Function at 0x41ab90
Capabilities:
Create new key via cryptacquirecontext
Get disk information
Get file size
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Link many functions at runtime
Move file
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d32b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2b0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [ebx + 8]
mov esi, dword [0x4574c0]
push 0xf0000000
push 0x18
mov byte [ebp - 0x199], al
mov eax, dword [0x4574c8]
push 0
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x1c0]
push 0
push eax
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1a8], 0
mov byte [ebp - 0x1c8], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41ad8c
push 0x30
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x260], 0
push 0
push eax
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x270], 0
call fcn.0042a4e0
mov ax, word [0x4574e0]
add esp, 0xc
mov word [ebp - 0x1c], ax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1a4], 0
push 0x10212
push eax
push dword [0x45764c]
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x278], 4
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x26c], 0
movq qword [ebp - 0x2c0], xmm0
movups xmmword [ebp - 0xb0], xmm0
mov dword [ebp - 0x1b0], 0
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x1b4], 0
movq qword [ebp - 0x90], xmm0
movq qword [ebp - 0x288], xmm0
mov dword [ebp - 0x1a], 0x5c003a
mov word [ebp - 0x16], ax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x198], edi
test edi, edi
je 0x41ad82
push 0x300
push 0
push dword [0x45764c]
mov dword [ebp - 0x298], 0x20
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x290], eax
test eax, eax
jne 0x41ad93
push edi
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [0x45771c], 8
xor eax, eax
jmp 0x41c274
cmp byte [ebp - 0x199], 0
mov ecx, str.HashMD5
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, str.SHA1
cmove eax, ecx
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x254]
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
push 0x2400
call edi
sub esp, 8
lea ecx, [ebp - 0x248]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0x240]
lea eax, [ebp - 0x248]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0x20a]
test eax, eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0
mov edx, 1
mov dword [ebp - 0x280], 0
push eax
cmovne ecx, edx
push 0x2000e
mov byte [ebp - 0x20a], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41ae9d
lea eax, [ebp - 0x280]
push eax
push 2
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x29c], eax
mov eax, 1
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0x250], eax
cmp esi, eax
jbe 0x41b4ac
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [ebp - 0x258]
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41b5bf
mov edi, dword [ebp - 0x294]
mov eax, dword [ebp - 0x298]
cmp edi, eax
jne 0x41af5a
add eax, eax
mov dword [ebp - 0x298], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [ebp - 0x1ac]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov dword [ebp - 0x290], ecx
test ecx, ecx
je 0x41b4a6
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x2a0], eax
lea eax, [edi + edi*2]
lea edi, [ecx + eax*8]
mov dword [ebp - 0x290], edi
jmp 0x41af60
mov edi, dword [ebp - 0x290]
cmp word [esi], 0x2f
jne 0x41b24c
movzx eax, word [esi + 2]
cmp eax, 0x4d
je 0x41af78
cmp eax, 0x6d
jne 0x41af98
movzx ecx, word [esi + 4]
cmp ecx, 0x44
je 0x41af86
cmp ecx, 0x64
jne 0x41af98
cmp word [esi + 6], 0x35
jne 0x41af98
cmp word [esi + 8], 0
je 0x41b48d
cmp eax, 0x53
je 0x41afa2
cmp eax, 0x73
jne 0x41afd0
movzx ecx, word [esi + 4]
cmp ecx, 0x48
je 0x41afb0
cmp ecx, 0x68
jne 0x41afd0
movzx ecx, word [esi + 6]
cmp ecx, 0x41
je 0x41afbe
cmp ecx, 0x61
jne 0x41afd0
cmp word [esi + 8], 0x31
jne 0x41afd0
cmp word [esi + 0xa], 0
je 0x41b48d
cmp eax, 0x41
je 0x41afda
cmp eax, 0x61
jne 0x41b001
movzx ecx, word [esi + 4]
cmp ecx, 0x52
je 0x41afe8
cmp ecx, 0x72
jne 0x41b001
cmp word [esi + 6], 0
jne 0x41b001
cmp dword [0x4574d4], 0
je 0x41c292
jmp 0x41b24c
cmp eax, 0x41
je 0x41b00f
cmp eax, 0x61
jne 0x41b1b0
cmp word [esi + 4], 0x3d
jne 0x41b1b0
lea edx, [esi + 6]
mov byte [ebp - 0x191], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1d8], xmm0
test edx, edx
je 0x41b19b
movzx eax, word [edx]
test ax, ax
je 0x41b19b
cmp ax, 9
je 0x41b0ef
cmp ax, 0x20
je 0x41b0ef
cmp ax, 0xd
je 0x41b0ef
cmp ax, 0xa
je 0x41b0ef
mov ecx, 0xa0
cmp ax, cx
je 0x41b0ef
cmp ax, 0xc
je 0x41b0ef
cmp ax, 0xb
je 0x41b0ef
mov ecx, 0x85
cmp ax, cx
je 0x41b0ef
mov ecx, 0x2028
cmp ax, cx
je 0x41b0ef
mov ecx, 0x2029
cmp ax, cx
je 0x41b0ef
mov ecx, 0x202f
cmp ax, cx
je 0x41b0ef
mov ecx, 0x1680
cmp ax, cx
je 0x41b0ef
mov ecx, 0x180e
cmp ax, cx
je 0x41b0ef
mov ecx, 0x1fff
cmp ax, cx
jbe 0x41b0d1
mov ecx, 0x200c
cmp ax, cx
jb 0x41b0ef
mov ecx, 0x3000
cmp ax, cx
je 0x41b0ef
mov ecx, 0xfeff
cmp ax, cx
je 0x41b0ef
mov ecx, 0x205f
cmp ax, cx
jne 0x41b0fb
movzx eax, word [edx + 2]
add edx, 2
jmp 0x41b043
mov dword [ebp - 0x1a0], edx
cmp ax, 0x2b
je 0x41b117
movzx ecx, ax
cmp ax, 0x2d
jne 0x41b124
mov byte [ebp - 0x191], 1
movzx ecx, word [edx + 2]
add edx, 2
mov dword [ebp - 0x1a0], edx
mov esi, dword [ebp - 0x1d8]
cmp cx, 0x30
jb 0x41b182
mov edi, dword [ebp - 0x1d4]
movzx edx, cx
nop dword [eax]
cmp dx, 0x39
ja 0x41b182
mov eax, esi
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc edi, ecx
shld edi, esi, 1
add esi, esi
add esi, eax
mov eax, dword [ebp - 0x1a0]
adc edi, edx
sub esi, 0x30
sbb edi, 0
add eax, 2
mov dword [ebp - 0x1a0], eax
movzx eax, word [eax]
mov edx, eax
cmp eax, 0x30
jae 0x41b140
mov eax, esi
neg eax
cmp byte [ebp - 0x191], 0
cmove eax, esi
or dword [ebp - 0x1bc], eax
jmp 0x41b48d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x1bc], eax
jmp 0x41b48d
cmp eax, 0x46
je 0x41b1be
cmp eax, 0x66
jne 0x41b24c
cmp word [esi + 4], 0x3d
jne 0x41b24c
cmp word [ebp - 0x1b4], 0
jne 0x41b24c
lea ecx, [esi + 6]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x41b1e3
cmp eax, 9
jne 0x41b1e8
add ecx, 2
jmp 0x41b1d6
test ax, ax
je 0x41b24c
lea eax, [esi + 6]
mov dword [ebp - 0x26c], eax
test eax, eax
je 0x41b224
push 0x457630
mov edx, 0x7fff
mov ecx, eax
call fcn.00402470
test eax, eax
js 0x41b21e
movzx eax, word [0x457630]
mov dword [ebp - 0x1b4], eax
jmp 0x41b24c
mov eax, dword [ebp - 0x26c]
mov dword [0x457630], 0
test eax, eax
je 0x41b242
cmp word [eax], 0
mov dword [ebp - 0x1b4], 0x7fff
jne 0x41b24c
mov dword [ebp - 0x1b4], 0
push ecx
lea eax, [ebp - 0x1cc]
mov ecx, esi
push eax
lea edx, [ebp - 0x198]
call fcn.00404830
add esp, 8
test al, al
je 0x41b48d
mov ax, word [0x457638]
mov esi, dword [ebp - 0x198]
push 0
push 0x2000080
push 3
mov word [edi + 4], ax
mov eax, dword [ebp - 0x1cc]
push 0
push 7
sub eax, esi
push 0x120089
sar eax, 1
push esi
mov word [edi + 6], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41b2cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41b48d
cmp dword [0x4574d4], 0
je 0x41c298
jmp 0x41b48d
push 0x23
push 8
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], 0
push eax
lea eax, [ebp - 0x2c0]
push eax
push edi
call dword [0x4576d0]
test eax, eax
jns 0x41b341
mov ax, word [esi + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x41b312
cmp eax, 2
jne 0x41b486
push 4
push 0x28
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x2c0]
push eax
push edi
call dword [0x4576d0]
test eax, eax
js 0x41b486
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x288], eax
jmp 0x41b352
mov eax, dword [ebp - 0x288]
test eax, 0x400
jne 0x41b486
test al, 0x10
je 0x41b3cb
push ecx
push 0xd
push dword [ebp - 0x26c]
lea edx, [ebp - 0x2b8]
push esi
lea ecx, [ebp - 0x248]
call fcn.00404c20
add esp, 0x10
test al, al
jne 0x41b3ba
cmp dword [0x45771c], 0
je 0x41b3ba
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41c225
cmp dword [0x45771c], 5
je 0x41b547
mov esi, dword [ebp - 0x2a0]
mov dword [ebp - 0x1ac], esi
jmp 0x41b48d
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x1ac], eax
jmp 0x41b486
cmp dword [0x4574d4], 0
jne 0x41b3f9
mov eax, dword [ebp - 0x290]
mov edx, esi
mov ecx, dword [ebp - 0x29c]
push 0x42
movzx eax, word [eax + 6]
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x41b540
mov esi, dword [ebp - 0x290]
add esi, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi]
add dword [ebp - 0x1f8], eax
mov eax, dword [esi + 4]
mov esi, dword [ebp - 0x290]
adc dword [ebp - 0x1f4], eax
movzx eax, word [esi + 4]
lea eax, [eax*2 + 2]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esi + 0x10], ecx
test ecx, ecx
je 0x41b560
movzx eax, word [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x198]
push ecx
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0x1e8], 1
adc dword [ebp - 0x1e4], 0
add esi, 0x18
inc dword [ebp - 0x2b4]
inc dword [ebp - 0x294]
mov dword [ebp - 0x290], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp eax, dword [ebp - 0x1c4]
jb 0x41aee0
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 0x1e8], 0
je 0x41c225
test byte [ebp - 0x1bc], 4
je 0x41b664
cmp byte [ebp - 0x199], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x41b600
push str.A_SHAInit
push dword [0x457654]
call esi
push str.A_SHAUpdate
push dword [0x457654]
mov dword [ebp - 0x268], eax
call esi
push str.A_SHAFinal
push dword [0x457654]
mov dword [ebp - 0x264], eax
call esi
cmp dword [ebp - 0x268], 0
mov dword [ebp - 0x270], eax
je 0x41b664
cmp dword [ebp - 0x264], 0
je 0x41b664
test eax, eax
je 0x41b664
mov byte [ebp - 0x1c8], 1
jmp 0x41b664
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4574d4], 0
je 0x41c298
mov dword [0x45771c], 5
jmp 0x41b575
lea ecx, [ebp - 0x248]
mov dword [0x45771c], 8
call fcn.004036e0
cmp byte [ebp - 0x20a], 0
je 0x41b589
lea ecx, [ebp - 0x248]
call fcn.004036e0
sub esp, 8
lea ecx, [ebp - 0x248]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0x248]
push 0x5dc
call fcn.00403330
jmp 0x41c225
push 0x65
push dword [ebp - 0x240]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x244]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x20a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x244]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x41c225
push str.MD5Init
push dword [0x457654]
call esi
push str.MD5Update
push dword [0x457654]
mov dword [ebp - 0x260], eax
call esi
push str.MD5Final
push dword [0x457654]
mov dword [ebp - 0x25c], eax
call esi
cmp dword [ebp - 0x260], 0
mov dword [ebp - 0x274], eax
je 0x41b664
cmp dword [ebp - 0x25c], 0
je 0x41b664
mov edx, dword [ebp - 0x1c8]
test eax, eax
movzx edx, dl
mov eax, 1
cmovne edx, eax
mov dword [ebp - 0x1c8], edx
mov ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x1f8]
test ecx, ecx
jne 0x41b685
cmp eax, 0x63
ja 0x41b685
mov dword [ebp - 0x1e0], 1
jmp 0x41b696
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0x1e0], eax
push 0x65
push dword [ebp - 0x240]
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x204], 0
mov byte [ebp - 0x209], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x244]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x20a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x244]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0x20f], 0
je 0x41b72a
mov eax, dword [ebp - 0x23c]
mov byte [ebp - 0x20f], 0
test eax, eax
je 0x41b72a
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0x23c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x45754c]
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0x1d8], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
cmp byte [ebp - 0x199], 0
mov dword [ebp - 0x1d4], eax
je 0x41b78d
mov eax, dword [0x44ca30]
movq xmm0, qword [str.SHA1:]
mov dword [0x457728], eax
lea eax, [ebp - 0x1d8]
push eax
push 0xfe
movq qword [0x457720], xmm0
push 0x45772c
jmp 0x41b7b8
mov ax, word [0x44ca48]
movups xmm0, xmmword [str.HashMD5:]
mov word [0x457730], ax
lea eax, [ebp - 0x1d8]
push eax
push 0xfb
movups xmmword [0x457720], xmm0
push 0x457732
push 0x400
push 0
push dword [0x4563bc]
push 0x2400
call edi
mov eax, dword [ebp - 0x244]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x244]
push 0
mov byte [ebp - 0x209], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov edi, dword [ebp - 0x1e8]
mov esi, dword [ebp - 0x1ac]
mov dword [ebp - 0x248], eax
mov eax, 0x5f
mov word [ebp - 0x88], ax
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x290], esi
test edi, edi
je 0x41c208
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41c208
mov eax, dword [ebp - 0x1f0]
movzx ecx, word [esi + 6]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1cc], eax
mov eax, dword [esi + 0x10]
push 0
push 1
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x244]
push eax
push 2
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
push 0
push 0xa000080
push 3
push 0
push 7
push SysReAllocString
mov dword [ebp - 0x248], eax
push dword [esi + 0x10]
mov dword [ebp - 0x1b0], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1b4], esi
cmp esi, 0xffffffff
je 0x41c13f
cmp byte [ebp - 0x199], 0
je 0x41bbce
cmp byte [ebp - 0x1c8], 0
lea edi, [ebp - 0x30]
je 0x41b9fa
lea eax, [ebp - 0x190]
push eax
call dword [ebp - 0x268]
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x41b9c8
nop word [eax + eax]
mov ecx, dword [ebp - 0x1a4]
test ecx, ecx
je 0x41b9c8
push ecx
push dword [ebp - 0x198]
lea eax, [ebp - 0x190]
push eax
call dword [ebp - 0x264]
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41b9de
mov ecx, dword [ebp - 0x1f0]
add ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1ec]
push 0
push dword [ebp - 0x1e0]
adc eax, 0
mov dword [ebp - 0x1f0], ecx
push eax
push ecx
mov dword [ebp - 0x1ec], eax
call fcn.0043d1d0
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
cmp edx, dword [ebp - 0x204]
jb 0x41b99f
ja 0x41b994
cmp eax, dword [ebp - 0x208]
jbe 0x41b99f
lea ecx, [ebp - 0x248]
call fcn.004031a0
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1b0], eax
test eax, eax
jne 0x41b910
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x190]
push eax
call dword [ebp - 0x270]
jmp 0x41bb51
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1a0]
mov dword [0x45771c], 0x4c7
jmp 0x41c1e4
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41c139
push 0
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 4
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41ba49
cmp dword [ebp - 0x1b8], 0
jne 0x41ba53
mov dword [ebp - 0x1b8], 0x14
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c12d
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x41ba9d
push 0
push eax
push dword [ebp - 0x198]
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41c12d
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41bba6
mov ecx, dword [ebp - 0x1f0]
mov esi, dword [ebp - 0x1a4]
add ecx, esi
mov eax, dword [ebp - 0x1ec]
push 0
push dword [ebp - 0x1e0]
adc eax, 0
mov dword [ebp - 0x1f0], ecx
push eax
push ecx
mov dword [ebp - 0x1ec], eax
call fcn.0043d1d0
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
cmp edx, dword [ebp - 0x204]
jb 0x41bb12
ja 0x41bb01
cmp eax, dword [ebp - 0x208]
jbe 0x41bb12
lea ecx, [ebp - 0x248]
call fcn.004031a0
mov esi, dword [ebp - 0x1a4]
cmp esi, 0x10000
mov esi, dword [ebp - 0x1b4]
je 0x41ba53
push 0
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x30]
push eax
push 2
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x1b0], 0
je 0x41c139
lea edx, [ebp - 0x88]
mov byte [ebp - 0x191], 0x14
nop dword [eax + eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, word [eax*2 + 0x44e568]
mov word [edx + 2], ax
add edx, 4
add byte [ebp - 0x191], 0xff
movzx eax, word [ecx*2 + 0x44e568]
mov word [edx], ax
jne 0x41bb70
jmp 0x41be91
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [ebp - 0x1a0]
mov dword [0x45771c], 0x4c7
jmp 0x41c1e4
cmp byte [ebp - 0x1c8], 0
lea edi, [ebp - 0xc0]
je 0x41bcec
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x260]
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1b0], eax
test eax, eax
je 0x41bcda
nop word [eax + eax]
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x41bcda
push eax
push dword [ebp - 0x198]
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x25c]
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41b9de
mov ecx, dword [ebp - 0x1f0]
add ecx, dword [ebp - 0x1a4]
mov eax, dword [ebp - 0x1ec]
push 0
push dword [ebp - 0x1e0]
adc eax, 0
mov dword [ebp - 0x1f0], ecx
push eax
push ecx
mov dword [ebp - 0x1ec], eax
call fcn.0043d1d0
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
cmp edx, dword [ebp - 0x204]
jb 0x41bcaf
ja 0x41bca4
cmp eax, dword [ebp - 0x208]
jbe 0x41bcaf
lea ecx, [ebp - 0x248]
call fcn.004031a0
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, eax
mov dword [ebp - 0x1b0], ecx
test ecx, ecx
jne 0x41bc20
lea eax, [ebp - 0x118]
push eax
call dword [ebp - 0x274]
jmp 0x41be46
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x41c139
push 0
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 4
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41bd3b
cmp dword [ebp - 0x1b8], 0
jne 0x41bd45
mov dword [ebp - 0x1b8], 0x10
push 0
lea eax, [ebp - 0x1a4]
push eax
push 0x10000
push dword [ebp - 0x198]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41c12d
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x41bd8f
push 0
push eax
push dword [ebp - 0x198]
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41c12d
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x41bba6
mov ecx, dword [ebp - 0x1f0]
mov esi, dword [ebp - 0x1a4]
add ecx, esi
mov eax, dword [ebp - 0x1ec]
push 0
push dword [ebp - 0x1e0]
adc eax, 0
mov dword [ebp - 0x1f0], ecx
push eax
push ecx
mov dword [ebp - 0x1ec], eax
call fcn.0043d1d0
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
cmp edx, dword [ebp - 0x204]
jb 0x41be04
ja 0x41bdf3
cmp eax, dword [ebp - 0x208]
jbe 0x41be04
lea ecx, [ebp - 0x248]
call fcn.004031a0
mov esi, dword [ebp - 0x1a4]
cmp esi, 0x10000
mov esi, dword [ebp - 0x1b4]
je 0x41bd45
push 0
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0xc0]
push eax
push 2
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x1b0], 0
je 0x41c139
lea edx, [ebp - 0x88]
mov byte [ebp - 0x191], 0x10
movzx ecx, byte [edi]
lea edi, [edi + 1]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, word [eax*2 + 0x44e568]
mov word [edx + 2], ax
add edx, 4
add byte [ebp - 0x191], 0xff
movzx eax, word [ecx*2 + 0x44e568]
mov word [edx], ax
jne 0x41be60
xor eax, eax
push esi
mov word [edx + 2], ax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1ac]
movzx eax, word [esi + 4]
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x10]
push dword [ebp - 0x198]
call fcn.0043c9e0
movzx edi, word [esi + 4]
add esp, 0xc
mov edx, dword [ebp - 0x198]
xor ecx, ecx
lea esi, [edx - 2]
lea esi, [esi + edi*2]
test di, di
je 0x41bf21
movzx eax, word [esi]
cmp eax, 0x5c
je 0x41bee5
cmp eax, 0x2f
jne 0x41bef5
add edi, 0xffff
sub esi, 2
test di, di
jne 0x41bed8
jmp 0x41bf21
test di, di
je 0x41bf21
nop word [eax + eax]
movzx eax, word [esi]
cmp eax, 0x5c
je 0x41bf21
cmp eax, 0x2f
je 0x41bf21
cmp eax, 0x2e
je 0x41bf27
add edi, 0xffff
inc ecx
sub esi, 2
test di, di
jne 0x41bf00
cmp word [esi], 0x2e
jne 0x41bf3f
inc ecx
mov dword [ebp - 0x27c], esi
sub esi, 2
mov dword [ebp - 0x250], ecx
add edi, 0xffff
jmp 0x41bf51
movzx eax, cx
add edi, ecx
mov dword [ebp - 0x250], 0
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x1bc]
and eax, 3
cmp al, 3
je 0x41c07a
cmp di, 0x20
jbe 0x41c07a
push 0x457628
push 1
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
test eax, eax
je 0x41c074
test byte [0x457628], 0x80
je 0x41c074
mov eax, 0x20
nop word [eax + eax]
add eax, 0xffff
add esi, 0xfffffffe
mov dword [ebp - 0x1c4], eax
test ax, ax
je 0x41bfdf
push 0x457628
push 1
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
test eax, eax
je 0x41c074
test byte [0x457628], 0x80
mov eax, dword [ebp - 0x1c4]
jne 0x41bfa0
jmp 0x41c074
cmp word [esi], 0x5f
jne 0x41bffd
test byte [ebp - 0x1bc], 1
lea eax, [edi - 0x21]
movzx ecx, ax
movzx eax, di
cmovne ecx, eax
movzx edi, cx
jmp 0x41c074
test byte [ebp - 0x1bc], 2
jne 0x41c074
cmp di, 0x28
jbe 0x41c074
push 0x457628
push 1
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
test eax, eax
je 0x41c074
test byte [0x457628], 0x80
je 0x41c074
mov eax, 8
nop
add eax, 0xffff
add esi, 0xfffffffe
mov dword [ebp - 0x1c4], eax
test ax, ax
je 0x41c068
push 0x457628
push 1
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
test eax, eax
je 0x41c074
test byte [0x457628], 0x80
mov eax, dword [ebp - 0x1c4]
jne 0x41c030
jmp 0x41c074
cmp word [esi], 0x5f
jne 0x41c074
add edi, 0xffd7
mov edx, dword [ebp - 0x198]
mov esi, dword [ebp - 0x250]
movzx edi, di
test si, si
je 0x41c0b9
movzx eax, si
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x27c]
xor eax, eax
cmp byte [ebp - 0x199], al
setne al
lea eax, [eax*8 + 0x21]
add eax, edi
lea eax, [edx + eax*2]
push eax
call fcn.0043c9e0
add esp, 0xc
cmp byte [ebp - 0x199], 0
mov ecx, 0x52
mov eax, 0x42
cmovne eax, ecx
push eax
lea eax, [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x198]
lea eax, [eax + edi*2]
push eax
call fcn.0043c9e0
xor ecx, ecx
movzx eax, si
mov esi, dword [ebp - 0x1ac]
add esp, 0xc
cmp byte [ebp - 0x199], cl
setne cl
push 1
lea ecx, [ecx*8 + 0x21]
add ecx, edi
mov edi, dword [ebp - 0x198]
add eax, ecx
xor ecx, ecx
push edi
mov word [edi + eax*2], cx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, dword [ebp - 0x1a0]
test eax, eax
je 0x41c13f
jmp 0x41c1ea
push dword [ebp - 0x1a8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [ebp - 0x1a0]
push dword [ebp - 0x1b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x1ac]
mov dword [0x45771c], esi
push 0
push dword [ebp - 0x1e0]
mov ecx, dword [eax + 8]
add ecx, dword [ebp - 0x258]
mov eax, dword [eax + 0xc]
adc eax, dword [ebp - 0x1cc]
push eax
push ecx
mov dword [ebp - 0x1f0], ecx
mov dword [ebp - 0x1ec], eax
call fcn.0043d1d0
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1fc], edx
cmp edx, dword [ebp - 0x204]
jb 0x41c1bb
ja 0x41c1aa
cmp eax, dword [ebp - 0x208]
jbe 0x41c1bb
lea ecx, [ebp - 0x248]
call fcn.004031a0
mov esi, dword [0x45771c]
add dword [ebp - 0x1e8], 0xffffffff
lea ecx, [ebp - 0x248]
adc dword [ebp - 0x1e4], 0xffffffff
cmp edi, 1
sete al
movzx eax, al
push eax
push esi
push 0x3e8
call fcn.00403330
mov esi, dword [ebp - 0x1ac]
dec edi
add esi, 0x18
mov dword [ebp - 0x1a0], edi
mov dword [ebp - 0x1ac], esi
mov dword [ebp - 0x290], esi
test edi, edi
jne 0x41b832
lea ecx, [ebp - 0x248]
mov byte [ebp - 0x200], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x198]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
lea ecx, [ebp - 0x2b8]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0x248]
call fcn.00403270
lea ecx, [ebp - 0x248]
call fcn.00402f30
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov esi, dword [ebp - 0x198]
push esi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ebp - 0x1c0]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 0xc
lea edx, [ebp - 0x2b8]
lea ecx, [ebp - 0x248]
call fcn.00403910
int3