Function at 0x701a00
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x29c
mov eax, dword [0x7122e4]
xor eax, esp
mov dword [esp + 0x298], eax
cmp dword [0x712308], 0
mov eax, dword [esp + 0x2a0]
push esi
mov dword [esp + 0x1c], eax
jne 0x701afd
push 0x110
xor esi, esi
lea eax, [esp + 0x2c]
push esi
push eax
call sub.vcruntime140.dll_memset
add esp, 0xc
mov dword [esp + 0x24], 0x114
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
push dword [esp + 0x34]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x7074dc
call fcn.00702520
add esp, 0x10
cmp dword [esp + 0x34], 2
jne 0x701ac0
mov eax, dword [esp + 0x28]
cmp eax, 6
jne 0x701a96
cmp dword [esp + 0x2c], 1
jne 0x701ab3
push 0x707504
call fcn.00702520
mov esi, 3
jmp 0x701ab0
cmp eax, 0xa
jne 0x701ab3
cmp dword [esp + 0x2c], esi
jne 0x701ab3
push 0x707528
call fcn.00702520
mov esi, 5
add esp, 4
mov eax, dword [esp + 0x30]
mov dword [0x71230c], eax
test esi, esi
jne 0x701acd
push 0x70754c
call fcn.00702520
add esp, 4
push 0x707568
call fcn.00702520
add esp, 4
mov dword [0x712308], esi
test esi, esi
jne 0x701afd
lea eax, [esi - 0x65]
pop esi
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.007062b2
add esp, 0x29c
ret
push pe_nt_image_headers32
mov dword [esp + 8], 0
mov dword [esp + 0xc], pe_nt_image_headers32
call sub.ucrtbase.dll_malloc
add esp, 4
mov dword [esp + 0xc], eax
mov byte [eax], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x701b49
cmp eax, 0x80010106
je 0x701b45
mov esi, 0xffffff9b
mov ecx, 0x65
jmp 0x701c18
xor eax, eax
jmp 0x701b4e
mov eax, 1
cmp word [0x7122fc], 0
mov word [0x7122f8], ax
jne 0x701b94
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x701b89
mov esi, 0xffffff9a
mov ecx, 0x66
jmp 0x701c18
mov eax, 1
mov word [0x7122fc], ax
push 0x712304
push 0x70e364
push 1
push 0
push 0x70e354
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x701bbd
mov esi, 0xffffff99
mov ecx, 0x67
jmp 0x701c18
mov eax, dword [0x712304]
push 0x712300
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push 0x7072cc
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jns 0x701bf0
mov esi, 0xffffff98
mov ecx, 0x68
jmp 0x701c18
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [0x712300]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x701c49
mov esi, 0xffffff97
mov ecx, 0x69
push eax
push ecx
push 0x7072b0
call fcn.00702520
push 0x707350
call fcn.00702520
add esp, 0x10
mov eax, esi
pop esi
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.007062b2
add esp, 0x29c
ret
push ebx
push ebp
push edi
lea eax, [esp + 0x158]
push eax
push 0x707370
call fcn.00702550
lea eax, [esp + 0x1b0]
push eax
push 0x707388
push 0x707398
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.007025d0
add esp, 0x1c
test eax, eax
jle 0x701cb5
mov edi, dword [esp + 0x18]
test edi, edi
je 0x701cb1
mov esi, dword [esp + 0x10]
lea eax, [esi + 1]
push eax
call sub.ucrtbase.dll_malloc
push esi
mov ebp, eax
push edi
push ebp
call sub.ucrtbase.dll_strncpy
add esp, 0x10
mov byte [esi + ebp], 0
jmp 0x701ccf
xor ebp, ebp
jmp 0x701ccf
push 0x7073a8
call sub.ucrtbase.dll__mbsdup
mov ebp, eax
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.00701890
add esp, 0xc
lea eax, [esp + 0x1a8]
push eax
push 0x707388
push 0x7073b4
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
add esp, 0x14
test eax, eax
jle 0x701d33
push dword [esp + 0x10]
call sub.ucrtbase.dll_malloc
mov edx, ebp
mov ebx, eax
add esp, 4
mov dword [esp + 0x2c], ebx
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x701d11
mov ecx, dword [esp + 0x18]
sub edx, eax
add ecx, edx
mov edx, ebx
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x701d24
jmp 0x701d51
push 0x7073a8
call sub.ucrtbase.dll__mbsdup
mov ebx, eax
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x38], ebx
call fcn.00701890
add esp, 0xc
lea eax, [esp + 0x1a8]
push eax
push 0x7073bc
push 0x7073c8
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
lea eax, [esp + 0x1bc]
push eax
push 0x7073bc
push 0x7073d0
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.007025d0
lea eax, [esp + 0x1d0]
push eax
push 0x7073bc
push 0x7073e0
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.007025d0
lea eax, [esp + 0x1e4]
push eax
push 0x7073ec
push 0x707404
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.007025d0
add esp, 0x50
mov esi, eax
lea eax, [esp + 0x1a8]
push eax
push 0x707418
push 0x707420
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
add esi, eax
lea eax, [esp + 0x1bc]
push eax
push 0x707430
push 0x707420
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.007025d0
add eax, esi
mov dword [esp + 0x48], eax
lea eax, [esp + 0x1d0]
push eax
push 0x707430
push 0x70743c
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.007025d0
add esp, 0x3c
cmp dword [0x712308], 5
jl 0x701ec2
test byte [esp + 0x2b4], 1
jne 0x701ec2
lea eax, [esp + 0x1a8]
push eax
push 0x707444
push 0x707398
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
lea eax, [esp + 0x1bc]
push eax
push 0x707444
push 0x707454
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.007025d0
add esp, 0x28
mov eax, 0x707444
jmp 0x701ec7
mov eax, 0x707460
lea ecx, [esp + 0x1a8]
push ecx
push eax
push 0x707420
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
add esp, 0x14
xor edi, edi
cmp dword [0x712308], 5
jl 0x701f42
lea eax, [esp + 0x1a8]
push eax
push 0x707470
push 0x7073b4
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.007025d0
lea eax, [esp + 0x1bc]
push eax
push 0x707470
push 0x707420
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.007025d0
add esp, 0x28
mov edi, eax
mov eax, dword [0x712300]
test eax, eax
je 0x701f5d
mov ecx, dword [eax]
push eax
mov ecx, dword [ecx + 8]
call ecx
mov dword [0x712300], 0
mov ecx, dword [0x712304]
test ecx, ecx
je 0x701f79
mov eax, dword [ecx]
push ecx
mov eax, dword [eax + 8]
call eax
mov dword [0x712304], 0
cmp word [0x7122f8], 0
je 0x701f91
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov word [0x7122f8], ax
cmp dword [0x712308], 5
jge 0x70202f
test edi, edi
jne 0x70202f
lea eax, [esp + 0x1a8]
push eax
call fcn.007015b0
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x70202f
lea edi, [esp + 0x1a8]
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x701fd0
mov ebx, dword [esp + 0x10]
sub edi, ecx
mov ecx, dword [esp + 0x14]
add ebx, edi
lea eax, [ebx + 1]
cmp eax, ecx
jle 0x702009
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
mov esi, eax
add esp, 8
mov dword [esp + 0x18], esi
jmp 0x70200d
mov esi, dword [esp + 0x18]
push edi
lea eax, [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x18]
add eax, esi
push eax
call sub.ucrtbase.dll_strncat
mov edi, dword [esp + 0x28]
add esp, 0xc
mov dword [esp + 0x10], ebx
jmp 0x702037
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x20], 0
jg 0x70204a
test edi, edi
jne 0x70204a
lea ebx, [edi - 0x64]
jmp 0x7024cc
test ebx, ebx
jle 0x7024ba
movups xmm0, xmmword [0x707300]
mov al, byte [0x707310]
push 0x24
mov dword [esp + 0x28], 0
movups xmmword [esp + 0x148], xmm0
mov byte [esp + 0x158], al
call sub.ucrtbase.dll_malloc
add esp, 4
mov edi, eax
lea eax, [esp + 0x20]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
jne 0x7020b6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x707314
call fcn.00702520
add esp, 8
xor edi, edi
jmp 0x7021c0
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x30]
call dword [sym.imp.advapi32.dll_CryptCreateHash]
test eax, eax
jne 0x7020f9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0x707314
call fcn.00702520
add esp, 8
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
xor edi, edi
jmp 0x7021c0
push 0
push ebx
push esi
push dword [esp + 0x30]
call dword [sym.imp.advapi32.dll_CryptHashData]
test eax, eax
jne 0x70213b
push dword [sym.imp.kernel32.dll_GetLastError]
push 0x707334
call fcn.00702520
add esp, 8
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
xor edi, edi
jmp 0x7021c0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x10
push eax
lea eax, [esp + 0x1a0]
push eax
push 2
push dword [esp + 0x34]
call dword [sym.imp.advapi32.dll_CryptGetHashParam]
test eax, eax
je 0x7021a6
xor edx, edx
cmp dword [esp + 0x1c], edx
jbe 0x7021a6
mov ecx, edi
nop dword [eax]
movzx eax, byte [esp + edx + 0x198]
lea ecx, [ecx + 2]
shr eax, 4
movzx eax, byte [esp + eax + 0x144]
mov byte [ecx - 2], al
movzx eax, byte [esp + edx + 0x198]
inc edx
and eax, 0xf
movzx eax, byte [esp + eax + 0x144]
mov byte [ecx - 1], al
cmp edx, dword [esp + 0x1c]
jb 0x702170
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_CryptReleaseContext]
mov byte [edi + 0x20], 0
mov eax, dword [esp + 0x28]
mov ebx, 0xffffff9b
mov dword [eax], edi
xor eax, eax
test edi, edi
cmovne ebx, eax
mov dword [esp + 0x20], ebx
je 0x7024cc
test byte [esp + 0x2b4], 2
je 0x7024cc
cmp dword [0x712308], 5
lea eax, [esp + 0x1a8]
push dword [0x71230c]
jne 0x702207
push 0x7074c4
jmp 0x70220c
push 0x7074cc
push eax
call fcn.007017d0
add esp, 0xc
test esi, esi
je 0x70223a
push esi
call sub.ucrtbase.dll_free
add esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
call fcn.007018f0
mov eax, dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x18]
push eax
call fcn.00701890
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
lea edi, [esi + 1]
lea eax, [edi + 1]
cmp eax, ecx
jle 0x702286
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x70228a
mov eax, dword [esp + 0x18]
push 1
add eax, esi
push 0x7074d4
push eax
call sub.ucrtbase.dll_strncat
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], edi
push ebp
push eax
call fcn.00701800
mov esi, dword [esp + 0x24]
add esp, 0x14
mov ecx, dword [esp + 0x14]
lea edi, [esi + 1]
lea eax, [edi + 1]
cmp eax, ecx
jle 0x7022da
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x7022de
mov eax, dword [esp + 0x18]
push 1
add eax, esi
push 0x7074d4
push eax
call sub.ucrtbase.dll_strncat
push dword [esp + 0x38]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], edi
push eax
call fcn.00701800
add esp, 0x14
test byte [esp + 0x2b4], 1
je 0x70234f
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc ebx
lea eax, [ebx + 1]
cmp eax, edi
jle 0x702333
add edi, 0x100
push edi
push dword [esp + 0x1c]
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
jmp 0x702337
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
push 1
add eax, esi
push 0x7074d4
push eax
call sub.ucrtbase.dll_strncat
add esp, 0xc
jmp 0x7023b6
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edi, [esi + 3]
lea eax, [edi + 1]
cmp eax, ecx
jle 0x70237e
add ecx, 0x100
push ecx
push dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
call sub.ucrtbase.dll_realloc
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x702382
mov eax, dword [esp + 0x18]
push 3
add eax, esi
push 0x7074d8
push eax
call sub.ucrtbase.dll_strncat
lea eax, [esp + 0x1b4]
mov dword [esp + 0x1c], edi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00701890
mov esi, dword [esp + 0x2c]
add esp, 0x14
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 1]
mov dword [esp + 0x1c], eax
inc eax
cmp eax, edi
jle 0x7023d4
add edi, 0x100
push edi
push esi
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
push 1
lea eax, [esi + ebx]
push 0x7074d4
push eax
call sub.ucrtbase.dll_strncat
mov ebx, dword [esp + 0x28]
add esp, 0xc
lea eax, [ebx + 4]
cmp eax, edi
jle 0x702404
add edi, 0x100
push edi
push esi
call sub.ucrtbase.dll_realloc
add esp, 8
mov esi, eax
mov edi, esi
mov byte [esi + ebx], 0
xor edx, edx
test edi, edi
je 0x702444
mov al, byte [esi]
xor ebx, ebx
test al, al
je 0x702440
nop dword [eax + eax]
mov ecx, ebx
and ecx, 0x80000007
jns 0x70242f
dec ecx
or ecx, 0xfffffff8
inc ecx
inc ecx
movsx eax, al
imul ecx, eax
inc edi
inc ebx
mov al, byte [edi]
add edx, ecx
test al, al
jne 0x702420
mov ebx, dword [esp + 0x1c]
and edx, 0x8000000f
jns 0x702455
dec edx
or edx, 0xfffffff0
add edx, 1
js 0x702469
cmp edx, 0xa
jge 0x70245f
add dl, 0x30
jmp 0x70246b
cmp edx, 0x10
jge 0x702469
add dl, 0x57
jmp 0x70246b
mov dl, 0x58
mov eax, dword [esp + 0x28]
mov byte [esi + ebx], dl
mov byte [esi + ebx + 1], 0
inc ebx
push dword [eax]
call sub.ucrtbase.dll_free
add esp, 4
test esi, esi
je 0x7024ac
lea eax, [ebx + 1]
push eax
call sub.ucrtbase.dll_malloc
push ebx
mov edi, eax
push esi
push edi
call sub.ucrtbase.dll_strncpy
mov eax, dword [esp + 0x38]
add esp, 0x10
mov byte [edi + ebx], 0
mov ebx, dword [esp + 0x20]
mov dword [eax], edi
jmp 0x7024cc
mov eax, dword [esp + 0x28]
xor edi, edi
mov ebx, dword [esp + 0x20]
mov dword [eax], edi
jmp 0x7024cc
push 0x70748c
call fcn.00702520
add esp, 4
mov ebx, 0xffffff9d
test esi, esi
je 0x7024d9
push esi
call sub.ucrtbase.dll_free
add esp, 4
test ebp, ebp
je 0x7024e6
push ebp
call sub.ucrtbase.dll_free
add esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x7024f7
push eax
call sub.ucrtbase.dll_free
add esp, 4
mov ecx, dword [esp + 0x2a8]
mov eax, ebx
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.007062b2
add esp, 0x29c
ret