Function at 0x407c7a
Capabilities:
Delete file
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov r8d, 8
lea rdx, str.C:_ss.txt
mov rcx, rax
call fcn.00466ea0
lea rax, [rbp - 0x60]
add rax, 0xd0
mov rcx, rax
call fcn.00448fe0
test rax, rax
setne al
test al, al
je 0x407cd6
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
mov ebx, 0
jmp 0x407fcd
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00466e50
call fcn.004075d6
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rdx, str.Checking_ads.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x18f]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.ad.txt
mov rcx, rax
call fcn.00458cf0
lea rax, [rbp + 0x19b]
mov rcx, rax
call fcn.0044fb90
lea rdx, [rbp + 0x19b]
lea rax, [rbp + 0x190]
mov r8, rdx
lea rdx, str.https:__www.googleapis.com_drive_v3_files_1MVA7HvtqQLLZEWJ2lzDBvI8D0pkYTJjN_altmediakeyAIzaSyD_QWLVRGx58NvbEhXEH5kknnFYpH20wmw
mov rcx, rax
call fcn.00458cf0
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00402c37
mov dword [rbp + 0x19c], eax
lea rax, [rbp + 0x190]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x19b]
mov rcx, rax
call fcn.0044fbc0
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00459260
lea rax, [rbp + 0x18f]
mov rcx, rax
call fcn.0044fbc0
cmp dword [rbp + 0x19c], 0
js 0x407de8
lea rdx, [0x00496252]
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x407e11
lea rdx, str.Failed_to_download_resources............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
mov rax, qword [0x004bb040]
test rax, rax
je 0x407e62
mov rbx, qword [0x004bb040]
lea rdx, str.Found_browser_window_handle:
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov rdx, rbx
mov rcx, rax
call fcn.00457150
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
jmp 0x407ef9
lea rdx, str.Error:_Chrome_or_msedge_is_not_running...............
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
lea rdx, [0x00496c58]
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Step_1:_Goto_Windows_Settings........_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Step_2:_Goto_Apps............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Step_3:_Goto_default_apps..........._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rdx, str.Step_4:_Select_chrome_or_msedge_as_your_default_web_browser................_n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
lea rcx, str.pause
call sub.msvcrt.dll_system
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdx, str.Checking_ads.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.004071b1
mov ebx, eax
lea rdx, str.Total_Number_of_ads:
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov edx, ebx
mov rcx, rax
call fcn.00457300
mov rdx, qword [0x0049c9e0]
mov rcx, rax
call fcn.00457100
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, str.Showing_ads............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
call fcn.00407995
call fcn.00407ad9
call fcn.004071b1
mov ecx, eax
call fcn.00406fef
mov byte [0x004bb048], 1
lea rdx, str.done__Thanks.............._n
mov rcx, qword [0x0049c9d0]
call fcn.0047c280
mov ecx, 0x5dc
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rcx, [0x00496003]
call sub.msvcrt.dll_system
lea rcx, str.ad.txt
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
mov ebx, 1
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.00467540
cmp ebx, 1
je 0x407fe0
jmp 0x408049
nop
jmp 0x408049
add rsp, 0x228
pop rbx
pop rbp
ret