Function at 0x408e40
Capabilities:
Copy file
Delete file
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464a0e
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x474004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x118]
push eax
call fcn.00408b80
add esp, 4
mov ecx, dword [ebp - 0x108]
mov esi, 0x7fffffff
mov eax, esi
mov dword [ebp - 4], 0
sub eax, ecx
cmp eax, 0xb
jb 0x40a10b
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
push 0xb
cmovae eax, dword [ebp - 0x118]
push str._share_skel
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x100]
call fcn.004041b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.004089b0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.0040aa60
add esp, 8
test al, al
jne 0x4096e3
mov dword [ebp - 0x58], 0
mov byte [ebp - 0x58], al
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 1
mov word [ebp - 0x58], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004021df
add esp, 0xc
mov edx, dword [ebp - 0x44]
cmp edx, 0x10
jb 0x408f66
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
mov byte [ebp - 4], 7
cmp edx, 0x1000
jb 0x408f5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xb8], 0
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 1
mov word [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.004021df
add esp, 0xc
mov edx, dword [ebp - 0xa4]
mov byte [ebp - 4], 0xb
cmp edx, 0x10
jb 0x408ff8
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0xc
cmp edx, 0x1000
jb 0x408fea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a115
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa8], 0
cmovae eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xbc], 0x10
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0xd0]
cmovae eax, dword [ebp - 0xd0]
mov dword [ebp - 0x144], eax
mov eax, 0xe14
mov word [ebp - 0x140], ax
lea eax, [ebp - 0x150]
push eax
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
mov dword [ebp - 0x14c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x409168
mov eax, dword [ebp - 0xbc]
mov byte [ebp - 4], 0xd
cmp eax, 0x10
jb 0x409094
inc eax
lea ecx, [ebp - 0xd0]
push eax
push dword [ebp - 0xd0]
call fcn.00401177
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 4], 0xe
cmp eax, 0x10
jb 0x4090d1
inc eax
lea ecx, [ebp - 0xa0]
push eax
push dword [ebp - 0xa0]
call fcn.00401177
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xf
cmp eax, 0x10
jb 0x409105
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401177
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0xec]
mov byte [ebp - 4], 0x10
cmp eax, 0x10
jb 0x409139
inc eax
lea ecx, [ebp - 0x100]
push eax
push dword [ebp - 0x100]
call fcn.00401177
mov eax, dword [ebp - 0x104]
mov dword [ebp - 4], 0x11
cmp eax, 0x10
jb 0x40915e
inc eax
lea ecx, [ebp - 0x118]
push eax
push dword [ebp - 0x118]
call fcn.00401177
mov eax, 1
jmp 0x40a0f0
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
cmp eax, 0x10
jb 0x40a11a
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x10
cmovae eax, dword [ebp - 0x28]
push str._etc_icinga2_pki
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x12
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x13
cmp eax, 0x10
jb 0x4091c4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x12
jb 0x40a11f
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x12
cmovae eax, dword [ebp - 0x28]
push str._var_cache_icinga2
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x14
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x15
cmp eax, 0x10
jb 0x409224
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x16
jb 0x40a124
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x16
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_certs
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x16
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x17
cmp eax, 0x10
jb 0x409284
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x25
jb 0x40a129
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x25
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_certificate_requests
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x18
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x19
cmp eax, 0x10
jb 0x4092e4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x20
jb 0x40a12e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x20
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_agent_inventory
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x1a
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x1b
cmp eax, 0x10
jb 0x409344
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x1b
jb 0x40a133
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x1b
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_api_config
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x1c
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x1d
cmp eax, 0x10
jb 0x4093a4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x18
jb 0x40a138
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x18
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_api_log
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x1e
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
cmp eax, 0x10
jb 0x409404
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x1a
jb 0x40a13d
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x1a
cmovae eax, dword [ebp - 0x28]
push str._var_lib_icinga2_api_zones
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x20
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x21
cmp eax, 0x10
jb 0x409464
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x1f
jb 0x40a142
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x1f
cmovae eax, dword [ebp - 0x28]
push str._var_log_icinga2_compat_archive
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x22
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x23
cmp eax, 0x10
jb 0x4094c4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x16
jb 0x40a147
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x16
cmovae eax, dword [ebp - 0x28]
push str._var_log_icinga2_crash
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x24
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x25
cmp eax, 0x10
jb 0x409524
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x14
jb 0x40a14c
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x14
cmovae eax, dword [ebp - 0x28]
push str._var_run_icinga2_cmd
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x26
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x27
cmp eax, 0x10
jb 0x409584
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x1b
jb 0x40a151
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x1b
cmovae eax, dword [ebp - 0x28]
push str._var_spool_icinga2_perfdata
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x28
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x29
cmp eax, 0x10
jb 0x4095e4
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0xb
cmp eax, 0x16
jb 0x40a156
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x16
cmovae eax, dword [ebp - 0x28]
push str._var_spool_icinga2_tmp
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2a
push eax
call fcn.0040a7d0
add esp, 4
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x2b
cmp eax, 0x10
jb 0x409644
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov edx, dword [ebp - 0xbc]
cmp edx, 0x10
jb 0x409682
mov ecx, dword [ebp - 0xd0]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x2c
cmp edx, 0x1000
jb 0x409678
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a15b
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0xf
mov byte [ebp - 0xd0], 0
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x4096e3
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x2d
cmp edx, 0x1000
jb 0x4096d5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a15b
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
cmp eax, 0x34
jb 0x40a160
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x34
cmovae eax, dword [ebp - 0x28]
push str._etc_icinga2_features_available_windowseventlog.conf
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x2e
push eax
call fcn.0040aa60
add esp, 4
test al, al
sete byte [ebp - 0x181]
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x2f
cmp eax, 0x10
jb 0x409748
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
cmp byte [ebp - 0x181], 0
mov byte [ebp - 4], 2
je 0x409ce1
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
cmp eax, 0x2a
jb 0x40a165
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x2a
cmovae eax, dword [ebp - 0x28]
push str._etc_icinga2_features_enabled_mainlog.conf
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x88]
call fcn.004041b0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x30
push eax
call fcn.0040aa60
add esp, 4
test al, al
je 0x4097c6
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
cmovae eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40a16a
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xc0], str.features_enabled
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], str.features_available
mov dword [ebp - 0x60], eax
mov edi, eax
cmp eax, ecx
je 0x409ca6
nop dword [eax]
nop word [eax + eax]
mov edx, dword [edi]
mov ecx, edx
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
lea eax, [ecx + 1]
mov byte [ebp - 0xa0], 0
mov dword [ebp - 0x5c], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409830
sub ecx, dword [ebp - 0x5c]
push ecx
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040227f
mov ecx, dword [ebp - 0xf0]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0x33
cmp eax, 0xd
jb 0x40a10b
cmp dword [ebp - 0xec], 0x10
lea eax, [ebp - 0x100]
push 0xd
cmovae eax, dword [ebp - 0x100]
push str._etc_icinga2_
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x130]
call fcn.004041b0
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmovae eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x130]
push eax
mov byte [ebp - 4], 0x34
call fcn.00401ea6
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push 0x15
push str._windowseventlog.conf
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x35
call fcn.00401ea6
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x48], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x409973
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x38
cmp edx, 0x1000
jb 0x409969
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
mov edx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0x39
cmp edx, 0x10
jb 0x4099cb
mov ecx, dword [ebp - 0x130]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x3a
cmp edx, 0x1000
jb 0x4099bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0xf
mov byte [ebp - 0x130], 0
cmp eax, 0xd
jb 0x40a10b
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0xd
cmovae eax, dword [ebp - 0x28]
push str._etc_icinga2_
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.004041b0
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
push dword [ebp - 0x90]
cmovae eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x3b
call fcn.00401ea6
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push 0x15
push str._windowseventlog.conf
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x3c
call fcn.00401ea6
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0xd4]
cmp edx, 0x10
jb 0x409b20
mov ecx, dword [ebp - 0xe8]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x3f
cmp edx, 0x1000
jb 0x409b16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
mov edx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x40
cmp edx, 0x10
jb 0x409b7b
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x41
cmp edx, 0x1000
jb 0x409b6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 0x40
cmp dword [ebp - 0xa4], 0x10
lea ecx, [ebp - 0xb8]
push 0
cmovae ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 0x10
push ecx
cmovae eax, dword [ebp - 0x58]
push eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40a1be
mov edx, dword [ebp - 0xa4]
cmp edx, 0x10
jb 0x409bfc
mov ecx, dword [ebp - 0xb8]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x46
cmp edx, 0x1000
jb 0x409bf2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
cmp edx, 0x10
jb 0x409c4f
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x47
cmp edx, 0x1000
jb 0x409c45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x30
cmp edx, 0x10
jb 0x409c95
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x48
cmp edx, 0x1000
jb 0x409c87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a110
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 0x30
add edi, 4
lea eax, [ebp - 0xb8]
cmp edi, eax
jne 0x409800
mov edx, dword [ebp - 0x74]
cmp edx, 0x10
jb 0x409ce1
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x49
cmp edx, 0x1000
jb 0x409cd7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a1b9
push edx
push ecx
call fcn.004015b9
add esp, 8
mov eax, dword [str.icacls]
mov dword [ebp - 0xe8], eax
mov ax, word [0x46727c]
mov dword [ebp - 0xd4], 0xf
mov dword [ebp - 0xd8], 6
mov word [ebp - 0xe4], ax
mov byte [ebp - 0xe2], 0
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub eax, ecx
mov byte [ebp - 4], 0x4b
cmp eax, 1
jb 0x40a235
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x88]
push eax
push 1
push 0x467274
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
call fcn.004041b0
push 0x1c
push str.___grant_S_1_5_20:_oi__ci_m
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x4c
call fcn.00401ea6
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x58], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x48], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00408760
mov edx, dword [ebp - 0x44]
add esp, 8
cmp edx, 0x10
jb 0x409dea
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x4e
cmp edx, 0x1000
jb 0x409de0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a23a
push edx
push ecx
call fcn.004015b9
add esp, 8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x74]
mov byte [ebp - 4], 0x4f
cmp eax, 0x10
jb 0x409e1b
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00401177
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x409e76
mov ecx, dword [ebp - 0xe8]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x50
cmp edx, 0x1000
jb 0x409e68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a23a
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 2
push 6
mov dword [ebp - 0x58], 0
lea ecx, [ebp - 0x58]
push str.icacls
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.0040227f
mov ecx, dword [ebp - 0x18]
sub esi, ecx
mov byte [ebp - 4], 0x51
cmp esi, 1
jb 0x40a23f
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x88]
push eax
push 1
push 0x467274
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x5c]
call fcn.004041b0
push str.etc___inheritance:r__grant:r_S_1_5_20:_oi__ci_m_S_1_5_32_544:_oi__ci_f
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x52
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00404205
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0x53
push eax
call fcn.00408760
add esp, 0x14
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0x54
cmp eax, 0x10
jb 0x409f19
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00401177
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x74]
mov byte [ebp - 4], 0x55
cmp eax, 0x10
jb 0x409f4a
inc eax
lea ecx, [ebp - 0x88]
push eax
push dword [ebp - 0x88]
call fcn.00401177
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
mov byte [ebp - 4], 2
cmp edx, 0x10
jb 0x409f9f
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x56
cmp edx, 0x1000
jb 0x409f91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a244
push edx
push ecx
call fcn.004015b9
add esp, 8
mov byte [ebp - 4], 2
push 0x14
mov dword [ebp - 0x88], 0
lea ecx, [ebp - 0x88]
push str.__scm_install_daemon
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.0040227f
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x57
push eax
call fcn.00408840
mov edx, dword [ebp - 0x74]
add esp, 4
cmp edx, 0x10
jb 0x40a01e
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x58
cmp edx, 0x1000
jb 0x40a014
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a249
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40a056
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x59
cmp edx, 0x1000
jb 0x40a04c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a24e
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0xec]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x40a0a6
mov ecx, dword [ebp - 0x100]
inc edx
mov eax, ecx
mov byte [ebp - 4], 0x5a
cmp edx, 0x1000
jb 0x40a09c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a253
push edx
push ecx
call fcn.004015b9
add esp, 8
mov edx, dword [ebp - 0x104]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x40a0ee
mov ecx, dword [ebp - 0x118]
inc edx
mov eax, ecx
mov dword [ebp - 4], 0x5b
cmp edx, 0x1000
jb 0x40a0e4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40a258
push edx
push ecx
call fcn.004015b9
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004022c0
mov esp, ebp
pop ebp
ret
call fcn.00402784
call fcn.0040307b
call fcn.0040307b
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.00402784
call fcn.0040307b
call fcn.00402784
call fcn.00402784
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x40]
push str.deleting_
push eax
call fcn.00401d61
push str._failed
push eax
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x31
push eax
call fcn.00404205
add esp, 0x18
push eax
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x32
call fcn.004020ea
push 0x472ccc
lea eax, [ebp - 0xc4]
push eax
call fcn.00404250
call fcn.0040307b
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x130]
push str.copying_
push eax
call fcn.00401d61
push str._to_
push eax
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x42
push eax
call fcn.00404205
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x43
push ecx
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.00403297
push str._failed
push eax
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 0x44
push eax
call fcn.00404205
add esp, 0x30
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x45
call fcn.004020ea
push 0x472ccc
lea eax, [ebp - 0x64]
push eax
call fcn.00404250
call fcn.00402784
call fcn.0040307b
call fcn.00402784
call fcn.0040307b
call fcn.0040307b
call fcn.0040307b
call fcn.0040307b
call fcn.0040307b
int3