Function at 0x402cc0
Capabilities:
Create directory
Get session user name
Hash data using sha1
Read file on windows

Disassembly:
push ebp
mov eax, 0x813c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004044e0
mov dword [ebp - 0x28], 0x54e014
xor ecx, ecx
mov eax, str.PAR_TEMP
mov dword [ebp - 0x8110], ecx
mov dword [ebp - 0x24], str.C:TEMP
mov dword [ebp - 0x20], 0x54e02e
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x48], str.PAR_TMPDIR
mov dword [ebp - 0x44], str.TMPDIR
mov dword [ebp - 0x40], str.TEMPDIR
mov dword [ebp - 0x3c], str.TEMP
mov dword [ebp - 0x38], 0x54e188
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x58], str.USER
mov dword [ebp - 0x54], str.USERNAME
mov dword [ebp - 0x50], 0
call fcn.004013b0
test eax, eax
mov edi, eax
je 0x402d4c
cmp byte [eax], 0
jne 0x403050
mov edx, 0x7fff
mov dword [ebp - 0x810c], edx
mov dword [esp], 0x7fff
call sub.msvcrt.dll_malloc
mov ebx, eax
lea eax, [ebp - 0x810c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_GetUserNameA
sub esp, 8
call fcn.00402b30
test eax, eax
mov ebx, eax
je 0x403194
mov dword [esp], ebx
mov edi, ebx
call sub.msvcrt.dll_strlen
lea eax, [eax + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x8120], eax
mov ebx, eax
movzx eax, byte [edi]
test al, al
je 0x402dd3
nop
mov dword [esp], ebx
movzx eax, al
inc edi
mov dword [esp + 8], eax
mov eax, str._02x
add ebx, 2
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
movzx eax, byte [edi]
test al, al
jne 0x402db0
mov eax, dword [ebp - 0x48]
xor esi, esi
test eax, eax
je 0x402dfd
lea esi, [esi]
call fcn.004013b0
test eax, eax
mov edi, eax
je 0x402df4
cmp byte [eax], 0
jne 0x403026
inc esi
mov eax, dword [ebp + esi*4 - 0x48]
test eax, eax
jne 0x402de0
mov eax, str.WinDir
call fcn.004013b0
test eax, eax
mov edi, eax
je 0x402e16
cmp byte [eax], 0
jne 0x403140
mov eax, dword [ebp - 0x8110]
xor esi, esi
test eax, eax
je 0x403100
mov eax, dword [ebp - 0x8110]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp], str.par_
mov ebx, eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x8120]
add ebx, eax
mov dword [esp], edx
call sub.msvcrt.dll_strlen
mov dword [esp], 0x54e1ab
add ebx, eax
call sub.msvcrt.dll_strlen
lea ebx, [ebx + eax + 0x400]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x8118], eax
mov eax, dword [ebp - 0x8120]
mov dword [esp + 0x14], eax
mov eax, str.par_
mov dword [esp + 0x10], eax
mov eax, dword [0x54d510]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8110]
mov eax, str._s_s_s_s
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x8118]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov edx, dword [ebp - 0x8118]
mov dword [esp], edx
call sub.msvcrt.dll__mkdir
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x8114], eax
mov eax, str.PATH
call fcn.004013b0
test eax, eax
je 0x403068
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [esp + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [esp], eax
call fcn.004015d0
test eax, eax
mov esi, eax
je 0x403068
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp eax, 8
mov ebx, eax
jge 0x403080
call fcn.00401a50
test eax, eax
jne 0x402f3e
mov dword [esp], esi
mov ecx, 0x8000
mov dword [esp + 4], ecx
call sub.msvcrt.dll__open
mov dword [ebp - 0x811c], eax
test eax, eax
jne 0x4031cf
mov edx, 0x54e107
mov eax, 0x54e097
mov edi, str._s_stemp__u_s
call fcn.004013c0
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], eax
mov edx, 0x54e1ab
xor ebx, ebx
mov dword [esp + 0x14], edx
mov eax, dword [0x54d510]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8118]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x8114]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
jmp 0x402fdb
call sub.msvcrt.dll__errno
cmp dword [eax], 0x11
jne 0x402fec
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], eax
mov esi, 0x54e1ab
inc ebx
mov dword [esp + 0x18], esi
mov ecx, str._s_stemp__u__u_s
mov dword [esp + 0x14], ebx
mov eax, dword [0x54d510]
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8118]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x8114]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov edx, dword [ebp - 0x8114]
mov dword [esp], edx
call sub.msvcrt.dll__mkdir
inc eax
je 0x402f90
mov eax, dword [ebp - 0x8118]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edx, dword [ebp - 0x8114]
mov eax, str.PAR_TEMP
call fcn.004013c0
mov edx, dword [ebp - 0x8114]
mov dword [esp], edx
call fcn.00402ba0
mov eax, dword [ebp - 0x8114]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00402b40
test eax, eax
je 0x402df4
mov dword [esp], edi
call sub.msvcrt.dll__strdup
mov dword [ebp - 0x8110], eax
test eax, eax
jne 0x402e16
jmp 0x402dfd
mov dword [esp], eax
call fcn.00402ba0
mov dword [esp], edi
call sub.msvcrt.dll__strdup
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp eax, 8
mov ebx, eax
jl 0x402f16
lea eax, [esi + eax - 8]
mov edi, str.parl.exe
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402f16
cmp ebx, 8
je 0x4030b4
mov eax, dword [0x54d510]
movzx eax, byte [eax]
cmp byte [esi + ebx - 9], al
jne 0x402f16
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 4]
test ebx, ebx
je 0x402f16
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
cmp eax, 3
jbe 0x402f16
lea eax, [ebx + eax - 4]
mov ebx, str..par
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402f16
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
jmp 0x402f16
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x402e26
nop
lea esi, [esi]
cmp byte [edi], 0
je 0x402e26
mov eax, edi
call fcn.00402b40
test eax, eax
jne 0x403184
mov eax, dword [ebp - 0x8110]
inc esi
test eax, eax
jne 0x402e26
mov edi, dword [ebp + esi*4 - 0x28]
test edi, edi
jne 0x403110
jmp 0x402e26
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 6
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [esp + 8], edi
mov ebx, eax
mov eax, str._s_temp
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov eax, ebx
call fcn.00402b40
test eax, eax
je 0x4035f5
mov dword [ebp - 0x8110], ebx
jmp 0x402e16
mov dword [esp], edi
call sub.msvcrt.dll__strdup
mov dword [ebp - 0x8110], eax
jmp 0x403124
mov eax, dword [ebp - 0x58]
xor esi, esi
jmp 0x4031ad
inc esi
test ebx, ebx
jne 0x402d89
mov eax, dword [ebp + esi*4 - 0x58]
test eax, eax
je 0x4035c6
call fcn.004013b0
test eax, eax
je 0x4031a0
cmp byte [eax], 0
je 0x4031a0
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov ebx, eax
jmp 0x4031a0
mov dword [esp], eax
mov edx, 2
mov edi, 0xffffffee
mov dword [esp + 8], edx
mov esi, 6
mov dword [esp + 4], edi
call sub.msvcrt.dll__lseek
mov dword [esp + 8], esi
lea edx, [ebp - 0x80e8]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x811c]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp byte [ebp - 0x80e8], 0
jne 0x403220
cmp byte [ebp - 0x80e7], 0x43
je 0x403602
xor eax, eax
mov edi, 0x10325476
mov esi, 0xc3d2e1f0
mov dword [esp + 8], eax
xor eax, eax
xor ebx, ebx
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x811c]
mov dword [esp], edx
call sub.msvcrt.dll__lseek
mov dword [ebp - 0xdc], edi
mov eax, 0x67452301
xor ecx, ecx
mov dword [ebp - 0xe8], eax
mov eax, 0xefcdab89
xor edx, edx
mov dword [ebp - 0xe4], eax
mov eax, 0x98badcfe
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x8c], edx
lea esi, [esi]
mov eax, 0x8000
lea edx, [ebp - 0x80e8]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x811c]
mov dword [esp], eax
call sub.msvcrt.dll__read
test eax, eax
mov edi, eax
jle 0x4033ba
mov edx, dword [ebp - 0xd4]
lea eax, [ebp - 0x80e8]
mov ebx, edi
mov dword [ebp - 0x8124], eax
mov eax, dword [ebp - 0xd0]
lea ecx, [edx + edi*8]
mov dword [ebp - 0xd4], ecx
cmp ecx, edx
adc eax, 0
mov dword [ebp - 0xd0], eax
mov eax, edi
shr eax, 0x1d
add dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x40335c
mov esi, 0x40
sub esi, eax
cmp esi, edi
jle 0x40330b
mov esi, edi
mov dword [esp + 8], esi
lea eax, [eax + ebp - 0xcc]
mov ebx, edi
mov dword [esp], eax
lea edx, [ebp - 0x80e8]
sub ebx, esi
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
lea eax, [ebp - 0x80e8]
add eax, esi
mov dword [ebp - 0x8124], eax
mov eax, dword [ebp - 0x8c]
add eax, esi
mov dword [ebp - 0x8c], eax
cmp eax, 0x40
jne 0x403290
lea eax, [ebp - 0xe8]
call fcn.00401aa0
lea edi, [ebp - 0xcc]
jmp 0x403394
mov eax, 0x40
sub ebx, 0x40
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x8124]
mov dword [esp], edi
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
add dword [ebp - 0x8124], 0x40
lea eax, [ebp - 0xe8]
call fcn.00401aa0
cmp ebx, 0x3f
jg 0x403364
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x8124]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x8c], ebx
jmp 0x403290
mov edx, dword [ebp - 0x811c]
lea ebx, [ebp - 0x8108]
mov dword [esp], edx
call sub.msvcrt.dll__close
mov eax, dword [ebp - 0xd4]
mov esi, dword [ebp - 0xd0]
mov edx, eax
mov dword [ebp - 0x8128], eax
shr edx, 3
and edx, 0x3f
mov al, pe_nt_image_headers32
mov byte [edx + ebp - 0xcc], al
inc edx
cmp edx, 0x38
jle 0x4035d0
mov eax, 0x40
lea edi, [ebp - 0xcc]
sub eax, edx
mov dword [esp + 8], eax
lea edx, [ebp + edx - 0xcc]
xor eax, eax
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xe8]
call fcn.00401aa0
cld
mov ecx, 0xe
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, esi
mov edx, esi
shr eax, 0x18
mov byte [ebp - 0x94], al
mov eax, esi
shr eax, 0x10
mov byte [ebp - 0x93], al
mov eax, esi
shr eax, 8
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x8128]
lea esi, [ebp - 0x88]
mov byte [ebp - 0x91], dl
mov edi, esi
shr eax, 0x18
mov byte [ebp - 0x90], al
mov eax, dword [ebp - 0x8128]
shr eax, 0x10
mov byte [ebp - 0x8f], al
mov eax, dword [ebp - 0x8128]
shr eax, 8
mov byte [ebp - 0x8e], al
movzx eax, byte [ebp - 0x8128]
mov byte [ebp - 0x8d], al
lea eax, [ebp - 0xe8]
call fcn.00401aa0
mov edx, dword [ebp - 0xe8]
mov eax, edx
shr eax, 0x18
mov byte [ebx], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, edx
shr eax, 8
mov byte [ebx + 2], al
mov byte [ebx + 3], dl
mov edx, dword [ebp - 0xe4]
mov eax, edx
mov byte [ebx + 7], dl
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 6], al
mov edx, dword [ebp - 0xe0]
mov eax, edx
mov byte [ebx + 0xb], dl
shr eax, 0x18
mov byte [ebx + 8], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 9], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0xa], al
mov edx, dword [ebp - 0xdc]
mov eax, edx
mov byte [ebx + 0xf], dl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0xe], al
mov edx, dword [ebp - 0xd8]
mov eax, edx
mov byte [ebx + 0x13], dl
shr eax, 0x18
mov byte [ebx + 0x10], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 0x11], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0x12], al
xor ebx, ebx
lea esi, [esi]
lea edi, [edi]
movzx eax, byte [ebx + ebp - 0x8108]
inc ebx
mov dword [esp], edi
add edi, 2
mov dword [esp + 8], eax
mov eax, str._02x
mov dword [esp + 4], eax
call sub.msvcrt.dll_sprintf
cmp ebx, 0x13
jle 0x403560
mov byte [ebp - 0x60], 0
mov ebx, 0x54e1ab
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov eax, dword [0x54d510]
mov ecx, str._s_scache__s_s
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x8118]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov eax, dword [ebp - 0x8114]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
jmp 0x402fec
mov ebx, str.SYSTEM
jmp 0x402d89
mov eax, 0x38
sub eax, edx
lea edx, [ebp + edx - 0xcc]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memset
jmp 0x403436
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x402e16
cmp byte [ebp - 0x80e6], 0x41
jne 0x403220
cmp byte [ebp - 0x80e5], 0x43
jne 0x403220
cmp byte [ebp - 0x80e4], 0x48
jne 0x403220
cmp byte [ebp - 0x80e3], 0x45
jne 0x403220
mov ecx, 0xffffffc6
mov ebx, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x811c]
mov dword [esp], edx
call sub.msvcrt.dll__lseek
mov edx, 0x29
lea eax, [ebp - 0x80e8]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x811c]
mov dword [esp], edx
call sub.msvcrt.dll__read
mov eax, 0x54e1ab
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x80e8]
mov dword [esp + 0x10], eax
jmp 0x403597