Function at 0x4ffaf0
Capabilities:
Create process on windows
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1634
call fcn.0056af00
mov eax, dword [0x5c4008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x70ac6d
call fcn.0056b0a5
push 0x6e5798
push str._s_exception.dmp
lea eax, [ebp - 0xcc0]
push 0x3e8
push eax
call fcn.004dc4f0
lea eax, [ebp - 0xcc0]
push 0x5b1154
push eax
call fcn.00556c35
add esp, 0x18
test eax, eax
je 0x4ffea1
push eax
call fcn.005572b0
add esp, 4
lea eax, [ebp - 0x3f0]
push 0x5b1c1c
push str.1.06
push str.Polda_2_rem
push 0x6e5798
push str._s_s__s_._s
push 0x3e8
push eax
call fcn.004dc4f0
add esp, 0x1c
nop dword [eax]
nop word [eax + eax]
push 0x140
lea eax, [ebp - 0x630]
push 0xff
push eax
call fcn.00552c40
add esp, 0xc
lea eax, [ebp - 0x15d0]
xor ebx, ebx
push eax
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x15d4], esi
cmp esi, 0xffffffff
je 0x4ffc7b
lea eax, [ebp - 0x15cc]
inc ebx
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x4ffc02
mov ecx, 0x50
lea esi, [ebp - 0x15d0]
lea edi, [ebp - 0x630]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x15d4]
lea eax, [ebp - 0x15d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4ffbd0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
jl 0x4ffc7b
push 0
push 0
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x3f0]
push eax
call fcn.00558bac
add esp, 0x14
lea eax, [ebp - 0x604]
push 0
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x10a8]
push eax
call fcn.00558e2d
add esp, 0x14
lea eax, [ebp - 0x10a8]
push eax
call fcn.00558916
add esp, 4
jmp 0x4ffb90
xor esi, esi
nop dword [eax]
push 0x5b1c1c
push esi
push str.1.06
push str.Polda_2_rem
push 0x6e5798
push str._s_s__s__i._s
lea eax, [ebp - 0x3f0]
push 0x3e8
push eax
call fcn.004dc4f0
lea eax, [ebp - 0x3f0]
push 0x5b1154
push eax
call fcn.00556c35
add esp, 0x28
test eax, eax
je 0x4ffcd7
push eax
call fcn.005572b0
inc esi
add esp, 4
cmp esi, 0xa
jl 0x4ffc80
jmp 0x4ffe5b
xor edi, edi
nop dword [eax]
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0xcc0]
push eax
call fcn.00558c17
add esp, 8
test eax, eax
je 0x4ffd0b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x4ffce0
cmp edi, 5
jne 0x4ffd3e
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0xcc0]
push eax
push str.Renaming__s_to__s_failed
push 1
call fcn.004e9620
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00551170
mov esp, ebp
pop ebp
ret
push 0x3e8
lea eax, [ebp - 0x8d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4ffe5b
lea eax, [ebp - 0x8d8]
push 0x5c
push eax
call fcn.00552840
add esp, 8
test eax, eax
je 0x4ffe5b
movups xmm0, xmmword [str.SendException.exe]
push str.http:__scripts.hrapolda.cz_upload_file.php
movups xmmword [eax + 1], xmm0
mov cx, word [0x5b1c50]
mov word [eax + 0x11], cx
lea eax, [ebp - 0x3f0]
push eax
push str.1.06
push str.Polda_2_rem
lea eax, [ebp - 0x8d8]
push eax
push str.__s____s__s____s____s_
lea eax, [ebp - 0x1490]
push 0x7d0
push eax
call fcn.004dc4f0
push 0x44
lea eax, [ebp - 0x1630]
mov dword [ebp - 0x15d4], 0xffffffff
push 0
push eax
call fcn.00552c40
add esp, 0x2c
mov dword [ebp - 0x1630], 0x44
mov eax, 1
or dword [ebp - 0x1604], eax
mov word [ebp - 0x1600], ax
lea eax, [ebp - 0x15e8]
push eax
lea eax, [ebp - 0x1630]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x1490]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4ffe5b
push 0xffffffffffffffff
push dword [ebp - 0x15e8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x15d4]
push eax
push dword [ebp - 0x15e8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x15e8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x15e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xa
jne 0x4ffea1
xor esi, esi
lea eax, [ebp - 0xcc0]
push eax
call fcn.00558916
add esp, 4
test eax, eax
je 0x4ffe86
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jb 0x4ffe62
cmp esi, 5
jne 0x4ffea1
lea eax, [ebp - 0xcc0]
push eax
push str.Removing__s_failed_n
push 1
call fcn.004e9620
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00551170
mov esp, ebp
pop ebp
ret