Function at 0x401630
Capabilities:
Check if file exists
Check os version
Contain obfuscated stackstrings
Download url
Execute command
Get common file path
Get file attributes
Get process heap flags
Query environment variable
Receive data
Set current directory

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
mov eax, 0x1448
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00402978
mov esi, str.https:__github.com_PowerShell_PowerShell_releases_download_v6.1.6_PowerShell_6.1.6_win_x64.msi
sub esp, eax
mov eax, dword [ecx]
lea ebx, [ebp - 0x13db]
lea edi, [ebp - 0x13d8]
mov dword [ebp - 0x1420], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x141c], eax
mov eax, dword [str.https:__github.com_PowerShell_PowerShell_releases_download_v6.1.6_PowerShell_6.1.6_win_x64.msi]
mov dword [ebp - 0x13db], eax
mov eax, dword [0x40430b]
mov dword [ebp - 0x1380], eax
mov eax, ebx
sub eax, edi
sub esi, eax
add eax, 0x5f
shr eax, 2
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1240]
mov byte [ebp - 0x13dc], 0
mov dword [ebp - 0x13f8], 0x65776f50
mov dword [ebp - 0x13f4], 0x65685372
mov dword [ebp - 0x13f0], 0x362d6c6c
mov dword [ebp - 0x13ec], 0x362e312e
mov dword [ebp - 0x13e8], 0x6e69772d
mov dword [ebp - 0x13e4], 0x3436782d
mov eax, ecx
xor ecx, ecx
mov word [ebp - 0x13fa], cx
mov ecx, 0x7a
mov dword [ebp - 0x13e0], 0x69736d2e
mov dword [ebp - 0x140a], 0x770070
mov dword [ebp - 0x1406], 0x680073
mov dword [ebp - 0x1402], 0x65002e
mov dword [ebp - 0x13fe], 0x650078
mov dword [ebp - 0x1260], 0x740073
mov dword [ebp - 0x125c], 0x720061
mov dword [ebp - 0x1258], 0x200074
mov dword [ebp - 0x1254], 0x770070
mov dword [ebp - 0x1250], 0x680073
mov dword [ebp - 0x124c], 0x65002e
mov dword [ebp - 0x1248], 0x650078
mov dword [ebp - 0x1244], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xe4c]
mov ecx, 0x81
mov dword [ebp - 0xe50], 0
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc40]
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0xc48], 0x63002d
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa40]
mov dword [ebp - 0xc44], 0x20
mov dword [esp + 8], 0x105
mov dword [esp + 4], eax
mov dword [esp], str._ProgramW6432_
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
sub esp, 0xc
test eax, eax
jne 0x4017f0
mov dword [esp], str.Something_went_wrong_:___32_bit___winversion__win7___....___n
call dbg.printf
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
cmp word [ebp - 0xa40], 0
lea edx, [ebp - 0xa40]
je 0x401809
add edx, 2
cmp word [edx], 0
jne 0x401800
xor eax, eax
mov ecx, 0x5c
jmp 0x40181f
movzx ecx, word [eax + str.Powershell6pwsh.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401818
lea eax, [ebp - 0xa40]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x401cab
cmp dword [ebp - 0x1420], 1
jle 0x401f56
lea eax, [ebp - 0xe50]
mov esi, dword [sym.imp.ucrtbase.dll__wcsnicmp]
mov ebx, 1
mov dword [ebp - 0x142c], 0
mov dword [ebp - 0x1424], eax
lea esi, [esi]
mov eax, dword [ebp - 0x141c]
lea edx, [ebx*4]
mov dword [esp + 8], 3
mov dword [ebp - 0x1428], edx
lea edi, [eax + edx]
mov eax, dword [edi]
mov dword [esp], 0x4041d0
mov dword [esp + 4], eax
call esi
test eax, eax
jne 0x4018bc
mov eax, dword [ebp - 0x141c]
mov edx, dword [ebp - 0x1428]
add ebx, 2
lea edi, [eax + edx + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x40196e
cmp word [ebp - 0xe50], 0
mov edx, dword [ebp - 0x1424]
je 0x4018e9
lea esi, [esi]
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4018e0
xor eax, eax
mov edi, 0x20
jmp 0x4018ff
movzx edi, word [eax + 0x4041d8]
mov word [edx + eax], di
add eax, 2
test di, di
jne 0x4018f8
cmp word [ebp - 0xe50], 0
mov edx, dword [ebp - 0x1424]
je 0x401929
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x401920
xor eax, eax
lea esi, [esi]
nop
movzx edi, word [ecx + eax]
mov word [edx + eax], di
add eax, 2
test di, di
jne 0x401930
mov dword [esp + 8], 4
mov dword [esp + 4], ecx
mov dword [esp], 0x4041dc
call esi
cmp eax, 1
adc dword [ebp - 0x142c], 0
add ebx, 1
cmp dword [ebp - 0x1420], ebx
jg 0x401878
mov ebx, 1
lea esi, [esi]
nop
mov eax, dword [ebp - 0x141c]
mov dword [esp + 8], 2
lea edi, [eax + ebx*4]
mov eax, dword [edi]
mov dword [esp], 0x4041e6
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401c68
mov dword [esp + 8], 2
mov eax, dword [edi]
mov dword [esp], 0x4041ec
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x4041f2
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x4041d0
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x4041fa
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x404202
mov dword [esp + 4], eax
call esi
test eax, eax
jne 0x401bbf
lea esi, [esi]
nop
add ebx, 1
add ebx, 1
cmp dword [ebp - 0x1420], ebx
jg 0x401978
mov byte [ebp - 0x1420], 1
xor ebx, ebx
mov esi, str._System.Math_::sqrt_64_
mov ecx, 0x208
lea edi, [ebp - 0x838]
rep movsd dword es:[edi], dword [esi]
test byte [0x403820], 1
jne 0x401ebc
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
test ebx, ebx
jne 0x401e53
mov ebx, dword [ebp - 0x1424]
lea eax, [ebp - 0x630]
mov dword [esp + 8], eax
lea eax, [ebp - 0x838]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dbg.replace_smart
xor edx, edx
lea esi, [esi]
movzx ecx, word [eax + edx]
mov word [ebx + edx], cx
add edx, 2
test cx, cx
jne 0x401aa0
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov ebx, dword [ebp - 0x1424]
lea eax, [ebp - 0x220]
sub esp, 0xc
mov dword [esp + 8], eax
lea eax, [ebp - 0x428]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dbg.replace_smart
xor edx, edx
lea esi, [esi]
movzx ecx, word [eax + edx]
mov word [ebx + edx], cx
add edx, 2
test cx, cx
jne 0x401af8
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
test byte [0x403820], 1
jne 0x401db9
lea eax, [ebp - 0x140a]
cmp byte [ebp - 0x1420], 0
mov dword [ebp - 0x1410], 0
mov dword [ebp - 0x1418], eax
mov eax, dword [ebp - 0x1424]
mov dword [ebp - 0x1414], eax
je 0x401c7c
lea ebx, [ebp - 0x1260]
cmp word [ebp - 0x1260], 0
mov edx, ebx
je 0x401b89
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x401b80
mov esi, dword [ebp - 0x1424]
xor eax, eax
lea esi, [esi]
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401b98
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wsystem]
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x40420a
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x404212
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 3
mov eax, dword [edi]
mov dword [esp], 0x40421a
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a30
mov dword [esp + 8], 1
mov eax, dword [edi]
mov dword [esp], 0x404222
mov dword [esp + 4], eax
call esi
test eax, eax
je 0x401a33
cmp word [ebp - 0xc48], 0
mov esi, dword [edi]
lea eax, [ebp - 0xc48]
je 0x401c56
add eax, 2
cmp word [eax], 0
jne 0x401c4d
xor edx, edx
movzx ecx, word [esi + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x401c58
mov eax, dword [ebp - 0x142c]
test eax, eax
setne byte [ebp - 0x1420]
jmp 0x401a4b
lea eax, [ebp - 0x1418]
mov dword [esp], 2
mov dword [esp + 8], eax
lea eax, [ebp - 0xa40]
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__wspawnv]
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [ebp - 0x137c], 0x11c
lea eax, [ebp - 0x137c]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
sub esp, 4
test eax, eax
jne 0x4017d0
mov eax, dword [ebp - 0x1378]
cmp eax, 5
jbe 0x4017d0
cmp eax, 6
jne 0x401cf1
mov edx, dword [ebp - 0x1374]
test edx, edx
je 0x4017d0
mov dword [esp + 0xc], 0x30
lea edi, [ebp - 0x1058]
mov dword [esp + 8], str.Message
mov dword [esp + 4], str.Looks_like_Powershell_Core_is_not_installed__nWill_start_downloading_and_install_now_n_____This_could_take_quite_some_time____nNo_progress_bar_is_shown_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [esp + 4], edi
mov dword [esp], 0x105
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
sub esp, 8
mov dword [esp], str.c:windows_temp_
call esi
lea edx, [ebp - 0x13f8]
sub esp, 4
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], str.Downloading_File_From:__s__To:__s__n
call dbg.printf
lea edx, [ebp - 0x13f8]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp], 0
call sym._URLDownloadToFileA_20
sub esp, 0x14
test eax, eax
jne 0x4017d0
mov dword [esp], str.File_Successfully_Downloaded__n
call dbg.printf
mov dword [esp], str.start__WAIT_msiexec.exe__i_PowerShell_6.1.6_win_x64.msi__INSTALLFOLDER_C:WindowsPowershell6____q
call dword [sym.imp.ucrtbase.dll_system]
mov dword [esp], edi
call esi
sub esp, 4
jmp 0x401846
mov dword [esp + 0xc], str.e_1_93m
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
test byte [0x403820], 1
je 0x401b36
mov eax, dword [ebp - 0x1424]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str._nnew_command_line_is__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
test byte [0x403820], 1
je 0x401b36
mov dword [esp + 0xc], str.e_0m_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x401b36
lea eax, [ebp - 0xc48]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x141c]
mov eax, dword [eax + ebx*4]
mov ebx, dword [ebp - 0x1424]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dbg.replace_smart
xor edx, edx
lea esi, [esi]
movzx ecx, word [eax + edx]
mov word [ebx + edx], cx
add edx, 2
test cx, cx
jne 0x401e80
mov dword [esp + 8], eax
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x401a78
mov dword [esp + 0xc], str.e_1_35m
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
test byte [0x403820], 1
je 0x401a6a
mov eax, dword [ebp - 0x1424]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0xc], str._nold_command_line_is__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
test byte [0x403820], 1
je 0x401a6a
mov dword [esp + 0xc], str.e_0m_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], 0x403820
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x401a6a
lea eax, [ebp - 0xe50]
mov byte [ebp - 0x1420], 1
xor ebx, ebx
mov dword [ebp - 0x1424], eax
jmp 0x401a4b