Function at 0x404240
Capabilities:
Access peb ldr_data
Delete file
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x46f8f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x548
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 1
mov dword [esp + 0x564], 0
call fcn.00463d8c
mov edi, eax
mov eax, dword [0x48fb24]
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x560], 2
push eax
call fcn.00461c3d
mov ecx, dword [eax]
push 0
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x3c]
call fcn.00461c50
mov edx, dword [eax + 0xc]
push 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], edx
call fcn.00461c50
mov ebp, dword [eax + 0x10]
push 0
lea ecx, [esp + 0x3c]
inc ebp
call fcn.00461c50
mov ebx, dword [eax + 0x14]
push 0
lea ecx, [esp + 0x3c]
add ebx, 0x76c
call fcn.00461c50
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], eax
call fcn.00461c50
mov ecx, dword [eax + 4]
push 0
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x3c]
call fcn.00461c50
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0x64]
push eax
push ebp
push ebx
mov dword [esp + 0x30], edx
push str.HistoryHistory_
push ecx
lea edx, [esp + 0x28]
push str._s_s_4d_02d_02d.hty
push edx
call fcn.00461a66
add esp, 0x1c
lea ecx, [esp + 0x3c]
call fcn.00443f37
mov eax, dword [esp + 0x568]
push 0x48b2bc
push eax
mov byte [esp + 0x568], 3
call fcn.0044bf3e
add esp, 8
test eax, eax
jne 0x40466f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
push ebp
push ebx
lea edx, [esp + 0x28]
push str._4d____02d____02d__02d:_02d:_02d___Application_Normally_Open__MultiDataLog___r_n
push edx
call fcn.00461a66
add esp, 0x1c
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x56c], 4
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404eb0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push str.11:27:05
push str.Oct_11_2022
push 0x491f08
push 0x81
push 2
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
push ebp
push ebx
lea edx, [esp + 0x3c]
push str._4d____02d____02d__02d:_02d:_02d_ExtFTP_V_d._02x_s____s__s____r_n
push edx
call fcn.00461a66
add esp, 0x30
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x56c], 5
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [0x491f50]
push 0x48b7d0
push ecx
call fcn.0044c25e
mov ebp, eax
lea edx, [esp + 0x160]
push ebp
push 0x400
push edx
call fcn.0044c17c
add esp, 0x14
test eax, eax
je 0x404540
mov bl, 6
lea eax, [esp + 0x158]
lea ecx, [esp + 0x10]
push eax
push 0x48b480
push ecx
call fcn.00461a66
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00461b07
lea ecx, [esp + 0x10]
call fcn.00461abb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push str._s__r_n
push eax
call fcn.00461a66
add esp, 8
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0046260d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x56c], bl
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
push ebp
lea eax, [esp + 0x15c]
push 0x400
push eax
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x404490
push ebp
call fcn.0044c12b
mov ecx, dword [0x48fb24]
mov dword [esp + 0x24], ecx
lea edx, [esp + 0x24]
mov bl, 7
push str.wevtutil.exe_qe_System__c:3__rd:true__f:text__q:__System__EventID41_______EventLog41.txt
push edx
mov byte [esp + 0x56c], bl
call fcn.00461a66
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
push str.EventLog41.txt
call ebp
mov eax, dword [esp + 0x20]
push eax
call fcn.0044c03d
push 0x48b7d0
push str.EventLog41.txt
call fcn.0044c25e
mov esi, eax
lea ecx, [esp + 0x164]
push esi
push 0x400
push ecx
call fcn.0044c17c
add esp, 0x18
test eax, eax
je 0x404649
lea edx, [esp + 0x158]
lea eax, [esp + 0x10]
push edx
push 0x48b480
push eax
call fcn.00461a66
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00461b07
lea ecx, [esp + 0x10]
call fcn.00461abb
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
push str._s__r_n
push edx
call fcn.00461a66
add esp, 8
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x56c], 8
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], bl
call fcn.00404dd0
push esi
lea eax, [esp + 0x15c]
push 0x400
push eax
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x4045b1
push esi
call fcn.0044c12b
add esp, 4
push str.EventLog41.txt
call ebp
lea ecx, [esp + 0x20]
mov byte [esp + 0x560], 3
call fcn.00462898
jmp 0x404d5b
mov ecx, dword [esp + 0x568]
push str.CLOSE
push ecx
call fcn.0044bf3e
add esp, 8
test eax, eax
jne 0x404728
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push ebp
push ebx
lea eax, [esp + 0x28]
push str._4d____02d____02d__02d:_02d:_02d___Application_Normally_Close__MultiDataLog___r_n
push eax
call fcn.00461a66
mov ecx, dword [esp + 0x34]
add esp, 0x20
push 0
push ecx
lea ecx, [esp + 0x44]
call fcn.00443ffa
push ecx
test eax, eax
mov ecx, esp
jne 0x404706
lea edx, [esp + 0x14]
mov dword [esp + 0x1c], esp
push edx
call fcn.0046260d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x56c], 9
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404eb0
jmp 0x404d5b
lea edx, [esp + 0x14]
mov dword [esp + 0x1c], esp
push edx
call fcn.0046260d
push ecx
mov byte [esp + 0x568], 0xa
mov ecx, esp
mov dword [esp + 0x28], esp
jmp 0x404d42
mov ecx, dword [esp + 0x568]
push str.LOAD
push ecx
call fcn.0044bf3e
add esp, 8
test eax, eax
jne 0x404abf
mov edx, dword [esp + 0x14]
push 0x48b7d0
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], eax
call fcn.0044c25e
mov dword [esp + 0x28], eax
push eax
lea eax, [esp + 0x64]
push 0xff
push eax
call fcn.0044c17c
add esp, 0x14
test eax, eax
je 0x40479b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x5c]
inc eax
push 0xff
push edx
mov dword [esp + 0x38], eax
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x404777
mov eax, dword [esp + 0x20]
push eax
call fcn.0044c12b
mov ecx, dword [esp + 0x30]
mov eax, 0x3e8
add esp, 4
cmp ecx, eax
jl 0x4047bd
sub ecx, eax
mov dword [esp + 0x2c], ecx
jmp 0x4047c5
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x14]
push 0x48b7d0
push ecx
call fcn.0044c25e
push eax
lea edx, [esp + 0x64]
push 0xff
push edx
mov dword [esp + 0x34], eax
call fcn.0044c17c
add esp, 0x14
test eax, eax
je 0x40487a
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jle 0x40485b
lea eax, [esp + 0x58]
lea ecx, [esp + 0x10]
push eax
push 0x48b480
push ecx
call fcn.00461a66
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00461b07
lea ecx, [esp + 0x10]
call fcn.00461abb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push str._s__r_n
push eax
call fcn.00461a66
add esp, 8
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x58]
push eax
push 0xff
push ecx
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x4047f3
mov edx, dword [esp + 0x20]
push edx
call fcn.0044c12b
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edx
push eax
push ebp
push ebx
lea ecx, [esp + 0x2c]
push str._4d____02d____02d__02d:_02d:_02d___Application_Normally_Open__MultiDataLog___r_n
push ecx
call fcn.00461a66
mov edx, dword [esp + 0x38]
add esp, 0x24
lea ecx, [esp + 0x3c]
push 0
push edx
call fcn.00443ffa
push ecx
test eax, eax
mov ecx, esp
jne 0x4048fb
lea eax, [esp + 0x14]
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x56c], 0xb
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404eb0
jmp 0x404931
lea eax, [esp + 0x14]
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x56c], 0xc
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push str.11:27:05
push str.Oct_11_2022
push 0x491f08
push 0x81
push 2
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
push ebp
push ebx
lea edx, [esp + 0x3c]
push str._4d____02d____02d__02d:_02d:_02d_ExtFTP_V_d._02x_s____s__s____r_n
push edx
call fcn.00461a66
add esp, 0x30
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x56c], 0xd
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [0x491f50]
push 0x48b7d0
push ecx
call fcn.0044c25e
mov ebp, eax
lea edx, [esp + 0x60]
push ebp
push 0x400
push edx
call fcn.0044c17c
add esp, 0x14
test eax, eax
je 0x404ab1
mov bl, 0xe
lea eax, [esp + 0x58]
lea ecx, [esp + 0x10]
push eax
push 0x48b480
push ecx
call fcn.00461a66
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00461b07
lea ecx, [esp + 0x10]
call fcn.00461abb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push str._s__r_n
push eax
call fcn.00461a66
add esp, 8
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x56c], bl
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
push ebp
lea eax, [esp + 0x5c]
push 0x400
push eax
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x404a07
push ebp
call fcn.0044c12b
add esp, 4
jmp 0x404d5b
mov ecx, dword [esp + 0x568]
lea edx, [esp + 0x10]
push ecx
push str._s__r_n
push edx
call fcn.00461a66
mov eax, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x3c]
push 0
push eax
call fcn.00443ffa
push ecx
test eax, eax
mov ecx, esp
jne 0x404d25
lea edx, [esp + 0x14]
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x56c], 0xf
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404eb0
mov ecx, esi
call fcn.00404210
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
push ebp
push ebx
lea edx, [esp + 0x28]
push str._4d____02d____02d__02d:_02d:_02d___New_File___r_n
push edx
call fcn.00461a66
add esp, 0x1c
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x56c], 0x10
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push str.11:27:05
push str.Oct_11_2022
push 0x491f08
push 0x81
push 2
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
push ebp
push ebx
lea edx, [esp + 0x3c]
push str._4d____02d____02d__02d:_02d:_02d_ExtFTP_V_d._02x_s____s__s____r_n
push edx
call fcn.00461a66
add esp, 0x30
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x56c], 0x11
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
mov ecx, dword [0x491f50]
push 0x48b7d0
push ecx
call fcn.0044c25e
mov ebp, eax
lea edx, [esp + 0x160]
push ebp
push 0x400
push edx
call fcn.0044c17c
add esp, 0x14
test eax, eax
je 0x404d1a
mov bl, 0x12
lea eax, [esp + 0x158]
lea ecx, [esp + 0x10]
push eax
push 0x48b480
push ecx
call fcn.00461a66
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00461b07
lea ecx, [esp + 0x10]
call fcn.00461abb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push edx
push str._s__r_n
push eax
call fcn.00461a66
add esp, 8
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x56c], bl
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
mov ecx, esi
call fcn.004040f0
push ebp
lea eax, [esp + 0x15c]
push 0x400
push eax
call fcn.0044c17c
add esp, 0xc
test eax, eax
jne 0x404c6a
push ebp
call fcn.0044c12b
add esp, 4
jmp 0x404d5b
lea edx, [esp + 0x14]
mov dword [esp + 0x20], esp
push edx
call fcn.0046260d
push ecx
mov byte [esp + 0x568], 0x13
mov ecx, esp
mov dword [esp + 0x20], esp
lea eax, [esp + 0x1c]
push eax
call fcn.0046260d
mov ecx, edi
mov byte [esp + 0x568], 3
call fcn.00404dd0
push edi
call fcn.00463db5
add esp, 4
lea ecx, [esp + 0x3c]
mov byte [esp + 0x560], 2
call fcn.00443f74
lea ecx, [esp + 0x10]
mov byte [esp + 0x560], 1
call fcn.00462898
lea ecx, [esp + 0x14]
mov byte [esp + 0x560], 0
call fcn.00462898
lea ecx, [esp + 0x568]
mov dword [esp + 0x560], 0xffffffff
call fcn.00462898
mov ecx, dword [esp + 0x558]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x554
ret 4