MD5 C95772694EA68F394DAA4AC144BD40FB
start
- call ds:InitCommonControls [ initialized common controls in windows ]
- call ds:SetErrorMode (8001h) [ send critical errors to calling process, no prompt if error]
- call ds:OleInitialize [initialize COM (component model object) library ]
- call sub_xxxxx1
-- call ds:GetModuleHandleA [ gets handle to the KERNEL32.DLL ]
-- call ds:LoadLibraryA [ loads KERNEL32.DLL into memory ]
-- call ds:GetProcessAddress [ gets the address of GetDiskFreeSpaceExW method, dynamically loaded, it is not in the import table ]
- call ds:SHGetFileInfoW [ gets info like file name, attribute, ioc of file ]
- call sub_xxxxx2
-- call ds:lstrcpynW [ makes a copy of the NSIS error message string ]
- call ds:CommandLineW [ gets the command line string for this process ]
- call sub_xxxxx2
-- call ds:lstrcpynW [ makes a copy of the command line string ]
- call ds:GetModuleHandleW [ gets a handle to the file of this current process ]
- call sub_xxxxx3 [ arguments are Quote(") and the Command Line String ]
-- while character is not a Quote(")
-- call ds:CharNextW [] to move to the next character in Command line String
- call ds:CharNextW [move past the Quote(") that was just found]
- while character is not a Space (0x20)
-- inc eax [ move to the next letter in the command line string]
- inc eax (past Quote(" , 0x22))
- find the flag ("/S" , 0x2f53)
- find the flag ("/NCRC", 0x2f4E435243) (note: in assembly listed CNCR (reversed)
- call sub_xxxxx2
-- call ds:lstrcpynW [ makes a copy of the command line string ]
- call ds:GetTempPathW [ gets path of temp folder ]
- call ds:GetWindowsDirectoryW [ gets path of windows folder ]
- call lstrcatW [ append "Temp" to the folder so c:\windows\temp ]
- call sub_xxxxx4
-- call sub_xxxxx5 [ did not finish ]
-- call sub_xxxxx6 [ did not finish ]
-- call sub_xxxxx7 [ did not finish ]
-- call ds:CreateDirectoryW
-- call sub_xxxxx8 [ did not finish ]
- call ds:GetTempPathW [ gets path of temp folder ]
- call lstrcatW [ append the word "Low" to the temp folder ]
note: changes it from C:\Users\x\AppData\Local to C:\Users\x\AppData\LocalLow
- call ds:SetEnvironmentVariableW [ set T to the temp folder ]
- call ds:SetEnvironmentVariableW [ set TMP to the temp folder ]
- call ds:DeleteFileW [ ]
- ... much more ...
- call lstrcatW [ append "~nsu.tmp" to the temp folder path ]
- ... more ...
- call ds:CreateDirectoryW [ create a new temp folder ]
- call ds:SetCurrentDirectoryW [ move to the newly created folder ]
- call sub_xxxxx2
- call lstrcatW [ append "~nsu.tmp" to the temp folder path ]
- ... more ...
- call ds:CreateDirectoryW [ create a new temp folder ]
- call ds:SetCurrentDirectoryW [ move to the newly created folder ]
- call sub_xxxxx2
- call sub_xxxxx2
- call sub_xxxxx9 [works on CurrentVersion registry and Quick Launch registry]
- call ds:DeleteFileW
- call ds:CopyFileW
- call sub_xxxxx9 [works on CurrentVersion registry and Quick Launch registry]
- call sub_xxxxx10
-- call ds:CreateProcess
-- call ds:CloseHandle
- call ds:CloseHandle
- ... more ...
- call ds:DeleteFileW
- call ds:CopyFileW
- call sub_xxxxx9 [works on CurrentVersion registry and Quick Launch registry]
- call sub_xxxxx10
-- call ds:CreateProcess
-- call ds:CloseHandle
- call ds:CloseHandle
- ... more ...