Function at 0x404565
Capabilities:
Authenticate hmac
Encode data using xor
Get disk information
Move file
Read .ini file

Disassembly:
mov eax, dword [ebp - 0x34]
sbb bl, ah
add esp, 4
xor dword [ebp - 0x12], 0xffffffa8
adc dword [ebp - 0x35], ebx
sbb ebx, eax
mov ecx, esi
lea esi, [0x40544e]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
add edi, ebx
mov esi, ebx
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
adc eax, dword [ebp - 0x40]
or edi, 0xffffffab
adc dword [ebp - 0x2c], 0x27
or esi, 0xffffffdd
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
sbb dword [ebp - 0x25], ebx
and dword [ebp - 0x4a], 0xffffffc6
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov esi, dword [0x405171]
or edi, 0xffffff93
sub byte [ebp - 0x28], ah
call 0x4046e9
mov ecx, dword [ebp - 0x34]
mov edx, 0x33
and eax, dword [ebp - 0x34]
sub eax, 0x13
sbb dword [ebp - 0xa], 0xffffff9b
pop eax
sbb ah, byte [ebp - 0x53]
xor dword [ebp - 6], edi
sbb edi, dword [ebp - 0x5b]
xor ebx, 0xffffffdc
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
and eax, 0x39
adc edi, ebx
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
sub dword [0x4052a0], edi
mov ecx, 0x10
and dword [ebp - 7], esi
mov edx, 0xffffffab
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
sbb byte [ebp - 0x2d], ah
and edi, edi
xchg esi, eax
call fcn.0040253e
and dword [ebp - 0x4f], esi
add dword [ebp - 0x39], 0x3d
sub edi, eax
xor ebx, dword [ebp - 0x3a]
mov edx, eax
add dword [ebp - 0x2d], 0x6d
add esp, 4
and dword [ebp - 0x2d], 0xffffffcb
add ebx, edx
sbb esi, dword [ebp - 0x3e]
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov ecx, dword [0x4051c5]
adc dword [ebp - 9], ecx
push 0x1c
push 0x405415
lea edx, [0x405411]
push dword [edx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sbb dword [ebp - 0x37], ebx
or dword [ebp - 0x13], edi
mov edx, 0xffffff99
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
sbb eax, dword [ebp - 0x39]
mov ecx, 0x32
mov edx, dword [ebp - 0x28]
xor dword [0x40518b], 0xffffffcd
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
sub dword [ebp - 0x10], 0xffffff9c
or edi, esi
xor dword [ebp - 0x14], 0xffffffe7
call fcn.00402439
xor dword [ebp - 2], 0x39
add eax, dword [0x405154]
sbb dword [0x40519b], 0xffffffa6
mov edx, 0xffffffec
add esp, 4
sub ah, al
xor dword [ebp - 0x1c], eax
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
adc dword [ebp - 0x1d], edi
mov eax, 0xffffffe3
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
mov ecx, dword [ebp - 0x58]
sbb dword [ebp - 0xd], ecx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
adc dword [ebp - 0x12], esi
or esi, 0xffffffe3
call 0x402c78
add edi, 0xffffffd0
xor eax, 0x6e
add edi, dword [ebp - 0x2e]
xor esi, 0xd
xor edi, edi
add dword [ebp - 0x43], 0xffffff90
xor esi, dword [ebp - 0x2a]
or eax, eax
sub esp, 0xfffffffc
sub dword [ebp - 0x4c], 0xffffffb4
mov ecx, dword [ebp - 0x1b]
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
add dword [0x40522e], ebx
adc ebx, 0xffffff84
xor edi, 0x78
add dword [ebp - 0x14], eax
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
add dword [ebp - 0x3f], 0xffffff85
add dword [ebp - 0x16], 0xffffffe2
sub edi, dword [0x405171]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
sub esi, dword [ebp - 0x2f]
mov edx, eax
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x1d], edi
add dword [0x4050e2], 0x34
call 0x401376
sbb edi, esi
adc ebx, edi
and dword [ebp - 0x58], eax
adc eax, dword [ebp - 0x20]
sub ebx, eax
mov ecx, dword [0x4051f2]
sub esp, 0xfffffffc
mov edx, 0xffffffc8
add edi, eax
or eax, 0xffffffe3
mov dword [ebp - 0x57], 0xab
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
xor dword [ebp - 0x24], edi
sub esi, dword [ebp - 0x42]
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
mov eax, dword [0x405200]
mov edx, dword [ebp - 0x39]
call section..code
sub dword [ebp - 0x2b], 0xffffffe2
sbb dword [ebp - 0x22], edi
sub esi, esi
mov ecx, dword [ebp - 0x18]
pop ebx
adc ebx, 0x5e
xor eax, 0x14
xor dword [ebp - 0x23], 0xffffffde
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x40354b
sbb edi, ebx
xor dword [0x405121], edi
add dword [ebp - 0x35], 0x74
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne 0x40354b
sub dword [ebp - 0x2c], 0xffffff9f
sub dword [ebp - 0x44], 0xa
adc dword [ebp - 0x42], 0xffffffb4
lea ecx, [0x40544e]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
sbb dword [ebp - 0x14], 0xffffffba
sbb dword [ebp - 0x50], eax
or dword [ebp - 0xa], eax
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x40354b
and dword [ebp - 5], 0x1b
mov dword [ebp - 0x13], ebx
sbb edi, 0x2b
mov edx, dword [ebp - 0x31]
call 0x401d43
sbb dword [ebp - 0x58], 0xffffffe9
xor dword [ebp - 0x57], 0xffffffc8
add ebx, 0x1e
xchg edi, edx
mov edx, edi
mov edx, 0x53
and ebx, dword [0x405198]
sub dword [0x4052b3], esi
add esp, 4
add eax, 0x1a
add edx, 0xffffff9c
or dword [ebp - 0x11], 0x37
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
sbb dword [ebp - 0x58], 0x52
or byte [0x4051d9], al
xor esi, eax
mov bh, al
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov edx, 0x41
sub dword [ebp - 0x50], 0xffffff81
call 0x40129e
or esi, dword [ebp - 0x12]
or dword [ebp - 0x11], esi
mov ecx, 0xffffffca
and dword [ebp - 0x3d], 0x2a
adc dword [ebp - 0x37], 6
mov eax, dword [ebp - 0x31]
mov ecx, 0xffffffd2
add esp, 4
add dword [ebp - 3], 0xfffffffa
mov dword [ebp - 0x4e], 0x1a
xchg edi, ebx
sbb ch, byte [ebp - 0x23]
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x402de4
xchg ebx, eax
or dword [ebp - 0x24], edi
sub dword [ebp - 0x36], 0xffffffe2
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402de4
mov ecx, dword [ebp - 0xc]
or dword [ebp - 0x23], esi
adc esi, ecx
xor dword [ebp - 0x5a], eax
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x402de4
xor eax, dword [ebp - 0x21]
xchg bh, bh
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne 0x402de4
adc dword [ebp - 0x3a], eax
add dword [ebp - 9], 0x21
and edi, eax
call fcn.00402ee3
sbb dword [ebp - 0x1c], 0xffffffc4
add dword [ebp - 0x43], eax
xor eax, eax
mov edx, dword [ebp - 0x29]
pop esi
add ebx, 0xffffff82
mov ecx, edi
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne 0x401810
sub dword [ebp - 0x25], 0xffffffd2
add dword [ebp - 0x2c], edi
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne 0x401810
sub edi, 0xffffffa9
and esi, edi
xor esi, 0x23
push 0x1c
push 0x405415
lea ecx, [0x405411]
push dword [ecx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
or dword [ebp - 0x2a], ebx
and dword [ebp - 0x3c], 0xffffff94
adc dword [ebp - 0x1d], ebx
mov ecx, dword [ebp - 0xe]
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x401810
add dword [ebp - 0x22], 0xffffffdc
adc dword [0x40526b], 0x27
sbb dword [ebp - 0x57], edi
mov ecx, 0x68
call fcn.00402839
and esi, 0xfffffffb
adc dword [ebp - 0x50], 0xfffffff8
sub dword [ebp - 6], 0x41