Function at 0x429130
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov eax, 0x183c
push edi
push esi
push ebx
call fcn.004f11c8
sub esp, eax
cmp byte [0xd622c0], 0
je 0x429538
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x429740
lea ebp, [esp + 0x30]
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebp
mov ebx, ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
jmp 0x42918b
lea ebx, [eax + 1]
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x429188
cmp ebx, ebp
je 0x429528
lea eax, [esp + 0xc37]
mov byte [ebx], 0
lea edi, [esp + 0xc30]
mov dword [esp + 4], ebp
lea esi, [esp + 0xc30]
lea ebx, [esp + 0x430]
mov dword [esp], eax
mov dword [esp + 0xc30], 0x656c6966
mov dword [esp + 0xc34], 0x2f2f3a
call sub.msvcrt.dll_strcpy
mov eax, dword [0xde84ac]
mov dword [esp + 0xc], 0xd622c0
mov dword [esp + 4], 0x400
mov dword [esp + 8], eax
lea eax, [esp + 0x1030]
mov dword [esp], eax
call fcn.00404e10
lea eax, [esp + 0x1030]
mov dword [esp + 4], eax
lea eax, [esp + 0xc30]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [esp + 0xc30]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov byte [esp + 0x430], 0x22
lea edx, [edi + eax]
lea edi, [esp + 0x434]
mov dword [edx], 0x7468782e
mov dword [edx + 3], 0x6c6d74
mov ecx, dword [esp + 0xc30]
lea edx, [eax + 7]
mov dword [esp + 0x431], ecx
mov ecx, dword [esp + eax + 0xc33]
mov dword [esp + eax + 0x434], ecx
lea ecx, [esp + 0x431]
sub ecx, edi
sub esi, ecx
add ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov esi, 0x22
lea edi, [esp + 0xc30]
mov word [ebx + eax + 7], si
mov esi, ebx
mov ecx, dword [esp + eax + 0x435]
mov dword [esp + eax + 0xc35], ecx
lea ecx, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0xd622c0
mov edi, 0x22
mov dword [esp], str._s.png
call fcn.00402550
mov dword [esp + 4], 0x400
mov dword [esp + 0xc], eax
mov eax, dword [0xde84ac]
mov dword [esp + 8], eax
lea eax, [esp + 0x1030]
mov dword [esp], eax
call fcn.00404e10
lea eax, [esp + 0x1030]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
lea eax, [esp + 0x1030]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [esp + 0x1030]
mov byte [esp + 0x430], 0x22
mov dword [esp + 4], eax
lea eax, [esp + 0x431]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
lea edx, [eax + 2]
mov word [ebx + eax], di
cmp edx, 4
jae 0x429550
test edx, edx
je 0x42936b
movzx eax, byte [esp + 0x430]
mov byte [esp + 0x1030], al
test dl, 2
jne 0x4297f0
mov dword [esp], str.reg_query__HKEY_CURRENT_USERSoftwareGoogleChromeBLBeacon___v_version
call sub.msvcrt.dll_system
test eax, eax
jne 0x429583
mov dword [esp], str.reg_query__HKEY_CLASSES_ROOTChromeHTML_shellopencommand___ve_____temp__
call sub.msvcrt.dll_system
mov dword [esp + 4], 0x50e35f
mov dword [esp], str.__temp__
call sub.msvcrt.dll_fopen
mov dword [esp + 4], 0x400
mov dword [esp + 8], eax
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x429528
add eax, 1
lea esi, [esp + 0x831]
mov byte [esp + 0x830], 0x22
lea ebx, [esp + 0x830]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x429528
mov byte [eax], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov ecx, 0x22
mov word [ebx + eax], cx
mov dword [esp], str.__temp__
call sub.msvcrt.dll_remove
movzx eax, byte [0xd622a0]
cmp al, 0x2e
je 0x4297a8
cmp al, 0x18
je 0x429769
lea edx, [eax + eax*2]
lea esi, [esp + 0x2b]
mov dword [esp + 4], 0x50e36a
lea eax, [eax + edx*4 + 0x34]
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00427940
lea eax, [esp + 0xc30]
mov dword [esp + 0xc], esi
lea esi, [esp + 0x1430]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1030]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 4], str._s___headless___disable_gpu___default_background_color00000000___window_size640x_s___screenshot_s__s
mov dword [esp], esi
call fcn.00427940
mov dword [esp + 4], 0x50e3d8
mov dword [esp], str.__temp__.bat
call sub.msvcrt.dll_fopen
mov dword [esp], esi
mov dword [esp + 4], eax
mov ebx, eax
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], str.__temp__.bat
call sub.msvcrt.dll_system
mov dword [esp], str.__temp__.bat
mov ebx, eax
call sub.msvcrt.dll_remove
test ebx, ebx
je 0x42977a
mov dword [esp + 4], ebx
mov dword [esp], str.Automatic_PNG_screenshot_with_Chrome_failed___d_.
call fcn.00414150
lea esi, [esi]
xor eax, eax
add esp, 0x183c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x50e260
call fcn.00413da0
jmp 0x429528
mov ecx, dword [esp + edx + 0x42c]
lea edi, [esp + 0x1030]
mov esi, ebx
mov dword [esp + edx + 0x102c], ecx
lea ecx, [eax + 1]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], str.reg_query__HKEY_CURRENT_USERSoftwareGoogleChromeBLBeacon___v_version
call sub.msvcrt.dll_system
test eax, eax
je 0x42937f
mov dword [esp], str.reg_query__HKEY_CURRENT_USERSoftwareMozillaFirefox___v_OldDefaultBrowserCommand
call sub.msvcrt.dll_system
test eax, eax
jne 0x429758
mov dword [esp], str.reg_query__HKEY_CLASSES_ROOTApplications_firefox.exe_shellopencommand___ve_____temp__
call sub.msvcrt.dll_system
mov dword [esp + 4], 0x50e35f
mov dword [esp], str.__temp__
call sub.msvcrt.dll_fopen
mov dword [esp + 4], 0x400
mov dword [esp + 8], eax
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x22
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x429528
add eax, 1
lea esi, [esp + 0x831]
mov byte [esp + 0x830], 0x22
lea ebx, [esp + 0x830]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x22
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
je 0x429528
mov byte [eax], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x22
mov word [ebx + eax], dx
mov dword [esp], str.__temp__
call sub.msvcrt.dll_remove
movzx eax, byte [0xd622a0]
cmp al, 0x2e
je 0x429805
cmp al, 0x18
je 0x4297df
mov edx, eax
lea esi, [esp + 0x2b]
mov dword [esp + 4], 0x50e36a
shl edx, 4
mov dword [esp], esi
lea eax, [eax + edx + 0x3c]
mov dword [esp + 8], eax
call fcn.00427940
lea eax, [esp + 0xc30]
mov dword [esp + 0xc], esi
lea esi, [esp + 0x1430]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1030]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 4], str._s___headless___window_size_660__s___screenshot__s__s
mov dword [esp], esi
call fcn.00427940
mov dword [esp + 4], 0x50e3d8
mov dword [esp], str.__temp__.bat
call sub.msvcrt.dll_fopen
mov dword [esp], esi
mov dword [esp + 4], eax
mov ebx, eax
call sub.msvcrt.dll_fputs
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [esp], str.__temp__.bat
call sub.msvcrt.dll_system
mov dword [esp], str.__temp__.bat
mov ebx, eax
call sub.msvcrt.dll_remove
test ebx, ebx
je 0x4297b9
mov dword [esp + 4], ebx
mov dword [esp], str.Automatic_PNG_screenshot_with_Firefox_failed___d_.
call fcn.00414150
jmp 0x429528
mov dword [esp], str.Screenshot:_Module_handle_is_NULL
call fcn.00412f10
jmp 0x429528
mov dword [esp], 0x50e594
call fcn.00413da0
jmp 0x429528
mov dword [esp + 0x2b], 0x353633
lea esi, [esp + 0x2b]
jmp 0x429490
mov dword [esp + 4], 0xd622c0
mov dword [esp], str._s.png
call fcn.00402550
mov dword [esp], str.PNG_screenshot_via_Chrome_saved_to__s.
mov dword [esp + 4], eax
call fcn.00414150
mov eax, 1
jmp 0x42952a
mov dword [esp + 0x2b], 0x303536
lea esi, [esp + 0x2b]
jmp 0x429490
mov dword [esp + 4], 0xd622c0
mov dword [esp], str._s.png
call fcn.00402550
mov dword [esp], str.PNG_screenshot_via_Firefox_saved_to__s.
mov dword [esp + 4], eax
call fcn.00414150
jmp 0x42979e
mov dword [esp + 0x2b], 0x303734
lea esi, [esp + 0x2b]
jmp 0x4296aa
movzx eax, word [esp + edx + 0x42e]
mov word [esp + edx + 0x102e], ax
jmp 0x42936b
mov dword [esp + 0x2b], 0x353338
lea esi, [esp + 0x2b]
jmp 0x4296aa