Function at 0x4085a0
Capabilities:
Check for sandbox username or hostname
Check if file exists
Get common file path
Get file attributes
Get file size
Get hostname
Get session user name
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13f4
call fcn.00408e50
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp + eax - 0x7c0], 0
inc eax
cmp eax, 0x348
jb 0x4085b2
mov edi, dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
lea eax, [ebp - 0x7c0]
xor esi, esi
mov dword [ebp - 0x7c0], 0x348
push esi
push eax
push esi
push esi
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40862e
nop word [eax + eax]
push 0x401ee8
lea eax, [ebp - 0x77c]
inc esi
push eax
call ebx
test eax, eax
jne 0x4086c5
push 0x401ef8
lea eax, [ebp - 0x77c]
push eax
call ebx
test eax, eax
jne 0x4086c5
push eax
lea eax, [ebp - 0x7c0]
push eax
push esi
push 0
call edi
test eax, eax
jne 0x4085f0
push 0x401c14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x401c20
push edi
call esi
push 0x401c40
push edi
mov ebx, eax
call esi
mov dword [ebp - 8], 0
mov esi, eax
test ebx, ebx
je 0x408666
lea eax, [ebp - 8]
push eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xbd0]
push 0x104
push eax
push 0x401f30
call ebx
push 0x104
lea eax, [ebp - 0xdd8]
push eax
push 0x401f80
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0xbd0]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4086ce
test al, 0x10
jne 0x4086ce
lea eax, [ebp - 0xdd8]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4086ce
test al, 0x10
jne 0x4086ce
test esi, esi
je 0x4086c5
push dword [ebp - 8]
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4086d7
push dword [ebp - 8]
call esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x478]
push eax
push 0
push 0
push 0
push 0
call esi
lea eax, [ebp - 0xfe0]
push eax
push 0
push 0
push 5
push 0
call esi
push 0x401fc8
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x270]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40872a
test al, 0x10
je 0x4086c5
xor esi, esi
mov dword [ebp - 0x2c], 0x401fe0
mov dword [ebp - 0x28], 0x401ffc
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x24], 0x402014
mov dword [ebp - 0x20], 0x40202c
mov dword [ebp - 0x1c], 0x402040
lea ebx, [esi + 5]
push dword [edi]
lea eax, [ebp - 0xfe0]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408785
test al, 0x10
jne 0x408785
mov cl, 1
jmp 0x408787
xor cl, cl
test cl, cl
lea eax, [esi + 1]
cmove eax, esi
add edi, 4
mov esi, eax
sub ebx, 1
jne 0x408755
cmp esi, 5
je 0x4086c5
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x478]
push 0x402058
push eax
lea eax, [ebp - 0x270]
push eax
call ebx
push 0x402074
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x11e8]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x270]
push eax
call edi
cmp eax, 0xffffffff
je 0x408968
test al, 0x10
jne 0x408968
lea eax, [ebp - 0x11e8]
push eax
call edi
cmp eax, 0xffffffff
je 0x408968
test al, 0x10
jne 0x408968
push 0
push 0x80
push 3
push 0
push 3
push closesocket
lea eax, [ebp - 0x270]
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408888
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 8
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
test eax, eax
je 0x408881
push 0
lea ecx, [ebp - 0x40]
push ecx
push dword [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea eax, [ebp - 0x270]
push esi
push 0x80
push 3
push esi
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4088f2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 8
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4088e9
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 4
mov byte [ebp - 4], 0
jne 0x408933
cmp dword [ebp - 0xc], 4
jne 0x408933
push 0x40208c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x408933
push 0x40208c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [ebp - 4]
test eax, eax
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x40894a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x40895e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp - 4], 0
jne 0x4086c5
push 0x402094
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x270]
push eax
call ebx
lea eax, [ebp - 0x270]
push eax
call edi
cmp eax, 0xffffffff
je 0x408a40
test al, 0x10
jne 0x408a40
xor esi, esi
mov dword [ebp - 0xc], 0
push esi
push 0x80
push 3
push esi
push 3
push closesocket
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408a03
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 8
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4089fc
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp dword [ebp - 0xc], 0x37
jne 0x408a24
push 0x4020b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
test esi, esi
je 0x408a38
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test bl, bl
jne 0x4086c5
push 0x104
lea eax, [ebp - 0x270]
push eax
push 0x4020e8
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x270]
push eax
call edi
cmp eax, 0xffffffff
je 0x408a8a
test al, 0x10
jne 0x408a8a
lea eax, [ebp - 0x3c]
push eax
push 0
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x408a8a
cmp dword [ebp - 0x1c], 0x37
je 0x4086c5
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x10
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x48], 0x101
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x9c8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor esi, esi
mov dword [ebp - 0x34], 0x402138
mov dword [ebp - 0x30], 0x40214c
mov dword [ebp - 0x2c], 0x402174
mov dword [ebp - 0x28], 0x40218c
mov dword [ebp - 0x24], 0x40219c
mov dword [ebp - 0x20], 0x4021b8
mov dword [ebp - 0x1c], 0x4021e0
movzx eax, si
push dword [ebp + eax*4 - 0x34]
lea eax, [ebp - 0x9c8]
push eax
call edi
test eax, eax
je 0x4086c5
inc esi
cmp si, 7
jb 0x408af0
push 0x4021fc
lea eax, [ebp - 0x9c8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x4086c5
mov dword [ebp - 0x24], 0x40220c
xor esi, esi
mov dword [ebp - 0x20], 0x402228
mov dword [ebp - 0x1c], 0x40223c
movzx eax, si
push dword [ebp + eax*4 - 0x24]
lea eax, [ebp - 0x68]
push eax
call edi
test eax, eax
je 0x4086c5
inc esi
cmp si, 3
jb 0x408b40
push 0x104
lea eax, [ebp - 0x13f0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x402250
lea eax, [ebp - 0x13f0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret