push ebx
call esi
lea ecx, [ebp - 0x10348]
push ecx
push ebx
push ebx
push 0x40f050
push ebx
push ebx
call esi
mov esi, dword [ebp - 0x10218]
mov eax, dword [0x46ff94]
mov dword [0x470154], edi
mov edx, dword [esi + 4]
mov dword [eax*4 + 0x4693b8], edx
add eax, edi
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xd0b]
push ebx
push eax
mov byte [ebp - 0xd0c], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xd0c]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4PIONEER.05102016
push str.NPAV4PIONEER.05102016
lea eax, [ebp - 0xd0c]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x6377]
push ebx
push ecx
mov byte [ebp - 0x6378], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6378]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x6378]
push str.WORM.PIONEER.05102016
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x417eef
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6378]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
add ecx, edi
add edx, edi
cmp al, bl
jne 0x417e50
mov ecx, dword [0x45d640]
mov eax, dword [str.WORM.PIONEER.05102016]
mov edx, dword [0x45d644]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d64c]
mov dword [0x46a03e], eax
mov eax, dword [0x45d648]
mov dword [0x46a04e], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a046], edx
mov dx, word [0x45d650]
mov dword [0x46a04a], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a052], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
jmp 0x417ee9
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x11000
je 0x417f07
cmp eax, 0x10000
jne 0x418326
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x417f20
cmp dword [ebp - 0x1023c], eax
jne 0x418326
push str.map_and_RWE
call fcn.004073f0
mov eax, dword [ebp - 0x1022c]
add esp, 4
cmp eax, 0x20000
je 0x417f45
cmp eax, 0x1000000
jne 0x418326
push str.0X11000_0X10000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0x10214]
push ebx
push edx
call fcn.0042eb30
mov edx, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x1000
lea ecx, [ebp - 0x10214]
push ecx
add edx, 0x4000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1000
jne 0x418326
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x10214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418326
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0x10214]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418326
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x28
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xb37]
push ebx
push eax
mov byte [ebp - 0xb38], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xb38]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.09012017.1
push str.NPAV4CRYSIS.09012017.1
lea eax, [ebp - 0xb38]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x78ab]
push ebx
push ecx
mov byte [ebp - 0x78ac], bl
call fcn.0042eb30
push 0xff
lea edx, [ebp - 0x1aff]
push ebx
push edx
mov byte [ebp - 0x1b00], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x418175
mov ecx, eax
lea edx, [ebp - 0x1b00]
jmp 0x418100
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418100
lea ecx, [ebp - 0x1b00]
push ecx
lea edx, [ebp - 0x78ac]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0xc
push 1
lea eax, [ebp - 0x78ac]
push eax
lea ecx, [ebp - 0x1b00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418175
lea edx, [ebp - 0x78ac]
push edx
lea eax, [ebp - 0x1b00]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x418168
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418175
lea ecx, [ebp - 0x1b00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x657f]
push ebx
push edx
mov byte [ebp - 0x6580], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6580]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x6580]
push str.WORM.CRYSIS.09012017.1
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41824d
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6580]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4181f0
mov dl, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4182c8
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x4182a0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4182a0
cmp dword [0x470144], ebx
je 0x4182c8
lea eax, [ebp - 0x1033c]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040ec20
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x4182fb
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0x3000
jne 0x418756
cmp dword [ebp - 0x10230], 0x20
je 0x41834f
cmp dword [ebp - 0x1023c], 0x80
jne 0x418f99
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418756
push str.0X3000
call fcn.004073f0
push 0x100
lea edx, [ebp - 0x876c]
push ebx
push edx
call fcn.0042eb30
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x100
lea ecx, [ebp - 0x876c]
push ecx
push 0x40d500
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x100
jne 0x418756
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x100
lea edx, [ebp - 0x50]
push edx
lea eax, [ebp - 0x876c]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418756
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x100
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0x876c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418756
push str.match_12_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2a
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xcd7]
push ebx
push edx
mov byte [ebp - 0xcd8], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xcd8]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.09012017.2
push str.NPAV4CRYSIS.09012017.2
lea edx, [ebp - 0xcd8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x5c67]
push ebx
push eax
mov byte [ebp - 0x5c68], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x1cff]
push ebx
push ecx
mov byte [ebp - 0x1d00], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x4185a2
mov ecx, eax
lea edx, [ebp - 0x1d00]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418520
lea eax, [ebp - 0x1d00]
push eax
lea ecx, [ebp - 0x5c68]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x5c68]
push edx
lea eax, [ebp - 0x1d00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4185a2
lea ecx, [ebp - 0x5c68]
push ecx
lea edx, [ebp - 0x1d00]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x418595
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4185a2
lea eax, [ebp - 0x1d00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x6787]
push ebx
push ecx
mov byte [ebp - 0x6788], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x6788]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x6788]
push str.WORM.CRYSIS.09012017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41867b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6788]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418620
mov eax, dword [str.NPA4]
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4186f8
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CRYSIS.09012017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4186d0
cmp dword [0x470144], ebx
je 0x4186f8
lea edx, [ebp - 0x102e0]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x434]
push eax
call fcn.0040ec20
mov eax, dword [0x470178]
add esp, 4
cmp eax, ebx
je 0x418712
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 8
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x136000
je 0x418775
cmp eax, 0x134000
je 0x418775
cmp eax, 0x135000
jne 0x418b77
cmp dword [ebp - 0x10230], 0x40
jne 0x418b77
cmp dword [ebp - 0x1023c], 0x80
jne 0x418b77
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418b77
push str.0X136000
call fcn.004073f0
push 0x32
lea ecx, [ebp - 0xd40]
push ebx
push ecx
call fcn.0042eb30
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea edx, [ebp - 0x1021c]
push edx
push 0x32
lea eax, [ebp - 0xd40]
push eax
push 0x406020
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x418b77
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea ecx, [ebp - 0x1a4]
push ecx
lea edx, [ebp - 0xd40]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418b77
push str.match_11_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x2c
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x68b]
push ebx
push edx
mov byte [ebp - 0x68c], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x68c]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4STOPRANSOM.NPAV4.18112019
push str.NPAV4STOPRANSOM.NPAV4.18112019
lea edx, [ebp - 0x68c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x412b]
push ebx
push eax
mov byte [ebp - 0x412c], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x1eff]
push ebx
push ecx
mov byte [ebp - 0x1f00], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x4189a6
mov ecx, eax
lea edx, [ebp - 0x1f00]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418924
lea eax, [ebp - 0x1f00]
push eax
lea ecx, [ebp - 0x412c]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x412c]
push edx
lea eax, [ebp - 0x1f00]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4189a6
lea ecx, [ebp - 0x412c]
push ecx
lea edx, [ebp - 0x1f00]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x418999
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4189a6
lea eax, [ebp - 0x1f00]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3c1b]
push ebx
push ecx
mov byte [ebp - 0x3c1c], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3c1c]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x3c1c]
push str.WORM.STOPRANSOM.NPAV4.18112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x418a7c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x3c1c]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418a21
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418af8
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.STOPRANSOM.NPAV4.18112019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418ad0
cmp dword [0x470144], ebx
je 0x418af8
lea edx, [ebp - 0x102bc]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418b31
push str.WORM.STOPRANSOM.NPAV4.18112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x412c]
push ecx
lea edx, [ebp - 0x68c]
push edx
lea ecx, [ebp - 0x3c1c]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418b55
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.STOPRANSOM.18112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0xd000
jne 0x418f7d
cmp dword [ebp - 0x10230], 0x40
jne 0x419806
cmp dword [ebp - 0x1023c], 0x80
jne 0x419806
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x418f7d
push str.0XD000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xddc]
push ebx
push eax
call fcn.0042eb30
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x32
lea edx, [ebp - 0xddc]
push edx
push 0x40d3e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x418f7d
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xb
push 0x32
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0xddc]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x418f7d
push str.match_11_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
push ebx
push edx
mov dword [ebp - 4], 0x2e
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x75b]
push ebx
push edx
mov byte [ebp - 0x75c], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x75c]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4DEATHRANSOM.NPAV4.22112019
push str.NPAV4DEATHRANSOM.NPAV4.22112019
lea edx, [ebp - 0x75c]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x3913]
push ebx
push eax
mov byte [ebp - 0x3914], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x20ff]
push ebx
push ecx
mov byte [ebp - 0x2100], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x418db8
mov ecx, eax
lea edx, [ebp - 0x2100]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418d36
lea eax, [ebp - 0x2100]
push eax
lea ecx, [ebp - 0x3914]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x3914]
push edx
lea eax, [ebp - 0x2100]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x418db8
lea ecx, [ebp - 0x3914]
push ecx
lea edx, [ebp - 0x2100]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x418dab
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x418db8
lea eax, [ebp - 0x2100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x3e23]
push ebx
push ecx
mov byte [ebp - 0x3e24], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x3e24]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x3e24]
push str.WORM.DEATHRANSOM.NPAV4.22112019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x418e8b
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x3e24]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418e33
mov eax, dword [str.NPA4]
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x418efe
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
push 0x104
push ebx
mov ecx, 8
mov esi, str.WORM.DEATHRANSOM.NPAV4.22112019
mov edi, 0x46f738
push 0x46f978
rep movsd dword es:[edi], dword [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x418ed6
cmp dword [0x470144], ebx
je 0x418efe
lea edx, [ebp - 0x102cc]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x418f37
push str.WORM.DEATHRANSOM.NPAV4.22112019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3914]
push ecx
lea edx, [ebp - 0x75c]
push edx
lea ecx, [ebp - 0x3e24]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x418f5b
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.DEATHRANSOM.22112019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x10238], 0x2000
je 0x418f99
cmp dword [ebp - 0x10238], 0x3000
jne 0x4193a7
cmp dword [ebp - 0x10230], 0x40
jne 0x4193a7
cmp dword [ebp - 0x1023c], 0x80
jne 0x4193a7
push str.IMAG_and_EWC
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x4193a7
push str.0X2000
call fcn.004073f0
push 0x32
lea eax, [ebp - 0xd74]
push ebx
push eax
call fcn.0042eb30
mov eax, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x32
lea edx, [ebp - 0xd74]
push edx
add eax, 0x11c0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x32
jne 0x4193a7
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x12
push 0x32
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0xd74]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x4193a7
push str.match_18_bytes
call fcn.004073f0
mov eax, dword [esi + 4]
push ebx
push eax
mov dword [ebp - 4], 0x30
call fcn.00408550
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x623]
push ebx
push edx
mov byte [ebp - 0x624], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x624]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SIFRELENDI.NPAV4.19122019
push str.NPAV4SIFRELENDI.NPAV4.19122019
lea edx, [ebp - 0x624]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x58
push 0xff
lea eax, [ebp - 0x3303]
push ebx
push eax
mov byte [ebp - 0x3304], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x22ff]
push ebx
push ecx
mov byte [ebp - 0x2300], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x4191d2
mov ecx, eax
lea edx, [ebp - 0x2300]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419150
lea eax, [ebp - 0x2300]
push eax
lea ecx, [ebp - 0x3304]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x3304]
push edx
lea eax, [ebp - 0x2300]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4191d2
lea ecx, [ebp - 0x3304]
push ecx
lea edx, [ebp - 0x2300]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x4191c5
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x4191d2
lea eax, [ebp - 0x2300]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea ecx, [ebp - 0x402b]
push ebx
push ecx
mov byte [ebp - 0x402c], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x402c]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x402c]
push str.WORM.SIFRELENDI.NPAV4.19122019
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x4192ab
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x402c]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419250
mov eax, dword [str.NPA4]
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov cl, byte [0x45ca74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x419328
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.SIFRELENDI.NPAV4.19122019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419300
cmp dword [0x470144], ebx
je 0x419328
lea edx, [ebp - 0x102d8]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x419361
push str.WORM.SIFRELENDI.NPAV4.19122019
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3304]
push ecx
lea edx, [ebp - 0x624]
push edx
lea ecx, [ebp - 0x402c]
push ecx
push 1
call eax
add esp, 0x1c
mov eax, dword [0x470188]
cmp eax, ebx
je 0x419385
push str.NPAV4
push str.NPAV4
lea edx, [ebp - 0x434]
push str.WORM.SIFRELENDI.19122019
push edx
call eax
add esp, 0x10
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
add esp, 4
mov dword [0x470154], eax
mov dword [0x470164], eax
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
cmp eax, 0x1d000
je 0x4193c6
cmp eax, 0x1c000
je 0x4193c6
cmp eax, 0x22000
jne 0x419806
cmp dword [ebp - 0x1022c], 0x20000
jne 0x419806
push str.MEM_PRIVATE
call fcn.004073f0
mov eax, 0x40
add esp, 4
cmp dword [ebp - 0x10230], eax
je 0x4193fc
cmp dword [ebp - 0x1023c], eax
jne 0x419806
push str.PAGE_EXECUTE_READWRITE
call fcn.004073f0
push 0x200
lea eax, [ebp - 0x90c0]
push ebx
push eax
call fcn.0042eb30
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x1021c]
push ecx
push 0x200
lea edx, [ebp - 0x90c0]
push edx
push 0x40c400
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x200
jne 0x419806
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x200
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x90c0]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x419806
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x200
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0x90c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x419806
push str.match_12_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ebx
push ecx
mov dword [ebp - 4], 0x32
call fcn.00408550
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0xb9f]
push ebx
push eax
mov byte [ebp - 0xba0], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xba0]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRYSIS.06022017.3
push str.NPAV4CRYSIS.06022017.3
lea eax, [ebp - 0xba0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x58
push 0xff
lea ecx, [ebp - 0x8567]
push ebx
push ecx
mov byte [ebp - 0x8568], bl
call fcn.0042eb30
push 0xff
lea edx, [ebp - 0x24ff]
push ebx
push edx
mov byte [ebp - 0x2500], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41965a
mov ecx, eax
lea edx, [ebp - 0x2500]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4195b0
lea ecx, [ebp - 0x2500]
push ecx
lea edx, [ebp - 0x8568]
push str._s.np4
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x8568]
push eax
lea ecx, [ebp - 0x2500]
push ecx
call fcn.0043090d
add esp, 0x14
test eax, eax
jne 0x41960b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41965a
push 0x1f2
lea eax, [ebp - 0x99b2]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x99b4], dx
call fcn.0042eb30
lea ecx, [ebp - 0x2500]
push 0x5c
push ecx
call fcn.0042f060
add esp, 0x14
cmp eax, ebx
je 0x41963d
mov byte [eax], bl
lea edx, [ebp - 0x99b4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x2500]
push ecx
call fcn.0040a680
add esp, 0xc
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x6b8f]
push ebx
push edx
mov byte [ebp - 0x6b90], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6b90]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x6b90]
push str.WORM.CRYSIS.06022017.3
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x419732
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6b90]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x4196d5
mov dl, byte [0x45ca74]
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x4197a8
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 5
mov esi, str.WORM.CRYSIS.06022017.3
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419780
cmp dword [0x470144], ebx
je 0x4197a8
lea eax, [ebp - 0x102fc]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
lea ecx, [ebp - 0x434]
push ecx
mov dword [0x470154], eax
mov dword [0x470164], eax
call fcn.0040ec20
mov eax, dword [0x470178]
add esp, 8
cmp eax, ebx
je 0x4197db
call eax
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
mov esi, dword [ebp - 0x10218]
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x34
cmp eax, 0x38000
je 0x419841
cmp eax, 0x3a000
je 0x419841
cmp eax, 0x34000
je 0x419841
cmp eax, 0x3b000
je 0x419841
cmp eax, 0x91000
je 0x419841
cmp eax, 0x39000
jne 0x419be8
cmp dword [ebp - 0x1022c], 0x20000
jne 0x419be8
mov ecx, 0x40
cmp dword [ebp - 0x10230], ecx
je 0x41986a
cmp dword [ebp - 0x1023c], ecx
jne 0x419be8
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419898
sub eax, edx
je 0x419be2
lea edx, [ebp - 0x434]
push str.EXPLORER.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x41990b
lea eax, [ebp - 0x434]
push str.CHROME.EXE
push eax
call fcn.0045315b
add esp, 8
test eax, eax
je 0x41990b
lea ecx, [ebp - 0x434]
push str.IEXPLORE.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x41990b
lea edx, [ebp - 0x434]
push str.FIREFOX.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x419be2
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
mov eax, dword [ebp - 0x10220]
push 0xa
lea ecx, [ebp - 0x330]
push ecx
push edx
push eax
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov word [ebp - 0x328], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x330]
mov cl, byte [ebp - 0x32c]
cmp eax, dword [ebp - 0x30]
jne 0x419963
cmp byte [ebp - 0x2c], cl
jne 0x419963
mov dl, byte [ebp - 0x2b]
cmp dl, byte [ebp - 0x32b]
je 0x4199ab
cmp eax, dword [ebp - 0xd0]
jne 0x419981
cmp byte [ebp - 0xcc], cl
jne 0x419981
mov dl, byte [ebp - 0xcb]
cmp dl, byte [ebp - 0x32b]
je 0x4199ab
cmp eax, dword [ebp - 0xc0]
jne 0x419be2
cmp byte [ebp - 0xbc], cl
jne 0x419be2
mov al, byte [ebp - 0x32b]
cmp byte [ebp - 0xbb], al
jne 0x419be2
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419be2
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6d93]
push ebx
push eax
mov byte [ebp - 0x6d94], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6d94]
push str.AR8__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x6d94]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419b39
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6d94]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419ab0
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d3a0]
mov eax, dword [0x45d3a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d3a8]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a042], edx
mov dx, word [0x45d3ac]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419be2
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov eax, dword [0x45d3a0]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d3a4]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d3a8]
mov dword [0x46f73c], eax
mov ax, word [0x45d3ac]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042eb30
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d398]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419be2
lea eax, [ebp - 0x1032c]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x10238]
mov dword [ebp - 4], 0x36
cmp eax, 0x96000
je 0x419c08
cmp eax, 0x93000
je 0x419c08
cmp eax, 0x94000
jne 0x419eea
cmp dword [ebp - 0x1022c], 0x20000
jne 0x419eea
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x419c31
cmp dword [ebp - 0x1023c], eax
jne 0x419eea
mov eax, dword [ebp - 0x10228]
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0xa
lea edx, [ebp - 0x44c]
push edx
push eax
push ecx
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], ebx
mov word [ebp - 0x444], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x30]
jne 0x419c89
mov dl, byte [ebp - 0x2c]
cmp dl, byte [ebp - 0x448]
jne 0x419c89
mov cl, byte [ebp - 0x2b]
cmp cl, byte [ebp - 0x447]
je 0x419cb9
cmp eax, dword [ebp - 0xc8]
jne 0x419eea
mov dl, byte [ebp - 0x448]
cmp byte [ebp - 0xc4], dl
jne 0x419eea
mov al, byte [ebp - 0x447]
cmp byte [ebp - 0xc3], al
jne 0x419eea
push str.Apcon:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x20]
push str.pid_d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x20]
push eax
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x419eea
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4AR8.21012017
mov dword [0x470164], 1
mov edx, dword [esi + 4]
push str.NPAV4AR8.21012017
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x45caa0
push str.NPAV4AR8
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea eax, [ebp - 0x6f97]
push ebx
push eax
mov byte [ebp - 0x6f98], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x6f98]
push str.AR8__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x6f98]
push str.WORM.AR8.21012017
push eax
call fcn.0040a000
add esp, 0x40
cmp dword [0x46f734], ebx
je 0x419e41
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x6f98]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x419db8
mov ecx, dword [str.WORM.AR8.21012017]
mov edx, dword [0x45d3a0]
mov eax, dword [0x45d3a4]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d3a8]
mov dword [0x46a04a], ecx
mov cl, byte [0x45ca74]
mov dword [0x46a042], edx
mov dx, word [0x45d3ac]
mov dword [0x46a046], eax
mov eax, dword [str.NPA4]
mov byte [0x46a0a7], cl
sub esp, 0x1e0
mov word [0x46a04e], dx
mov dword [0x46a0a3], eax
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x419eea
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov eax, dword [0x45d3a0]
mov edx, dword [str.WORM.AR8.21012017]
mov ecx, dword [0x45d3a4]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d3a8]
mov dword [0x46f73c], eax
mov ax, word [0x45d3ac]
push ebx
push 0x46f978
mov dword [0x46f740], ecx
mov dword [0x46f744], edx
mov word [0x46f748], ax
call fcn.0042eb30
mov ecx, dword [str.AR8.EXE]
mov edx, dword [0x45d398]
add esp, 0x18
mov dword [0x46f978], ecx
mov dword [0x46f97c], edx
cmp dword [0x470144], ebx
je 0x419eea
lea eax, [ebp - 0x10304]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x38
jne 0x41a380
mov eax, dword [ebp - 0x10238]
cmp eax, 0x14000
je 0x419f19
cmp eax, 0x13000
jne 0x41a380
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41a380
cmp dword [ebp - 0x1023c], eax
jne 0x41a380
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042eb30
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419f64
sub eax, edx
je 0x41a380
lea ecx, [ebp - 0x434]
push str.CacheMgr.exe
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x419fa7
lea edx, [ebp - 0x434]
push str.dwm22.exe
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41a380
mov edx, dword [ebp - 0x10228]
lea eax, [ebp - 0x1021c]
push eax
mov eax, dword [ebp - 0x10220]
push 0xa
lea ecx, [ebp - 0x4f8]
push ecx
push edx
push eax
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov word [ebp - 0x4f0], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, 9
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 0x4f8]
nop
cmp edx, 4
jb 0x41a03d
mov edi, dword [ecx]
cmp edi, dword [eax]
jne 0x41a380
sub edx, 4
add eax, 4
add ecx, 4
jmp 0x419ff0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41a380
push str.FAEDEVOUR:_Terminate_Process
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a380
mov eax, dword [0x46ff94]
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4FAEDEVOUR.22022017
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push str.NPAV4FAEDEVOUR.22022017
mov dword [eax*4 + 0x4693b8], ecx
inc eax
push 0x45caa0
push str.NPAV4
mov dword [0x46ff94], eax
call fcn.00407310
push 0x103
lea edx, [ebp - 0x719b]
push ebx
push edx
mov byte [ebp - 0x719c], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
lea edx, [ebp - 0x719c]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x719c]
push str.WORM.FAEDEVOUR.22022017
push eax
call fcn.0040a000
add esp, 0x44
cmp dword [0x46f734], ebx
je 0x41a1e3
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x719c]
mov edx, 0x469f12
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a150
mov ecx, dword [str.WORM.FAEDEVOUR.22022017]
mov edx, dword [0x45d328]
mov eax, dword [0x45d32c]
mov dword [0x46a03e], ecx
mov ecx, dword [0x45d330]
mov dword [0x46a042], edx
mov edx, dword [0x45d334]
mov dword [0x46a04a], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a046], eax
mov eax, dword [0x45d338]
mov dword [0x46a04e], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a052], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
push 0xff
lea eax, [ebp - 0x7097]
push ebx
push eax
mov byte [ebp - 0x7098], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x26ff]
push ebx
push ecx
mov byte [ebp - 0x2700], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41a2b8
lea edx, [ebp - 0x2700]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41a230
lea eax, [ebp - 0x2700]
push eax
lea ecx, [ebp - 0x7098]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x7098]
push edx
lea eax, [ebp - 0x2700]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a2b8
lea ecx, [ebp - 0x7098]
push ecx
lea edx, [ebp - 0x2700]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41a2ab
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a2b8
lea eax, [ebp - 0x2700]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x470160], ebx
jne 0x41a380
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov edx, dword [str.WORM.FAEDEVOUR.22022017]
mov eax, dword [0x45d328]
mov ecx, dword [0x45d32c]
push 0x104
mov dword [0x46f738], edx
mov edx, dword [0x45d330]
mov dword [0x46f73c], eax
mov eax, dword [0x45d334]
mov dword [0x46f740], ecx
mov ecx, dword [0x45d338]
push ebx
push 0x46f978
mov dword [0x46f744], edx
mov dword [0x46f748], eax
mov dword [0x46f74c], ecx
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41a350
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a350
cmp dword [0x470144], ebx
je 0x41a380
lea edx, [ebp - 0x102c8]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x10238], 0x3000
mov dword [ebp - 4], 0x3a
jne 0x41a883
cmp dword [ebp - 0x10230], 0x20
je 0x41a3ad
cmp dword [ebp - 0x1023c], 0x40
jne 0x41a883
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41a883
push str.0x3000
call fcn.004073f0
mov edi, dword [ebp - 0x10228]
mov edx, dword [ebp - 0x10220]
add esp, 4
lea eax, [ebp - 0x10268]
push eax
push 0xa
lea ecx, [ebp - 0x460]
push ecx
push edi
push edx
mov dword [ebp - 0x10268], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov word [ebp - 0x458], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x460]
cmp eax, dword [ebp - 0xb8]
jne 0x41a883
mov cl, byte [ebp - 0xb4]
cmp cl, byte [ebp - 0x45c]
jne 0x41a883
mov dl, byte [ebp - 0xb3]
cmp dl, byte [ebp - 0x45b]
jne 0x41a883
mov al, byte [ebp - 0xb2]
cmp al, byte [ebp - 0x45a]
jne 0x41a883
push 0x200
lea ecx, [ebp - 0x9bb4]
push ebx
push ecx
call fcn.0042eb30
mov ecx, dword [ebp - 0x10220]
add esp, 0xc
lea edx, [ebp - 0x10268]
push edx
push 0x200
lea eax, [ebp - 0x9bb4]
push eax
add edi, 0x900
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x10268], 0x200
jne 0x41a883
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x1f
push 0x200
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x9bb4]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41a883
push str.match_31_bytes
call fcn.004073f0
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 8
push str.Program_files
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x41a883
mov edx, dword [ebp - 0x10224]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41a883
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xc6f]
push ebx
push edx
mov byte [ebp - 0xc70], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xc70]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4BTCWARE.12042017.1
push str.NPAV4BTCWARE.12042017.1
lea edx, [ebp - 0xc70]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x739f]
push ebx
push eax
mov byte [ebp - 0x73a0], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x73a0]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x73a0]
push str.WORM.BTCWARE.12042017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41a6c1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x73a0]
mov edx, 0x469f12
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41a630
mov edx, dword [str.WORM.BTCWARE.12042017.1]
mov eax, dword [0x45d2d4]
mov ecx, dword [0x45d2d8]
mov dword [0x46a03e], edx
mov edx, dword [0x45d2dc]
mov dword [0x46a042], eax
mov eax, dword [0x45d2e0]
mov dword [0x46a046], ecx
mov ecx, dword [0x45d2e4]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov dword [0x46a052], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41a770
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, dword [str.WORM.BTCWARE.12042017.1]
mov edx, dword [0x45d2d4]
mov eax, dword [0x45d2d8]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d2dc]
mov dword [0x46f73c], edx
mov edx, dword [0x45d2e0]
mov dword [0x46f740], eax
mov eax, dword [0x45d2e4]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov dword [0x46f74c], eax
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41a740
cmp dword [0x470144], ebx
je 0x41a770
lea ecx, [ebp - 0x102d0]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x5e6b]
push ebx
push edx
mov byte [ebp - 0x5e6c], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x28ff]
push ebx
push eax
mov byte [ebp - 0x2900], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41a845
lea edx, [ebp - 0x2900]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41a7c0
lea edx, [ebp - 0x2900]
push edx
lea eax, [ebp - 0x5e6c]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x5e6c]
push ecx
lea edx, [ebp - 0x2900]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41a845
lea eax, [ebp - 0x5e6c]
push eax
lea ecx, [ebp - 0x2900]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41a838
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41a845
lea edx, [ebp - 0x2900]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10220]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push str.UmRdpService
mov dword [0x470164], 1
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x3c
jne 0x41ac71
cmp dword [ebp - 0x10238], 0x11000
jb 0x41ac71
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41ac71
cmp dword [ebp - 0x1023c], eax
jne 0x41ac71
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042eb30
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41a8f5
sub eax, edx
je 0x41ac71
lea ecx, [ebp - 0x434]
push str.SVCHOST.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
je 0x41a938
lea edx, [ebp - 0x434]
push str.SPOOLSV.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41ac71
push str.Chengdu:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41ac71
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x7f7]
push ebx
push edx
mov byte [ebp - 0x7f8], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7f8]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4Chengdu.22032022
push str.NPAV4Chengdu.22032022
lea edx, [ebp - 0x7f8]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x422f]
push ebx
push eax
mov byte [ebp - 0x4230], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4230]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x4230]
push str.WORM.CHENGDU.22032022
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41ab25
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4230]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41aa92
mov edx, dword [str.WORM.CHENGDU.22032022]
mov eax, dword [0x45d278]
mov ecx, dword [0x45d27c]
mov dword [0x46a03e], edx
mov edx, dword [0x45d280]
mov dword [0x46a042], eax
mov eax, dword [0x45d284]
mov dword [0x46a046], ecx
mov cx, word [0x45d288]
mov dword [0x46a04a], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04e], eax
mov al, byte [0x45ca74]
mov word [0x46a052], cx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41ac4d
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov eax, dword [0x45d264]
mov ecx, dword [str.WORM.CHENGDU.25052017]
mov edx, dword [0x45d260]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d268]
mov dword [0x46f73c], edx
mov edx, dword [0x45d26c]
mov dword [0x46f740], eax
mov ax, word [0x45d270]
push ebx
push 0x46f978
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
mov word [0x46f74c], ax
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41abb0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41abb0
push 0x44
lea ecx, [ebp - 0x10398]
push ebx
push ecx
call fcn.0042eb30
add esp, 0xc
lea edx, [ebp - 0x102b0]
push edx
lea eax, [ebp - 0x10398]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.IPSEC_STATIC_DELETE_POLICY_NAMEQIANYE
push str.C:WINDOWSSYSTEM32NETSH.EXE
mov dword [ebp - 0x10398], 0x44
mov dword [ebp - 0x102b0], ebx
mov dword [ebp - 0x102ac], ebx
mov dword [ebp - 0x102a8], ebx
mov dword [ebp - 0x102a4], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41ac4d
push 0x46f738
call fcn.00407460
add esp, 4
test eax, eax
jne 0x41ac4d
cmp dword [0x470144], ebx
je 0x41ac4d
lea ecx, [ebp - 0x10334]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea edx, [ebp - 0x4230]
push str.WORM.CHENGDU.NPAV4.25052017
push edx
call fcn.0040a000
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x1022c], 0x40000
mov dword [ebp - 4], 0x3e
jne 0x41af56
cmp dword [ebp - 0x10238], 0x2ee0
jb 0x41af56
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41af56
cmp dword [ebp - 0x1023c], eax
jne 0x41af56
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
call fcn.0042eb30
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41ace3
sub eax, edx
je 0x41af56
lea ecx, [ebp - 0x434]
push str.EXPLORER.EXE
push ecx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41af56
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x20]
push str.pid_d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x20]
push ecx
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41af50
mov dword [0x470164], 1
call fcn.0040c260
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x103
lea edx, [ebp - 0x75a7]
push ebx
push edx
mov byte [ebp - 0x75a8], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x75a8]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x75a8]
push str.WORM.DOFOIL.NPAV4.23032018
push eax
call fcn.0040a000
add esp, 0x38
cmp dword [0x470160], ebx
jne 0x41af50
push 0x31
lea ecx, [ebp - 0x82b]
push ebx
push ecx
mov byte [ebp - 0x82c], bl
call fcn.0042eb30
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x82c]
push str.NPAV4_s
push eax
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4DOFOIL.NPAV4.23032018
push str.NPAV4DOFOIL.NPAV4.23032018
lea ecx, [ebp - 0x82c]
push 0x45caa0
push ecx
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41aedb
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x75a8]
mov edx, 0x469f12
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41ae80
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.DOFOIL.NPAV4.23032018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41af20
cmp dword [0x470144], ebx
je 0x41af50
lea ecx, [ebp - 0x1030c]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0x10218]
cmp dword [ebp - 0x1022c], 0x40000
mov eax, 0x40
mov dword [ebp - 4], eax
jne 0x41b24a
cmp dword [ebp - 0x10238], 0x55f0
jb 0x41b24a
cmp dword [ebp - 0x10230], eax
jne 0x41b24a
cmp dword [ebp - 0x1023c], eax
jne 0x41b24a
push 0x104
lea edx, [ebp - 0x434]
push ebx
push edx
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41afc4
sub eax, edx
je 0x41b24a
lea edx, [ebp - 0x434]
push str.MSIEXEC.EXE
push edx
call fcn.0045315b
add esp, 8
test eax, eax
jne 0x41b24a
push str.Dofoil:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b24a
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042eb30
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x77ab]
push ebx
push ecx
mov byte [ebp - 0x77ac], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x77ac]
push str._s__d
push ecx
call fcn.0042ecc6
add esp, 0x30
cmp dword [0x470160], ebx
jne 0x41b220
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x31
mov dword [0x46ff94], eax
lea eax, [ebp - 0x893]
push ebx
push eax
mov byte [ebp - 0x894], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x894]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
push str.NPAV4CRY_MSIEXC.NPAV4.06032019
lea eax, [ebp - 0x894]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x38
cmp dword [0x46f734], ebx
je 0x41b1a1
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x77ac]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b144
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.CRY_MSIEXC.NPAV4.06032019
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41b1f0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b1f0
cmp dword [0x470144], ebx
je 0x41b220
lea eax, [ebp - 0x102c4]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0040c260
lea ecx, [ebp - 0x77ac]
push str.WORM.CRY_MSIEXC.NPAV4.06032019
push ecx
call fcn.0040a000
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
add esp, 0x10
cmp dword [ebp - 0x1022c], 0x20000
mov dword [ebp - 4], 0x42
jne 0x41b713
cmp dword [ebp - 0x10238], 0x9000
jne 0x41b713
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41b713
cmp dword [ebp - 0x1023c], eax
jne 0x41b713
mov eax, dword [esi + 4]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
jne 0x41b300
mov eax, dword [ebp - 0x10224]
cmp eax, ebx
je 0x41b2b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10220]
cmp eax, ebx
je 0x41dce9
push eax
jmp 0x41dce3
push 0x104
lea ecx, [ebp - 0xee0]
push ebx
push ecx
call fcn.0042eb30
add esp, 0xc
push 0x104
lea edx, [ebp - 0xee0]
push edx
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xee0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41b338
sub eax, edx
je 0x41b713
lea eax, [ebp - 0xee0]
push eax
call fcn.004303aa
lea ecx, [ebp - 0xee0]
push str.APPDATAROAMINGMICROSOFT_
push ecx
call fcn.0042f090
add esp, 0xc
test eax, eax
jne 0x41b387
lea edx, [ebp - 0xee0]
push str.APPLICATION_DATAMICROSOFT_
push edx
call fcn.0042f090
add esp, 8
test eax, eax
je 0x41b713
push str.HRM:_Suspended
call fcn.004073f0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x20]
push str.pid_d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x20]
push edx
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 0x14
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41b713
mov eax, dword [0x46ff94]
mov dword [0x470164], 1
mov ecx, dword [esi + 4]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x8fb]
push ebx
push edx
mov byte [ebp - 0x8fc], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x8fc]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4HRM.02112017.1
push str.NPAV4HRM.02112017.1
lea edx, [ebp - 0x8fc]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x79af]
push ebx
push eax
mov byte [ebp - 0x79b0], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x79b0]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x79b0]
push str.WORM.HRM.02112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41b568
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x79b0]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b4e1
mov edx, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45d0fc]
mov eax, dword [0x45d0f8]
mov dword [0x46a03e], edx
mov edx, dword [0x45d100]
mov dword [0x46a046], ecx
mov ecx, dword [str.NPA4]
mov dword [0x46a042], eax
mov eax, dword [0x45d104]
mov dword [0x46a04a], edx
mov dl, byte [0x45ca74]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov dword [0x46a04e], eax
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41b610
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov eax, dword [str.WORM.HRM.02112017.1]
mov ecx, dword [0x45d0f8]
mov edx, dword [0x45d0fc]
push 0x104
mov dword [0x46f738], eax
mov eax, dword [0x45d100]
mov dword [0x46f73c], ecx
mov ecx, dword [0x45d104]
push ebx
push 0x46f978
mov dword [0x46f740], edx
mov dword [0x46f744], eax
mov dword [0x46f748], ecx
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41b5e0
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41b5e0
cmp dword [0x470144], ebx
je 0x41b610
lea edx, [ebp - 0x102e4]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea eax, [ebp - 0x80c3]
push ebx
push eax
mov byte [ebp - 0x80c4], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x2aff]
push ebx
push ecx
mov byte [ebp - 0x2b00], bl
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41b650
mov cl, byte [ebp + eax - 0xee0]
mov byte [ebp + eax - 0x2b00], cl
inc eax
cmp cl, bl
jne 0x41b650
lea edx, [ebp - 0x2b00]
push edx
lea eax, [ebp - 0x80c4]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x80c4]
push ecx
lea edx, [ebp - 0x2b00]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41b6de
lea eax, [ebp - 0x80c4]
push eax
lea ecx, [ebp - 0x2b00]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41b6d1
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41b6de
lea edx, [ebp - 0x2b00]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 4]
push 1
push eax
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e9d0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [ebp - 0x10238], 0x1000
mov dword [ebp - 4], 0x44
jne 0x41bbda
cmp dword [ebp - 0x10230], 0x20
jne 0x41bbda
cmp dword [ebp - 0x1023c], 0x80
jne 0x41bbda
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41bbda
push str.0x1000
call fcn.004073f0
push 0x150
lea ecx, [ebp - 0x89c0]
push ebx
push ecx
mov dword [ebp - 0x1026c], ebx
call fcn.0042eb30
mov edi, dword [ebp - 0x10228]
mov ecx, dword [ebp - 0x10220]
add esp, 0x10
lea edx, [ebp - 0x1026c]
push edx
push 7
lea eax, [ebp - 0x4e0]
push eax
push edi
push ecx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x4dc], ebx
mov word [ebp - 0x4d8], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 0x4e0]
cmp edx, dword [ebp - 0xe0]
jne 0x41bbda
mov al, byte [ebp - 0xdc]
cmp al, byte [ebp - 0x4dc]
jne 0x41bbda
push str.match_5_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10220]
add esp, 4
lea ecx, [ebp - 0x1026c]
push ecx
push 0x150
lea edx, [ebp - 0x89c0]
push edx
add edi, 0xbb0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x89c0]
test ecx, ecx
je 0x41bbda
cmp dword [ebp - 0x1026c], 0x150
jne 0x41bbda
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x21
push 0x150
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x89c0]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41bbda
push str.match_33_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 4
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41bbda
push str.Sig_found_and_suspend_
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x963]
push ebx
push eax
mov byte [ebp - 0x964], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x964]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4HRM.02112017.2
push str.NPAV4HRM.02112017.2
lea eax, [ebp - 0x964]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0x103
lea ecx, [ebp - 0x7bb7]
push ebx
push ecx
mov byte [ebp - 0x7bb8], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x7bb8]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x7bb8]
push str.WORM.HRM.02112017.2
push edx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41ba25
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x7bb8]
mov edx, 0x469f12
jmp 0x41b9a0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41b9a0
mov eax, dword [str.WORM.HRM.02112017.2]
mov ecx, dword [0x45d0a4]
mov edx, dword [0x45d0a8]
mov dword [0x46a03e], eax
mov eax, dword [0x45d0ac]
mov dword [0x46a042], ecx
mov ecx, dword [0x45d0b0]
mov dword [0x46a046], edx
mov edx, dword [str.NPA4]
mov dword [0x46a04a], eax
mov al, byte [0x45ca74]
mov dword [0x46a04e], ecx
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov esi, dword [ebp - 0x10218]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41bad0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, dword [str.WORM.HRM.02112017.2]
mov edx, dword [0x45d0a4]
mov eax, dword [0x45d0a8]
push 0x104
mov dword [0x46f738], ecx
mov ecx, dword [0x45d0ac]
mov dword [0x46f73c], edx
mov edx, dword [0x45d0b0]
push ebx
push 0x46f978
mov dword [0x46f740], eax
mov dword [0x46f744], ecx
mov dword [0x46f748], edx
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41baa0
cmp dword [0x470144], ebx
je 0x41bad0
lea eax, [ebp - 0x102c0]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea ecx, [ebp - 0x606f]
push ebx
push ecx
mov byte [ebp - 0x6070], bl
call fcn.0042eb30
push 0xff
lea edx, [ebp - 0x2cff]
push ebx
push edx
mov byte [ebp - 0x2d00], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41bba5
lea edx, [ebp - 0x2d00]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41bb20
lea ecx, [ebp - 0x2d00]
push ecx
lea edx, [ebp - 0x6070]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0xc
push 1
lea eax, [ebp - 0x6070]
push eax
lea ecx, [ebp - 0x2d00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41bba5
lea edx, [ebp - 0x6070]
push edx
lea eax, [ebp - 0x2d00]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41bb98
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41bba5
lea ecx, [ebp - 0x2d00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esi + 4]
push 1
push edx
call fcn.00408550
call fcn.0040b2a0
push str.UmRdpService
call fcn.0040e9d0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
add esp, 4
cmp dword [ebp - 0x10238], 0x5000
mov dword [ebp - 4], 0x46
jne 0x41c092
cmp dword [ebp - 0x10230], 0x20
jne 0x41c092
cmp dword [ebp - 0x1023c], 0x80
jne 0x41c092
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41c092
push str.0x5000
call fcn.004073f0
push 0x150
lea eax, [ebp - 0x8468]
push ebx
push eax
mov dword [ebp - 0x10274], ebx
call fcn.0042eb30
mov edi, dword [ebp - 0x10228]
mov eax, dword [ebp - 0x10220]
add esp, 0x10
lea ecx, [ebp - 0x10274]
push ecx
push 9
lea edx, [ebp - 0x478]
push edx
push edi
push eax
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov word [ebp - 0x470], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x478]
cmp ecx, dword [ebp - 0x60]
jne 0x41c092
mov dl, byte [ebp - 0x5c]
cmp dl, byte [ebp - 0x474]
jne 0x41c092
mov al, byte [ebp - 0x5b]
cmp al, byte [ebp - 0x473]
jne 0x41c092
mov cl, byte [ebp - 0x5a]
cmp cl, byte [ebp - 0x472]
jne 0x41c092
push str.match_7_bytes
call fcn.004073f0
mov ecx, dword [ebp - 0x10220]
add esp, 4
lea edx, [ebp - 0x10274]
push edx
push 0x150
lea eax, [ebp - 0x8468]
push eax
add edi, 0x48b0
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x8468]
test edx, edx
je 0x41c092
cmp dword [ebp - 0x10274], 0x150
jne 0x41c092
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0xc
push 0x150
lea eax, [ebp - 0x1f8]
push eax
lea ecx, [ebp - 0x8468]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c092
push 9
push 0x150
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x845e]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c092
push 8
push 0x150
lea ecx, [ebp - 0x14c]
push ecx
lea edx, [ebp - 0x8458]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c092
push str.match_33_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41c092
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x9cb]
push ebx
push edx
mov byte [ebp - 0x9cc], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x9cc]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ZEPFOD.NPAV4.29112017.1
push str.NPAV4ZEPFOD.NPAV4.29112017.1
lea edx, [ebp - 0x9cc]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7dbb]
push ebx
push eax
mov byte [ebp - 0x7dbc], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7dbc]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x7dbc]
push str.WORM.ZEPFOD.NPAV4.29112017.1
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41bf1f
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x7dbc]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41bec6
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41bfa0
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.1
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41bf70
cmp dword [0x470144], ebx
je 0x41bfa0
lea ecx, [ebp - 0x10320]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x729b]
push ebx
push edx
mov byte [ebp - 0x729c], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x1237]
push ebx
push eax
mov byte [ebp - 0x1238], bl
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41c084
lea edx, [ebp - 0x1238]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41bff2
lea edx, [ebp - 0x1238]
push edx
lea eax, [ebp - 0x729c]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x729c]
push ecx
lea edx, [ebp - 0x1238]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c077
lea eax, [ebp - 0x729c]
push eax
lea ecx, [ebp - 0x1238]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41c06a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c077
lea edx, [ebp - 0x1238]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1238]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
cmp dword [ebp - 0x10238], 0x8000
mov dword [ebp - 4], 0x48
jne 0x41c553
cmp dword [ebp - 0x10230], 0x20
jne 0x41c553
cmp dword [ebp - 0x1023c], 0x80
jne 0x41c553
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41c553
push str.0x8000
call fcn.004073f0
push 0x150
lea edx, [ebp - 0x8318]
push ebx
push edx
mov dword [ebp - 0x10270], ebx
call fcn.0042eb30
mov edi, dword [ebp - 0x10228]
mov edx, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x10270]
push eax
push 9
lea ecx, [ebp - 0x484]
push ecx
push edi
push edx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
mov word [ebp - 0x47c], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x70]
jne 0x41c553
mov cl, byte [ebp - 0x6c]
cmp cl, byte [ebp - 0x480]
jne 0x41c553
mov dl, byte [ebp - 0x6b]
cmp dl, byte [ebp - 0x47f]
jne 0x41c553
mov al, byte [ebp - 0x6a]
cmp al, byte [ebp - 0x47e]
jne 0x41c553
push str.match_7_bytes
call fcn.004073f0
mov eax, dword [ebp - 0x10220]
add esp, 4
lea ecx, [ebp - 0x10270]
push ecx
push 0x150
lea edx, [ebp - 0x8318]
push edx
add edi, 0x7bc0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x8318]
test ecx, ecx
je 0x41c553
cmp dword [ebp - 0x10270], 0x150
jne 0x41c553
push str.read_successful_and_act_bytes
call fcn.004073f0
push 0x13
push 0x150
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x8318]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c553
push 0xc
push 0x150
lea ecx, [ebp - 0x1c8]
push ecx
lea edx, [ebp - 0x8305]
push edx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c553
push 7
push 0x150
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x82ff]
push ecx
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41c553
push str.match_33_bytes
call fcn.004073f0
mov edx, dword [ebp - 0x10224]
add esp, 4
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41c553
push str.Sig_found_and_suspend_
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0xa33]
push ebx
push edx
mov byte [ebp - 0xa34], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa34]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4ZEPFOD.NPAV4.29112017.2
push str.NPAV4ZEPFOD.NPAV4.29112017.2
lea edx, [ebp - 0xa34]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x50
push 0x103
lea eax, [ebp - 0x7fc3]
push ebx
push eax
mov byte [ebp - 0x7fc4], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x7fc4]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x7fc4]
push str.WORM.ZEPFOD.NPAV4.29112017.2
push ecx
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c3d9
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x7fc4]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c380
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470160], ebx
jne 0x41c460
push 0x104
push ebx
push 0x46f738
mov dword [0x470160], 1
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.ZEPFOD.NPAV4.29112017.2
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
jmp 0x41c430
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41c430
cmp dword [0x470144], ebx
je 0x41c460
lea ecx, [ebp - 0x102e8]
push ecx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
lea edx, [ebp - 0x6273]
push ebx
push edx
mov byte [ebp - 0x6274], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x1337]
push ebx
push eax
mov byte [ebp - 0x1338], bl
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41c545
lea edx, [ebp - 0x1338]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41c4b2
lea edx, [ebp - 0x1338]
push edx
lea eax, [ebp - 0x6274]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x6274]
push ecx
lea edx, [ebp - 0x1338]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c538
lea eax, [ebp - 0x6274]
push eax
lea ecx, [ebp - 0x1338]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41c52b
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c538
lea edx, [ebp - 0x1338]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1338]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
push 1
push ecx
call fcn.00408550
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10238], 0x3d000
mov esi, dword [ebp - 0x10218]
jb 0x41c9c4
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
jne 0x41c9c4
cmp dword [ebp - 0x1023c], eax
jne 0x41c9c4
push str.map_and_RWE
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x20000
jne 0x41cfc4
push str.0X3D000_0X3E000
call fcn.004073f0
push 0x1000
lea edx, [ebp - 0xf214]
push ebx
push edx
call fcn.0042eb30
mov edx, dword [ebp - 0x10228]
mov edi, dword [ebp - 0x10220]
add esp, 0x10
lea eax, [ebp - 0x1021c]
push eax
push 0x1000
lea ecx, [ebp - 0xf214]
push ecx
add edx, 0x3d30
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x1021c], 0x1000
jne 0x41c9c4
push str.read_successful_and_act_bytes
call fcn.004073f0
push 8
push 0x1000
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xf214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c9c4
mov edx, dword [ebp - 0x10224]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push str.match_8_bytes
call fcn.004073f0
push 0xc
push 0x1000
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xf214]
push ecx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41c9c4
push str.match_12_bytes
call fcn.004073f0
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
mov dword [ebp - 4], 0x4a
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x657]
push ebx
push eax
mov byte [ebp - 0x658], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x658]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4COMBO.NPAV4.21092018
push 0x45cfc8
lea eax, [ebp - 0x658]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x50
push 0xff
lea ecx, [ebp - 0x493f]
push ebx
push ecx
mov byte [ebp - 0x4940], bl
call fcn.0042eb30
push 0xff
lea edx, [ebp - 0x2eff]
push ebx
push edx
mov byte [ebp - 0x2f00], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
call fcn.0040e840
add esp, 0x1c
cmp eax, ebx
je 0x41c7d8
mov ecx, eax
lea edx, [ebp - 0x2f00]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c763
lea ecx, [ebp - 0x2f00]
push ecx
lea edx, [ebp - 0x4940]
push str._s.np4
push edx
call fcn.0042ecc6
add esp, 0xc
push 1
lea eax, [ebp - 0x4940]
push eax
lea ecx, [ebp - 0x2f00]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41c7d8
lea edx, [ebp - 0x4940]
push edx
lea eax, [ebp - 0x2f00]
push eax
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41c7cb
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41c7d8
lea ecx, [ebp - 0x2f00]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x103
lea edx, [ebp - 0x4433]
push ebx
push edx
mov byte [ebp - 0x4434], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x4434]
push str._s__d
push edx
call fcn.0042ecc6
lea eax, [ebp - 0x4434]
push str.WORM.COMBO.NPAV4.21092018
push eax
call fcn.0040a000
add esp, 0x24
cmp dword [0x46f734], ebx
je 0x41c8b0
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4434]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c853
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.COMBO.NPAV4.21092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
cmp dword [0x470154], ebx
jne 0x41c928
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, 0x45cf90
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41c900
cmp dword [0x470144], ebx
je 0x41c928
lea eax, [ebp - 0x102f0]
push eax
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
lea ecx, [ebp - 0x434]
mov esi, 1
push ecx
mov dword [0x470154], esi
mov dword [0x470164], esi
call fcn.0040ec20
mov eax, dword [0x470174]
add esp, 8
cmp eax, ebx
je 0x41c965
push 0xd3d
call eax
add esp, 4
push str.UmRdpService
call fcn.0040e9d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TermService
call fcn.0040e9d0
mov eax, dword [0x47017c]
add esp, 4
cmp eax, ebx
je 0x41c9bd
push 0x45cf90
push 0x45c58c
push 0x45c58c
lea edx, [ebp - 0x4940]
push edx
lea ecx, [ebp - 0x658]
push ecx
lea edx, [ebp - 0x4434]
push edx
push esi
call eax
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1022c], 0x20000
jne 0x41cfc4
cmp dword [ebp - 0x10238], 0x50000
jb 0x41cfc4
push str.RWE_AND_RW
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41cfc4
cmp dword [ebp - 0x1023c], 4
jne 0x41cfc4
push 0x1000
lea eax, [ebp - 0xccb4]
push ebx
push eax
mov byte [ebp - 0x10245], bl
call fcn.0042eb30
mov esi, dword [ebp - 0x10228]
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0xc
lea ecx, [ebp - 0x1021c]
push ecx
mov ecx, dword [ebp - 0x10220]
push 0x1000
lea edx, [ebp - 0xccb4]
push edx
lea eax, [esi + 0x58d00]
push eax
push ecx
call edi
jmp 0x41ca60
cmp dword [ebp - 0x1021c], 0x1000
jne 0x41cac1
push 7
push 0x1000
lea edx, [ebp - 0x12c]
push edx
lea eax, [ebp - 0xccb4]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
jne 0x41cac1
mov ecx, dword [ebp - 0x10224]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xc
push 0x1000
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0xccb4]
push eax
call fcn.00408390
add esp, 0x10
cmp eax, 1
je 0x41cb25
cmp byte [ebp - 0x10245], bl
jne 0x41cfc4
push 0x1000
lea ecx, [ebp - 0xccb4]
push ebx
push ecx
call fcn.0042eb30
add esp, 0xc
lea edx, [ebp - 0x1021c]
push edx
mov edx, dword [ebp - 0x10220]
push 0x1000
lea eax, [ebp - 0xccb4]
push eax
lea ecx, [esi + 0x51500]
push ecx
push edx
call edi
mov byte [ebp - 0x10245], 1
jmp 0x41ca60
mov eax, dword [ebp - 0x10224]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x41cfc4
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov eax, dword [esi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x4637]
push ebx
push ecx
mov byte [ebp - 0x4638], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4638]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x4638]
push edx
call fcn.004073f0
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x31
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0xa9b]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
mov byte [ebp - 0xa9c], bl
call fcn.0042eb30
add esp, 0x40
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0xa9c]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4MAYDAY.NPAV4.25082022
push str.NPAV4MAYDAY.NPAV4.25082022
lea edx, [ebp - 0xa9c]
push 0x45caa0
push edx
call fcn.00407310
lea eax, [ebp - 0x4638]
push str.WORM.MAYDAY.NPAV4.25082022
push eax
call fcn.0040a000
add esp, 0x34
cmp dword [0x46f734], ebx
je 0x41ccc5
push str.PFNADDENTRY_FOUND
call fcn.004073f0
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0x10
xor eax, eax
mov cl, byte [ebp + eax - 0x4638]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41cc60
mov dl, byte [0x45ca74]
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 6
mov esi, str.WORM.MAYDAY.NPAV4.25082022
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
movsw word es:[edi], word [esi]
push ebx
push 0x46f978
movsb byte es:[edi], byte [esi]
call fcn.0042eb30
add esp, 0x18
xor eax, eax
mov edi, edi
mov cl, byte [ebp + eax - 0x434]
mov byte [eax + 0x46f978], cl
inc eax
cmp cl, bl
jne 0x41cd00
push 0x103
lea eax, [ebp - 0x886f]
push ebx
push eax
mov byte [ebp - 0x8870], bl
call fcn.0042eb30
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x8870]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x8870]
push ecx
call fcn.004073f0
push 0x103
lea edx, [ebp - 0x81c7]
push ebx
push edx
mov byte [ebp - 0x81c8], bl
call fcn.0042eb30
push 0x103
lea eax, [ebp - 0x7ebf]
push ebx
push eax
mov byte [ebp - 0x7ec0], bl
call fcn.0042eb30
push 0x103
lea ecx, [ebp - 0x1137]
push ebx
push ecx
mov byte [ebp - 0x1138], bl
call fcn.0042eb30
add esp, 0x44
push 0x103
lea edx, [ebp - 0x3203]
push ebx
push edx
mov byte [ebp - 0x3204], bl
call fcn.0042eb30
mov eax, dword [esi + 4]
push eax
call fcn.0040e840
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x41cf87
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x41cf94
lea edx, [ebp - 0x81c8]
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x41cdf0
lea ecx, [ebp - 0x81c8]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x1138]
push edx
call fcn.004075a0
lea eax, [ebp - 0x1138]
push str.ZVSCAN
push eax
call fcn.0042f090
lea eax, [ebp - 0x1138]
add esp, 0x10
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x41ce30
mov ecx, dword [str.ECLNR.EXE]
mov edx, dword [0x45cf30]
mov dword [eax], ecx
mov cx, word [0x45cf34]
mov dword [eax + 4], edx
mov dl, byte [0x45cf36]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [ebp - 0x1138]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x81c8]
push ecx
lea edx, [ebp - 0x1138]
push edx
push str._s__F___s_
lea eax, [ebp - 0x7ec0]
push 0x104
push eax
call fcn.0042ed5f
lea ecx, [ebp - 0x7ec0]
push ecx
call fcn.004073f0
lea edx, [ebp - 0x7ec0]
push edx
call fcn.00408230
mov eax, dword [0x470008]
add esp, 0x20
or eax, dword [0x47000c]
jne 0x41cef2
lea ecx, [ebp - 0x1138]
push ecx
push str._s__A
lea edx, [ebp - 0x3204]
push 0x104
push edx
call fcn.0042ed5f
lea eax, [ebp - 0x3204]
push eax
call fcn.004073f0
lea ecx, [ebp - 0x3204]
push ecx
call fcn.00408230
add esp, 0x18
jmp 0x41cf74
call fcn.00430940
cdq
mov dword [0x470010], eax
sub eax, dword [0x470008]
push ebx
mov dword [0x470014], edx
sbb edx, dword [0x47000c]
push 0x3e8
push edx
push eax
call fcn.00430ab0
push ebx
push 0x3c
push edx
push eax
call fcn.00430ab0
push ebx
push 0x3c
push edx
push eax
call fcn.00430ab0
mov dword [0x470000], eax
mov dword [0x470004], edx
cmp eax, 3
jne 0x41cf94
cmp edx, ebx
jne 0x41cf94
lea edx, [ebp - 0x1138]
push edx
push str._s__A
lea eax, [ebp - 0x3204]
push 0x104
push eax
call fcn.0042ed5f
lea ecx, [ebp - 0x3204]
push ecx
call fcn.00408230
add esp, 0x14
call fcn.00430940
cdq
mov dword [0x470008], eax
mov dword [0x47000c], edx
jmp 0x41cf94
push str.PATH_NOT_FOUND_FOUND
call fcn.004073f0
add esp, 4
cmp dword [0x470160], ebx
jne 0x41cfc4
mov dword [0x470160], 1
cmp dword [0x470144], ebx
je 0x41cfc4
lea edx, [ebp - 0x10314]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x10238]
add eax, 0xfffe2000
cmp eax, 0xa000
ja 0x41d76e
push str.mbi_._RegionSize__0Xgenric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10230], 0x40
jne 0x41d76e
cmp dword [ebp - 0x1023c], 0x80
jne 0x41d76e
push str.IMAG_and_EWC_genric
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x1022c], 0x1000000
jne 0x41d76e
push str.mbi_._Type__MEM_IMAGE_genric
call fcn.004073f0
push str.match_KRAB_One_sig
call fcn.004073f0
mov edi, 0x64
push edi
lea ecx, [ebp - 0x1400]
push ebx
push ecx
mov dword [ebp - 0x1021c], ebx
call fcn.0042eb30
mov ecx, dword [ebp - 0x10220]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add esp, 0x14
lea edx, [ebp - 0x1021c]
push edx
push edi
lea eax, [ebp - 0x1400]
push eax
push 0x40e530
push ecx
call esi
cmp dword [ebp - 0x1021c], edi
jne 0x41d76e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xc
push edi
lea edx, [ebp - 0x1d4]
push edx
lea eax, [ebp - 0x1400]
push eax
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d3be
push str.match_12_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov ecx, dword [ebp - 0x10224]
add esp, 8
push ecx
mov dword [ebp - 4], 0x4c
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x10218]
mov edx, dword [esi + 4]
mov eax, dword [0x46ff94]
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x104
mov dword [0x46ff94], eax
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
push 0x31
lea eax, [ebp - 0x6bf]
push ebx
push eax
mov byte [ebp - 0x6c0], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x6c0]
push str.NPAV4_s
push edx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea eax, [ebp - 0x6c0]
push 0x45caa0
push eax
call fcn.00407310
add esp, 0x4c
push 0x103
lea ecx, [ebp - 0x483f]
push ebx
push ecx
mov byte [ebp - 0x4840], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x4840]
push str._s__d
push ecx
call fcn.0042ecc6
lea edx, [ebp - 0x4840]
push str.WORM.SAVEFILES.NPAV4.26092018
push edx
call fcn.0040a000
push 0xff
lea eax, [ebp - 0x3b17]
push ebx
push eax
mov byte [ebp - 0x3b18], bl
call fcn.0042eb30
push 0xff
lea ecx, [ebp - 0x30ff]
push ebx
push ecx
mov byte [ebp - 0x3100], bl
call fcn.0042eb30
mov edx, dword [esi + 4]
push edx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x41d277
lea edx, [ebp - 0x3100]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d202
lea eax, [ebp - 0x3100]
push eax
lea ecx, [ebp - 0x3b18]
push str._s.np4
push ecx
call fcn.0042ecc6
add esp, 0xc
push 1
lea edx, [ebp - 0x3b18]
push edx
lea eax, [ebp - 0x3100]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d277
lea ecx, [ebp - 0x3b18]
push ecx
lea edx, [ebp - 0x3100]
push edx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41d26a
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d277
lea eax, [ebp - 0x3100]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x10220]
push 9
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d30a
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4840]
mov edx, 0x469f12
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d2b0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d33e
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x3b18]
push ecx
lea edx, [ebp - 0x6c0]
push edx
lea ecx, [ebp - 0x4840]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d738
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
jmp 0x41d390
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d390
cmp dword [0x470144], ebx
je 0x41d738
lea edx, [ebp - 0x102d4]
jmp 0x41d728
push edi
lea eax, [ebp - 0x139c]
push ebx
push eax
call fcn.0042eb30
mov eax, dword [ebp - 0x10220]
add esp, 0xc
lea ecx, [ebp - 0x1021c]
push ecx
push edi
lea edx, [ebp - 0x139c]
push edx
push 0x40f3b5
push eax
call esi
cmp dword [ebp - 0x1021c], edi
jne 0x41d76e
push str.read_successful_and_act_bytes_dwActualReadBytes__100
call fcn.004073f0
push 0xb
push edi
lea ecx, [ebp - 0x1b0]
push ecx
lea edx, [ebp - 0x139c]
push edx
call fcn.00408390
add esp, 0x14
cmp eax, 1
jne 0x41d76e
push str.match_11_bytes
call fcn.004073f0
push str.match_SAVEFILES_main_sig
call fcn.004073f0
mov eax, dword [ebp - 0x10224]
add esp, 8
push eax
mov dword [ebp - 4], 0x4e
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, dword [ebp - 0x10218]
mov ecx, dword [esi + 4]
mov eax, dword [0x46ff94]
push 0x104
mov dword [eax*4 + 0x4693b8], ecx
lea edx, [ebp - 0x434]
inc eax
push ebx
push edx
mov dword [0x46ff94], eax
call fcn.0042eb30
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x434]
push eax
push ecx
call fcn.00408710
push 0x31
lea edx, [ebp - 0x727]
push ebx
push edx
mov byte [ebp - 0x728], bl
call fcn.0042eb30
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x728]
push str.NPAV4_s
push ecx
call fcn.0042ecc6
push 0x45cac0
push 0x45cac0
push 0x45cac0
push 0x45cac0
push str.NPAV4SAVEFILES.NPAV4.26092018
push str.NPAV4SAVEFILES.NPAV4.26092018
lea edx, [ebp - 0x728]
push 0x45caa0
push edx
call fcn.00407310
add esp, 0x4c
push 0x103
lea eax, [ebp - 0x4a43]
push ebx
push eax
mov byte [ebp - 0x4a44], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x4a44]
push str._s__d
push eax
call fcn.0042ecc6
lea ecx, [ebp - 0x4a44]
push str.WORM.SAVEFILES.NPAV4.26092018
push ecx
call fcn.0040a000
push 0xff
lea edx, [ebp - 0x432f]
push ebx
push edx
mov byte [ebp - 0x4330], bl
call fcn.0042eb30
push 0xff
lea eax, [ebp - 0x17ff]
push ebx
push eax
mov byte [ebp - 0x1800], bl
call fcn.0042eb30
mov ecx, dword [esi + 4]
push ecx
call fcn.0040e840
add esp, 0x40
cmp eax, ebx
je 0x41d5f5
lea edx, [ebp - 0x1800]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
cmp cl, bl
jne 0x41d580
lea edx, [ebp - 0x1800]
push edx
lea eax, [ebp - 0x4330]
push str._s.np4
push eax
call fcn.0042ecc6
add esp, 0xc
push 1
lea ecx, [ebp - 0x4330]
push ecx
lea edx, [ebp - 0x1800]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x41d5f5
lea eax, [ebp - 0x4330]
push eax
lea ecx, [ebp - 0x1800]
push ecx
call fcn.0043090d
add esp, 8
test eax, eax
jne 0x41d5e8
push str.Rename_process_sucessfully_
call fcn.004073f0
add esp, 4
jmp 0x41d5f5
lea edx, [ebp - 0x1800]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x10220]
push 9
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x46f734], ebx
je 0x41d68c
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
lea ecx, [ebp - 0x4a44]
mov edx, 0x469f12
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d630
mov dl, byte [0x45ca74]
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [str.NPA4]
movsw word es:[edi], word [esi]
mov dword [0x46a0a3], ecx
sub esp, 0x1e0
mov byte [0x46a0a7], dl
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
add esp, 0x1e0
mov eax, dword [0x47017c]
cmp eax, ebx
je 0x41d6c0
push str.WORM.SAVEFILES.NPAV4.26092018
push 0x45c58c
push 0x45c58c
lea ecx, [ebp - 0x4330]
push ecx
lea edx, [ebp - 0x728]
push edx
lea ecx, [ebp - 0x4a44]
push ecx
push 1
call eax
add esp, 0x1c
cmp dword [0x470154], ebx
jne 0x41d738
push 0x104
push ebx
push 0x46f738
call fcn.0042eb30
mov ecx, 7
mov esi, str.WORM.SAVEFILES.NPAV4.26092018
mov edi, 0x46f738
rep movsd dword es:[edi], dword [esi]
push 0x104
push ebx
push 0x46f978
movsw word es:[edi], word [esi]
call fcn.0042eb30
add esp, 0x18
lea ecx, [ebp - 0x434]
mov edx, 0x46f978
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x41d710
cmp dword [0x470144], ebx
je 0x41d738
lea edx, [ebp - 0x102ec]
push edx
push ebx
push ebx
push 0x40e800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.Sig_found_and_Terminate_
call fcn.004073f0
mov eax, 1
mov dword [0x470154], eax
mov dword [0x470164], eax
mov eax, dword [0x470174]
add esp, 4
cmp eax, ebx
je 0x41d767
push 0xd3d
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1022c]
cmp eax, 0x20000
je 0x41d786
cmp eax, 0x40000
jne 0x41db73
push str.PAGE_EXECUTE_READ
call fcn.004073f0
add esp, 4
cmp dword [ebp - 0x10238], 0x10000
jb 0x41db73
push str.mbi_._MEM_PRIVATE
call fcn.004073f0
mov eax, 0x40
add esp, 4
cmp dword [ebp - 0x10230], eax
jne 0x41db73
cmp dword [ebp - 0x1023c], eax
jne 0x41db73
push str.greater_than_0X10000
call fcn.004073f0
push 0x104
lea eax, [ebp - 0x434]
push ebx
push eax
call fcn.0042eb30
mov edi, dword [ebp - 0x10218]
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x434]
push ecx
push edx
call fcn.00408710
lea eax, [ebp - 0x434]
add esp, 0x18
lea edx, [eax + 1]
jmp 0x41d810
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41d810
sub eax, edx
je 0x41db79
push str.checking_len
call fcn.004073f0
push 0x7ff
lea eax, [ebp - 0xd4b3]
push ebx
push eax
mov byte [ebp - 0xd4b4], bl
call fcn.0042eb30
push 0x7ff
lea ecx, [ebp - 0xb7b3]
push ebx
push ecx
mov byte [ebp - 0xb7b4], bl
call fcn.0042eb30
push 0x7ff
lea edx, [ebp - 0xa3b3]
push ebx
push edx
mov byte [ebp - 0xa3b4], bl
call fcn.0042eb30
mov eax, dword [edi + 4]
add esp, 0x28
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x41d8b7
push str.inside__hProcess
call fcn.004073f0
lea ecx, [ebp - 0xd4b4]
push ecx
push esi
call fcn.0040f9a0
add esp, 0xc
push 0x200
lea edx, [ebp - 0xa3b4]
push edx
push ebx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0xd4b4]
push eax
lea ecx, [ebp - 0xb7b4]
push 0x800
push ecx
call fcn.004308a5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x18], bx
mov edx, dword [edi + 4]
push edx
lea eax, [ebp - 0x20]
push str.pid_d
push eax
call fcn.0042ecc6
push 0x104
lea ecx, [ebp - 0x434]
push ebx
push ecx
mov dword [0x470164], 1
call fcn.0042eb30
mov eax, dword [edi + 4]
lea edx, [ebp - 0x434]
push edx
push eax
call fcn.00408710
push 0x103
lea ecx, [ebp - 0x350b]
push ebx
push ecx
mov byte [ebp - 0x350c], bl
call fcn.0042eb30
mov edx, dword [edi + 4]
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x350c]
push str._s__d
push ecx
call fcn.0042ecc6
mov edx, dword [edi + 4]
mov eax, dword [0x46ff94]
add esp, 0x48
mov dword [eax*4 + 0x4693b8], edx
inc eax
push 0x31
mov dword [0x46ff94], eax
lea eax, [ebp - 0xda7]
push ebx
push eax
mov byte [ebp - 0xda8], bl
call fcn.0042eb30
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0xda8]
push str.NPAV4_s
push edx
call fcn.0042ecc6
add esp, 0x18
cmp dword [0x470158], ebx
jne 0x41db79
push 0x103
lea eax, [ebp - 0x866b]
push ebx
push eax
mov byte [ebp - 0x866c], bl
call fcn.0042eb30
push str.FILE_NOT_IN_GOOD_RMD5
call fcn.004073f0
lea ecx, [ebp - 0xa3b4]
push ecx
call dword [0x470184]
mov esi, eax
push esi
lea edx, [ebp - 0xa3b4]
push edx
lea eax, [ebp - 0x866c]
push str.__s__d
push eax
call fcn.0040dcc0
lea ecx, [ebp - 0x866c]
push ecx
call fcn.004073f0
add esp, 0x28
cmp esi, ebx
jne 0x41db64
push str.FILE_NOT_IN_GETDSRWITHSTATUS
call fcn.004073f0
push 0x63
lea edx, [ebp - 0xf43]
push ebx
push edx
mov byte [ebp - 0xf44], bl
call fcn.0042eb30
mov eax, dword [ebp - 0x10238]
push eax
lea ecx, [ebp - 0xf44]
push str.REGIONSIZE__0x_X
push ecx
call fcn.0040dce0
mov eax, dword [0x47017c]
add esp, 0x1c
cmp eax, ebx
je 0x41dac6
mov ecx, dword [ebp - 0x1022c]
cmp ecx, 0x20000
jne 0x41da91
push str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
lea edx, [ebp - 0xb7b4]
push edx
lea ecx, [ebp - 0xa3b4]
push ecx
lea edx, [ebp - 0x350c]
push edx
lea ecx, [ebp - 0xf44]
push ecx
push str.THREAD_TYPE__MEM_PRIVATE
jmp 0x41dabf
cmp ecx, 0x40000
jne 0x41dac6
push str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
lea edx, [ebp - 0xb7b4]
push edx
lea ecx, [ebp - 0xa3b4]
push ecx
lea edx, [ebp - 0x350c]
push edx
lea ecx, [ebp - 0xf44]
push ecx
push str.THREAD_TYPE__MEM_MAPPED
push 1
call eax
add esp, 0x1c
cmp dword [0x46f734], ebx
je 0x41db58
push 0x1e0
push ebx
push 0x469f00
call fcn.0042eb30
add esp, 0xc
xor eax, eax
jmp 0x41daf0
mov cl, byte [ebp + eax - 0x350c]
mov byte [eax + 0x469f12], cl
inc eax
cmp cl, bl
jne 0x41daf0
mov edx, dword [str.NPA4]
mov al, byte [0x45ca74]
mov ecx, 9
mov esi, str.AUD.PURE_ORANGE_THREAD.NPAV4.12042024
mov edi, 0x46a03e
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 0x1e0
mov dword [0x46a0a3], edx
mov byte [0x46a0a7], al
mov byte [0x46a0a2], 3
mov ecx, 0x78
mov esi, 0x469f00
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call dword [0x46f734]
mov edi, dword [ebp - 0x10218]
add esp, 0x1e0
mov dword [0x470158], 1
jmp 0x41db79
push str.FILE__FOUND_IN_GOOD_DATABASE
call fcn.004073f0
add esp, 4
jmp 0x41db79
mov edi, dword [ebp - 0x10218]
cmp dword [0x470164], ebx
jne 0x41dcb8
mov eax, 0x40
cmp dword [ebp - 0x10230], eax
je 0x41db9e
cmp dword [ebp - 0x1023c], eax
jne 0x41dcb8
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x41dcb8
cmp eax, 4
je 0x41dcb8
cmp dword [0x467218], eax
je 0x41dcb8
cmp dword [0x46721c], eax
je 0x41dcb8
cmp dword [0x467220], eax
je 0x41dcb8
cmp dword [0x467224], eax
je 0x41dcb8
cmp dword [0x470140], 1
jne 0x41dcb8
cmp dword [0x47012c], ebx
jne 0x41dcb8
mov eax, dword [ebp - 0x10228]
mov esi, dword [ebp - 0x10220]
lea ecx, [ebp - 0x1021c]
push ecx
push 0xa
lea edx, [ebp - 0x504]
push edx
push eax
push esi
mov dword [ebp - 0x504], ebx
mov dword [ebp - 0x500], ebx
mov word [ebp - 0x4fc], bx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 0x504], bl
je 0x41dcbe
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x564], ebx
mov word [ebp - 0x560], bx
mov ecx, dword [edi + 4]
push ecx
lea edx, [ebp - 0x57c]
push str.pid__d_
push edx
call fcn.0042ecc6
push str.Orange_thread_found_in_process__n
call fcn.004073f0
lea eax, [ebp - 0x57c]
push eax
call fcn.004073f0
push str.Calling_td.exe...
call fcn.004073f0
add esp, 0x18
call fcn.00408150
mov dword [0x47012c], 1
jmp 0x41dcbe
mov esi, dword [ebp - 0x10220]
mov eax, dword [ebp - 0x10224]
cmp eax, ebx
je 0x41dccf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x41dcda
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1029c]
jmp 0x41dceb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042eb15
mov esp, ebp
pop ebp
ret