Function at 0x402bfd
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
adc bl, bh
mov edx, edi
add dword [ebp - 0x26], ebx
sub esi, edi
add esp, 4
or dword [ebp - 0xc], edx
adc eax, edi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
and ah, byte [ebp - 0xb]
mov edx, edi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
xor bh, ah
add dword [ebp - 0x29], 0xfffffff9
mov ecx, 0x6a
or eax, esi
lea esi, [0x40544e]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
adc dword [ebp - 0x1e], 0x47
or eax, eax
or esi, dword [ebp - 0xb]
mov ecx, dword [ebp - 0x12]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
or edi, eax
adc dword [ebp - 0x49], ebx
call fcn.00401172
adc edi, esi
mov edx, esi
add dword [ebp - 0xb], edx
or dword [ebp - 0x2c], 0xffffffc2
xor dword [ebp - 0x20], 0x3e
sbb dword [ebp - 5], 0xffffffbe
mov ecx, dword [ebp - 0x4b]
pop edi
xor ecx, dword [ebp - 0x26]
sbb dword [ebp - 0x52], ebx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, 0
jne fcn.00402439
mov ecx, dword [0x405235]
or dword [ebp - 0x14], 4
mov esi, ecx
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
sbb dword [ebp - 0x44], eax
xor dword [ebp - 0x57], 0xffffff9e
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne fcn.00402439
sbb esi, esi
add dword [ebp - 0x34], 0xffffff91
mov edx, dword [ebp - 0x13]
and al, 0x5e
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
mov eax, edi
sub ebx, dword [ebp - 0x3d]
call 0x402099
or ebx, 0x32
mov ecx, 0x2b
and dword [ebp - 0x58], ecx
sbb al, bl
mov edx, eax
sub dword [ebp - 0x44], edx
sub dword [ebp - 0x49], esi
sub esp, 0xfffffffc
sbb ah, byte [ebp - 0x3d]
and edx, dword [ebp - 0xc]
and ebx, ebx
lea edx, [0x40544e]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, 0x18
sub eax, 0xffffff92
and edi, ebx
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
xchg edi, eax
mov dword [ebp - 0x46], eax
push 0x1c
push 0x405415
lea ecx, [0x405411]
push dword [ecx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edi, 0xfffffff5
or edi, dword [ebp - 0x30]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
adc esi, dword [ebp - 0x53]
mov dword [ebp - 0x14], 0x68
sbb eax, ebx
call fcn.00402439
adc dword [ebp - 0x43], edi
sbb dword [0x4050f7], edi
xor al, byte [0x405189]
adc ebx, 0xffffffc5
adc eax, 0x24
mov ebx, dword [ebp - 0x25]
or dword [0x405144], 0x1e
add esp, 4
sbb bl, byte [ebp - 0x4a]
mov dword [ebp - 8], 0x14
xor edi, dword [ebp - 0x24]
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
add dword [ebp - 0x46], 0xffffff95
mov edx, 0xffffff9a
lea esi, [0x40544e]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor dword [ebp], 0xffffff84
adc dword [ebp - 0x2a], ebx
add dword [ebp - 0x49], ebx
call 0x402a91
mov ecx, dword [ebp - 0x57]
sub dword [0x4051f2], ebx
mov edx, dword [ebp - 0xf]
mov edx, ebx
and dword [ebp - 0x34], edx
sub esp, 0xfffffffc
add dl, byte [ebp - 0xd]
sbb edx, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x12], eax
sub dword [ebp - 0x35], edi
or dword [ebp - 0x3c], 0xffffffed
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne fcn.00402439
and ebx, eax
add esi, dword [ebp]
sbb esi, ebx
adc dword [ebp - 0x58], esi
call fcn.00402439
mov dword [0x4052a5], esi
and dword [ebp - 0x3c], ebx
add dword [ebp - 9], 0xffffffb3
mov edx, 0x10
adc ebx, edi
pop esi
mov ah, byte [0x40518a]
sbb dword [ebp - 0x24], esi
or dword [ebp - 0x2c], esi
mov ecx, edi
push 0x1c
push 0x405415
lea esi, [0x405411]
push dword [esi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov edx, dword [ebp - 0x24]
adc edx, dword [ebp - 0x4d]
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4011f3
mov edi, ebx
xor dword [ebp - 0x26], 0xffffffc4
mov bh, bl
call 0x4039c1
sub dword [ebp - 0x32], 0xffffffb0
adc dword [ebp - 0x1e], 0x63
xor bh, 0x80
sub eax, 0xffffffea
and ebx, dword [0x4051de]
mov ecx, edi
add esp, 4
adc eax, 0x6b
and ebx, ecx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
or dword [ebp - 0x1e], ebx
sub dword [ebp - 0x25], 0xffffffdd
add eax, ebx
adc dword [ebp - 0xf], edi
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
sbb dword [ebp - 0x3d], edi
sbb byte [0x4050e0], bl
sbb eax, dword [ebp - 0x1a]
and esi, eax
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
mov dword [ebp - 0x25], 0xb0
and eax, dword [ebp - 0x27]
add bl, bl
sbb dword [ebp - 0x57], 0x24
call fcn.00402439
mov edx, 0xffffffd0
or dword [ebp - 0x22], 0x49
xor eax, dword [ebp - 1]
adc dword [ebp - 0x40], 0xffffffc4
adc ebx, 0x6d
add esp, 4
adc ebx, dword [ebp - 0x48]
adc byte [ebp - 0x43], al
xor eax, 0x4e
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
mov dword [0x405230], ebx
mov ebx, dword [ebp - 0x37]
xchg edi, edi
mov ecx, dword [0x405235]
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
sbb dword [ebp - 0x18], edi
add ebx, esi
and dword [ebp - 0x3f], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
or ebx, ebx
and esi, 0x7a
push 0x1c
push 0x405415
lea ebx, [0x405411]
push dword [ebx]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov ecx, dword [0x4052aa]
xor dword [ebp - 0x31], 0x24
or dword [ebp - 0x43], 0xb
or dword [ebp - 0x34], ecx
call 0x401ab5
sbb dword [ebp - 0xb], esi
mov eax, esi
mov ah, byte [ebp - 0x15]
mov ecx, dword [ebp - 0x3a]
pop edi
or dword [ebp - 0x11], edi
and esi, dword [ebp - 0x11]
sub dword [ebp - 0x53], 0x66
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
mov ecx, dword [ebp - 0x43]
and byte [ebp - 0x1c], ah
push 0x1c
push 0x405415
lea edi, [0x405411]
push dword [edi]
push 0xffffffff
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
sbb edi, dword [ebp - 0x3e]
or dword [ebp - 0x30], 0xffffffe8
call 0x403f45
and edi, 0xffffffb1
sbb ebx, ebx
mov al, 3
and dword [0x4051f8], ebx