Function at 0x403d1d
Capabilities:
Get disk information
Move file
Read .ini file

Disassembly:
xchg esi, eax
and esi, 0xffffff9c
or eax, dword [ebp - 0x24]
mov ecx, esi
pop edx
sbb ebx, 0xffffffb9
sub eax, ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne 0x403ca0
xchg ebx, eax
mov esi, 0x10
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and dword [ebp - 0xc], 0xffffffb9
mov byte [ebp - 0x40], bl
sub dword [ebp - 0x3e], edi
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
cmp eax, 0
jne 0x403ca0
add edi, 0
mov edx, esi
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
add eax, edi
sbb dword [ebp - 0x44], ebx
call 0x402bfd
sbb dword [ebp - 5], 0x40
mov ecx, 0xfffffff4
sbb dword [ebp - 0x1c], 0xffffffd1
adc edi, ebx
or edi, ebx
mov dword [ebp - 0x2f], edi
pop ebx
and edi, 0x50
sub bl, byte [ebp - 0xf]
adc eax, dword [ebp - 0xe]
adc dword [ebp], esi
lea eax, [0x40544e]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
xor edi, 0x30
adc dword [ebp - 0x2f], 0xffffff9f
mov ecx, dword [ebp - 0x3b]
or ebx, esi
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
and eax, 0xffffffb1
sub dword [ebp - 0x18], ebx
sbb ah, byte [ebp - 0x3d]
mov edx, dword [ebp - 0xf]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
mov ecx, ebx
or dword [ebp - 0x2a], 0xffffff9c
sbb dword [ebp - 0x4c], 0x65
push 0x405488
push 0x405480
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
add dword [ebp - 0x2c], 0xffffffdc
add esi, 0x31
xor dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x4a]
call 0x401532
mov esi, esi
adc dword [ebp - 0x28], 0xffffffe1
xor al, byte [ebp - 8]
and ecx, ecx
mov edx, 0x3e
xor ebx, dword [0x405180]
mov ecx, 0xfffffff7
xchg ecx, edx
pop edx
sub dword [ebp - 0x18], 0x4a
and dword [ebp - 0x1d], 0xffffffcf
or eax, dword [ebp - 0x39]
push str.cHiYglNALT
push 0x405452
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, 0
jne fcn.00402439
mov dword [ebp - 0x5b], ebx
or dword [ebp - 0x1f], 0xffffffcf
add esi, dword [ebp - 0x2a]
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
or dword [ebp - 0x49], 0xffffffab
xor dword [ebp - 0x19], 0x53
sub dword [ebp - 0x21], esi
add dword [ebp - 0x35], 0x64
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
mov edi, dword [ebp - 0x15]
and byte [ebp - 0x35], al
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
or dword [ebp - 0x24], 0xfffffffe
adc dword [ebp - 9], 0x4c
mov ecx, 0xfffffff2
xor dword [ebp - 0x44], esi
call fcn.00404253
mov ecx, esi
sub esi, dword [ebp - 6]
and edi, 0x55
sub dword [ebp - 0x3e], eax
or dword [ebp - 0x1f], ebx
xchg ebx, ebx
sbb edi, dword [ebp - 3]
sub esp, 0xfffffffc
and edi, dword [ebp - 0x3b]
xor eax, dword [ebp - 0x47]
and edi, esi
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 0
jne fcn.00402439
and dword [ebp - 0x26], 0x3c
mov eax, 0x51
push str.RDgOJmQGH
push 0x4053bb
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne fcn.00402439
sub ebx, 0x49
and ebx, 0xffffffce
call 0x403a53
and byte [ebp - 0x3a], bl
sbb ebx, 0xffffff97
sbb dword [ebp - 0x3f], 0x55
or dword [ebp - 0x4f], 0xffffffcd
mov ebx, esi
mov ecx, 0x77
mov ch, 0xd5
add esp, 4
mov edx, 6
mov dword [ebp - 0xc], esi
push 8
push 0x405468
push 0x13
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne fcn.00402439
sub edi, 0xffffffa1
sbb dword [ebp - 0x12], 0xffffffaa
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp eax, 0
jne fcn.00402439
or dword [ebp - 0x5a], 0x6d
xor eax, 0xd
or dword [ebp - 0x42], ebx
add dword [ebp - 0x24], ebx
call 0x4016e7
xchg esi, esi
xchg edi, ebx
adc edi, esi
xor edi, eax
mov ecx, dword [ebp - 0x35]
sub edi, dword [ebp - 0x11]
pop ecx
and dword [ebp - 0x27], 0xffffff9b
and dword [ebp - 0x22], 0xffffffe2
sbb eax, dword [ebp - 0x29]
push str.hsXwZQHIdYHH
push 0xe
push 0x4053f6
push str.fqzCXoPGeaZPD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
test eax, eax
jne fcn.00402439
mov ecx, ebx
or ecx, 0x6e
add esi, 0xfffffffe
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
and edi, 0x5d
mov edx, edi
call fcn.004023b0
sub edi, 0x3c
sub ebx, dword [ebp - 0xa]
mov ebx, 0xffffffe8
adc ebx, edi
add edi, dword [ebp - 0x1e]
sub esp, 0xfffffffc
add ebx, ebx
mov edx, 0x3a
push 0xb
push 0x4053dd
push str.mNzOaRhqyTbvb
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
cmp eax, 0
jne fcn.00402439
add dword [0x40511c], 0x55
add bl, bh
mov edx, dword [ebp - 0x29]
adc ebx, dword [ebp - 0xf]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne fcn.00402439
mov edx, dword [ebp - 0x38]
add byte [ebp - 0x44], dh
sbb esi, esi
push 0xb
push str.eENUCSqAykQ
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne fcn.00402439
sub dword [ebp - 7], 0xffffff83
xor dword [ebp - 0x56], 0xffffff90
sub esi, 0xffffffd2
call fcn.00403872
and al, byte [ebp - 0x1a]
sub dword [ebp - 7], edi
sub dword [ebp - 0x45], 0xffffffca
adc dword [ebp - 0x2b], 0x2d
sub dword [ebp - 0xb], 0x6a
xor dword [ebp - 0x4a], eax
sub esp, 0xfffffffc
xor dword [ebp - 0x19], 0xffffffc9
mov ecx, dword [ebp - 6]
add dword [ebp - 1], ebx
push 4
push 0x40547c
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne fcn.00402439
sub dword [ebp - 0x1b], ebx
or dword [ebp - 0x24], edi
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
mov edx, eax
and eax, dword [ebp - 0x28]
push str.afacobOatQxt
push str.OvAdYTeptgCNdyF
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne fcn.00402439
xor dword [ebp - 8], 0xffffffc8
or esi, eax
and edi, dword [0x405118]
call 0x402b10
and ebx, 0x13
add dword [ebp - 0x5a], ebx