Function at 0x40ab90
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Set current directory
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x44a6b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
mov ebx, ecx
cmp byte [ebx + 0x171], 1
push ebp
push esi
push edi
mov dword [esp + 0x10], ebx
jne 0x40b18a
mov ecx, dword [ebx + 0x1f0]
call fcn.00414080
sub esp, 0xc
mov edi, eax
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov ecx, edi
call fcn.0041eea0
call fcn.0040b890
add esp, 0xc
cmp eax, 8
jne 0x40ac67
mov ecx, dword [ebx + 0x1f0]
push 0x3e7
call fcn.00414280
test al, al
je 0x40b175
call fcn.00408f90
lea ecx, [esp + 0x10]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x40]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea eax, [esp + 0x48]
push eax
push 0
push ecx
mov dword [esp + 0x54], 1
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40b175
lea ecx, [esp + 0x30]
call fcn.0041c120
xor ebp, ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x108], ebp
call fcn.0041c120
lea ecx, [esp + 0x24]
mov byte [esp + 0x108], 1
call fcn.0041c120
lea ecx, [esp + 0x4c]
mov byte [esp + 0x108], 2
call fcn.0041c120
mov ecx, edi
mov byte [esp + 0x108], 3
call fcn.0041f410
test eax, eax
jle 0x40b12e
jmp 0x40acc0
push ebp
mov ecx, edi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041d610
test eax, eax
jne 0x40b11e
lea edx, [esp + 0x94]
push edx
push ebp
mov ecx, edi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041eea0
mov eax, dword [esp + 0x98]
push eax
call fcn.0042dc29
add esp, 4
lea ecx, [esp + 0x94]
mov esi, eax
call fcn.0041bee0
mov ecx, dword [ebx + 0x1f0]
push esi
call fcn.00414280
test al, al
je 0x40b11e
push ebp
mov ecx, edi
xor esi, esi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041d990
test eax, eax
jle 0x40b11e
lea esp, [esp]
lea ecx, [esp + 0xb8]
push ecx
push esi
push ebp
mov ecx, edi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041d970
mov ecx, eax
call fcn.004223f0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x10c], 4
call fcn.0041c060
lea ecx, [esp + 0xb8]
mov byte [esp + 0x108], 3
call fcn.0041bee0
push esi
push ebp
mov ecx, edi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041d970
mov ecx, eax
call fcn.004223e0
sub eax, 9
je 0x40b0f8
dec eax
je 0x40b0ed
dec eax
jne 0x40b106
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x50]
call fcn.0041c060
sub esp, 0xc
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0041bff0
lea ecx, [esp + 0xdc]
push ecx
call fcn.00403f50
mov eax, dword [eax + 4]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0xd0]
call fcn.0041bee0
push 0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x24], esp
push str.HTTP:__
call fcn.0041c090
lea edx, [esp + 0xf8]
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x11c], 5
call fcn.0041c1d0
mov ecx, eax
mov byte [esp + 0x118], 7
call fcn.0041bf70
cmp eax, 1
lea ecx, [esp + 0xe8]
sete bl
mov byte [esp + 0x108], 3
call fcn.0041bee0
test bl, bl
je 0x40ae68
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.0041c060
jmp 0x40b051
push 0x44f6bf
lea ecx, [esp + 0x50]
call fcn.0041bf50
test al, al
je 0x40afac
push 0x44f848
lea ecx, [esp + 0xb0]
call fcn.0041c090
push 0x44f828
lea ecx, [esp + 0x8c]
mov byte [esp + 0x10c], 8
call fcn.0041c090
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x114], 9
call fcn.004098a0
lea ecx, [esp + 0x24]
push ecx
push eax
lea edx, [esp + 0xfc]
push edx
mov byte [esp + 0x114], 0xa
call fcn.004098a0
lea ecx, [esp + 0xac]
push ecx
push eax
lea edx, [esp + 0xe4]
push edx
mov byte [esp + 0x114], 0xb
call fcn.004098a0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
lea edx, [esp + 0x58]
push edx
push eax
push ecx
mov byte [esp + 0x120], 0xc
call fcn.004098a0
lea eax, [esp + 0xd0]
push eax
call fcn.00403f50
add esp, 0x10
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], 0xd
call fcn.0041c060
lea ecx, [esp + 0xc4]
mov byte [esp + 0x108], 0xc
call fcn.0041bee0
lea ecx, [esp + 0xdc]
mov byte [esp + 0x108], 0xb
call fcn.0041bee0
lea ecx, [esp + 0xf4]
mov byte [esp + 0x108], 0xa
call fcn.0041bee0
lea ecx, [esp + 0x58]
mov byte [esp + 0x108], 9
call fcn.0041bee0
lea ecx, [esp + 0x88]
mov byte [esp + 0x108], 8
call fcn.0041bee0
lea ecx, [esp + 0xac]
jmp 0x40b044
push 0x44f828
lea ecx, [esp + 0xa4]
call fcn.0041c090
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x114], 0xe
call fcn.004098a0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
lea edx, [esp + 0x30]
push edx
push eax
push ecx
mov byte [esp + 0x120], 0xf
call fcn.004098a0
lea eax, [esp + 0x70]
push eax
call fcn.00403f50
add esp, 0x10
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], 0x10
call fcn.0041c060
lea ecx, [esp + 0x64]
mov byte [esp + 0x108], 0xf
call fcn.0041bee0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x108], 0xe
call fcn.0041bee0
lea ecx, [esp + 0xa0]
mov byte [esp + 0x108], 3
call fcn.0041bee0
push 0x44fb94
lea ecx, [esp + 0x74]
push ecx
sub esp, 0xc
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0041bff0
lea eax, [esp + 0x50]
push eax
call fcn.00409a00
add esp, 0x10
mov ecx, eax
mov byte [esp + 0x110], 0x11
call fcn.0041c1d0
mov ecx, eax
mov byte [esp + 0x10c], 0x12
call fcn.0041bf10
lea ecx, [esp + 0x70]
mov bl, al
mov byte [esp + 0x108], 0x11
call fcn.0041bee0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x108], 3
call fcn.0041bee0
test bl, bl
push 5
je 0x40b0d4
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [esp + 0x10]
jmp 0x40b106
mov edx, dword [esp + 0x20]
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, dword [esp + 0x10]
jmp 0x40b106
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
jmp 0x40b101
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x28]
call fcn.0041c060
push ebp
mov ecx, edi
inc esi
call fcn.0041f3f0
mov ecx, eax
call fcn.0041d990
cmp esi, eax
jl 0x40ad40
mov ecx, edi
inc ebp
call fcn.0041f410
cmp ebp, eax
jl 0x40acc0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x108], 2
call fcn.0041bee0
lea ecx, [esp + 0x24]
mov byte [esp + 0x108], 1
call fcn.0041bee0
lea ecx, [esp + 0x18]
mov byte [esp + 0x108], 0
call fcn.0041bee0
lea ecx, [esp + 0x30]
mov dword [esp + 0x108], 0xffffffff
call fcn.0041bee0
mov edx, dword [ebx + 0x1c]
push 0
push 0x64
push 8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40b36d
mov ecx, 0x477380
call fcn.00416990
mov esi, eax
test esi, esi
jne 0x40b28d
cmp dword [ebx + 0x1f4], 7
jne 0x40b36d
push esi
mov ecx, ebx
call fcn.0043cb18
push 0x3e
lea eax, [esp + 0x68]
push eax
mov ecx, 0x477420
call fcn.00417690
mov esi, eax
push 0x3f
lea ecx, [esp + 0x80]
push ecx
mov ecx, 0x477420
mov dword [esp + 0x110], 0x13
call fcn.00417690
mov edi, eax
push 0x13
lea edx, [esp + 0x74]
push edx
mov ecx, 0x477420
mov byte [esp + 0x110], 0x14
call fcn.00417690
push edi
push eax
lea eax, [esp + 0x44]
mov bl, 0x15
push eax
mov byte [esp + 0x114], bl
call fcn.004098a0
mov esi, dword [esi + 4]
mov eax, dword [eax + 4]
push 0x40
push esi
mov esi, dword [esp + 0x18]
push eax
mov ecx, esi
mov byte [esp + 0x114], 0x16
call fcn.0043de7a
lea ecx, [esp + 0x3c]
mov byte [esp + 0x108], bl
call fcn.0041bee0
lea ecx, [esp + 0x70]
mov byte [esp + 0x108], 0x14
call fcn.0041bee0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x108], 0x13
call fcn.0041bee0
lea ecx, [esp + 0x64]
mov dword [esp + 0x108], 0xffffffff
call fcn.0041bee0
mov ecx, dword [esi + 0x1c]
push 0
push 0x64
push 8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x40b36d
mov al, byte [0x464147]
test al, al
je 0x40b365
mov ecx, dword [ebx + 0x1ec]
mov byte [ebx + 0x171], 1
call fcn.0041a440
mov ecx, dword [ebx + 0x1f0]
sub esp, 0xc
mov edx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00418730
mov ecx, dword [ebx + 0x1f0]
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x28], esp
push eax
mov dword [esp + 0x124], 0x17
call fcn.00417dc0
or edi, 0xffffffff
mov ecx, ebx
mov dword [esp + 0x120], edi
call fcn.0040a0a0
mov ecx, dword [ebx + 0x1f0]
push esi
call fcn.00414530
mov ecx, dword [ebx + 0x1f0]
call fcn.0041a430
push 0
lea ecx, [ebx + 0x70]
mov dword [ebx + 0x1f4], 9
call fcn.0043cb54
lea esi, [ebx + 0xc0]
push 1
mov ecx, esi
call fcn.0043cb54
push 0x10
lea ecx, [esp + 0x5c]
push ecx
mov ecx, 0x477420
call fcn.00417690
mov eax, dword [eax + 4]
push eax
mov ecx, esi
mov dword [esp + 0x10c], 0x18
call fcn.0043ca9e
lea ecx, [esp + 0x58]
mov dword [esp + 0x108], edi
call fcn.0041bee0
jmp 0x40b36d
push esi
mov ecx, ebx
call fcn.0040a120
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xfc
ret