Function at 0x4013a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
lea ebx, [ebp - 0x45b]
sub esp, 0x458
mov edi, dword [ecx + 4]
call fcn.00401320
push eax
push 0x400
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push eax
push 0x41f024
push ebx
call sub.msvcrt.dll_fopen
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4016d1
push eax
push 2
push 0
push ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
add esp, 0xc
mov dword [0x423010], eax
push 0
push 0
push ebx
call sub.msvcrt.dll_fseek
pop eax
push dword [0x423010]
call sub.msvcrt.dll_malloc
mov dword [0x423020], eax
push ebx
push dword [0x423010]
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x14
push ebx
call sub.msvcrt.dll_fclose
rdtsc
mov dword [esp], 0
mov esi, edx
mov ebx, eax
call sub.msvcrt.dll_time
xor ebx, esi
xor ebx, dword [edi]
xor ebx, eax
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_srand
mov edi, dword [0x423010]
sub edi, 0xa
mov esi, dword [0x423020]
add esp, 0x10
jmp 0x401495
push eax
lea eax, [esi + ebx]
push 0xa
push str.__UNIQUE__esf
push eax
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
jne 0x401494
lea eax, [ebx + 0xa]
mov dword [0x423030], eax
xor eax, eax
jmp 0x40149e
inc ebx
cmp ebx, edi
jl 0x401470
mov eax, 1
test eax, eax
jne 0x4016d1
sub esp, 0xc
push str.ma_num_wa_rifaien_yanje_v1.0
call sub.msvcrt.dll_puts
mov dword [esp], 0x41f044
call sub.msvcrt.dll_puts
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x40
add esp, 0x10
mov dword [ebp - 0x464], ecx
sub esp, 0xc
mov ebx, 1
lea esi, [ebp - 0x33]
push 0x7530
call sub.KERNEL32.dll_Sleep
add esp, 0xc
call sub.msvcrt.dll_rand
mov edx, 7
mov ecx, edx
cdq
idiv ecx
lea edi, [edx + 1]
call sub.msvcrt.dll_rand
mov edx, 0x3e
mov ecx, edx
cdq
idiv ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [ebx + esi - 1], al
inc ebx
cmp ebx, 0x11
jne 0x4014fb
mov byte [ebp - 0x23], 0
push ebx
lea ebx, [ebp - 0x5b]
push esi
push str.rifaien2__s.exe
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xc
push edi
push ebx
push str.ma_num_wa_gyen_orn_hyzik__s_en_exec_ween_NODE_i_n
call sub.msvcrt.dll_printf
mov ebx, dword [0x423030]
mov esi, 1
add ebx, dword [0x423020]
add esp, 0x10
call sub.msvcrt.dll_rand
mov byte [esi + ebx - 1], al
inc esi
cmp esi, 0x11
jne 0x401551
lea esi, [ebp - 0x5b]
push ecx
push ecx
push 0x41f086
push esi
call sub.msvcrt.dll_fopen
mov ebx, eax
add esp, 0x10
mov eax, 1
test ebx, ebx
je 0x4016b4
push ebx
push dword [0x423010]
push 1
push dword [0x423020]
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [esp], 3
call sym.survivalist.exe_curl_global_init
add esp, 0xc
push edi
lea edi, [ebp - 0x22]
push str.NODE_i
push edi
call sub.msvcrt.dll_sprintf
add esp, 0xc
lea ebx, [ebp - 0x14]
push 0x11
push esi
lea esi, [ebp - 0x18]
push 0xa
push str.file__
push 1
push esi
push ebx
call sym.survivalist.exe_curl_formadd
add esp, 0x1c
push 0x11
push edi
push 4
push str.node
push 1
push esi
push ebx
call sym.survivalist.exe_curl_formadd
add esp, 0x1c
push 0x11
push str.send
push 4
push str.submit
push 1
push esi
push ebx
call sym.survivalist.exe_curl_formadd
add esp, 0x20
call sym.survivalist.exe_curl_easy_init
mov ebx, eax
test eax, eax
je 0x40169e
push edx
push str.http:__wecan.hasthe.technology_upload
push 0x2712
push eax
call sym.survivalist.exe_curl_easy_setopt
add esp, 0xc
push dword [ebp - 0x14]
push 0x2728
push ebx
call sym.survivalist.exe_curl_easy_setopt
add esp, 0xc
push 1
push 0x29
push ebx
call sym.survivalist.exe_curl_easy_setopt
mov dword [esp], ebx
call sym.survivalist.exe_curl_easy_perform
add esp, 0x10
test eax, eax
je 0x401689
sub esp, 0xc
push eax
call sym.survivalist.exe_curl_easy_strerror
add esp, 0xc
push eax
push str.curl_easy_perform___failed:__s_n
push dword [ebp - 0x464]
call sub.msvcrt.dll_fprintf
mov eax, 1
add esp, 0x10
jmp 0x4016b4
sub esp, 0xc
push ebx
call sym.survivalist.exe_curl_easy_cleanup
pop eax
push dword [ebp - 0x14]
call sym.survivalist.exe_curl_formfree
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x5b]
push eax
call sub.msvcrt.dll__unlink
xor eax, eax
add esp, 0x10
test ebx, ebx
sete al
test eax, eax
je 0x4014d1
sub esp, 0xc
push str.ma_au_ga_rre_gyaje_weel
call sub.msvcrt.dll_puts
add esp, 0x10
jmp 0x4014d1
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret