Function at 0x40231c
Capabilities:
Delete directory
Encode data using xor
Get disk information
Get file size
Read .ini file
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4010c0]
sub eax, 0x5aefc489
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x4010c8]
je 0x402461
mov edx, dword [0x43b0b1]
add edx, dword [ebp - 4]
mov dword [0x43b0b1], edx
call sym.imp.KERNEL32.DLL_GetFileInformationByHandle
mov eax, dword [0x4010c0]
cmp eax, dword [ebp - 0x18]
je 0x402576
mov edx, dword [ebp - 0x18]
add edx, 0xbbb3
cmp edx, dword [0x4010c0]
je 0x402527
call sym.imp.KERNEL32.DLL_SetEvent
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
call sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyA
call sym.imp.KERNEL32.DLL_GetPrivateProfileIntW
call sym.imp.KERNEL32.DLL_GetDriveTypeA
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
call sym.imp.KERNEL32.DLL_VirtualAlloc
call sym.imp.KERNEL32.DLL_OpenThread
call sym.imp.KERNEL32.DLL_CreateTimerQueue
mov ecx, dword [0x43b0a9]
sub ecx, dword [0x4010c8]
mov dword [0x43b0a9], ecx
test dword [ebp - 0x18], 0x8000
je 0x40253c
call sym.imp.KERNEL32.DLL_GetBinaryTypeA
call sym.imp.KERNEL32.DLL_EnumResourceLanguagesA
call sym.imp.KERNEL32.DLL_GetFullPathNameA
mov edx, dword [0x43b0a9]
sub edx, eax
mov dword [0x43b0a9], edx
mov edx, dword [0x43b0ad]
sub edx, dword [ebp - 4]
mov dword [0x43b0ad], edx
call sym.imp.SHLWAPI.dll_StrFormatKBSizeW
call sym.imp.KERNEL32.DLL_FindVolumeClose
cmp dword [ebp - 0x18], 0
je 0x4024de
mov eax, dword [0x43b0ad]
imul eax, dword [0x43b0ad]
mov dword [ebp - 0x14], eax
call sym.imp.SHLWAPI.dll_UrlIsW
call sym.imp.KERNEL32.DLL_MapUserPhysicalPages
call sym.imp.KERNEL32.DLL_OpenEventW
mov ecx, dword [ebp - 0x18]
sub ecx, 0xfa44
cmp ecx, dword [0x4010c0]
je 0x402522
call sym.imp.KERNEL32.DLL_ClearCommBreak
call sym.imp.KERNEL32.DLL_GetThreadContext
cmp dword [ebp - 0x18], 0
je 0x4023ed
call sym.imp.KERNEL32.DLL_WriteFileEx
mov eax, dword [0x4010c4]
cmp eax, dword [ebp - 0x18]
je 0x402582
call sym.imp.KERNEL32.DLL_RequestDeviceWakeup
cmp dword [ebp - 0x18], 0
je 0x402527
call sym.imp.KERNEL32.DLL_GetFileSize
mov edx, dword [0x43b0ad]
sub edx, dword [0x43b0a9]
mov dword [0x43b0ad], edx
mov edx, dword [0x43b0ad]
add edx, ecx
mov dword [0x43b0ad], edx
mov ecx, dword [0x43b0a9]
adc ecx, eax
mov dword [0x43b0a9], ecx
mov eax, dword [0x43b0a9]
imul eax, eax, 0x64
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
call sym.imp.KERNEL32.DLL_WritePrivateProfileStructA
call sym.imp.KERNEL32.DLL_HeapAlloc
call sym.imp.KERNEL32.DLL_RemoveDirectoryW
call sym.imp.KERNEL32.DLL_SetMailslotInfo
call sym.imp.KERNEL32.DLL_SizeofResource
call sym.imp.KERNEL32.DLL_GetVolumeInformationW
mov ecx, dword [0x43b0ad]
sub ecx, dword [ebp - 0x18]
mov dword [0x43b0ad], ecx
call sym.imp.KERNEL32.DLL_FreeConsole
mov eax, dword [ebp - 0x18]
xor eax, edx
mov dword [0x43b0ad], eax
call sym.imp.SHLWAPI.dll_PathRemoveBlanksA
call sym.imp.KERNEL32.DLL_GetProcessHeap
cmp dword [0x4010c0], 0
je 0x4023b5
call sym.imp.KERNEL32.DLL_FillConsoleOutputCharacterW
call sym.imp.SHLWAPI.dll_SHRegWriteUSValueW
call sym.imp.SHLWAPI.dll_PathGetDriveNumberA
test dword [0x4010c4], 8
je 0x402483
call sym.imp.KERNEL32.DLL_SetVolumeMountPointW
mov ecx, dword [ebp - 0x18]
xor ecx, dword [0x4010c4]
mov dword [0x43b0b1], ecx
call sym.imp.KERNEL32.DLL_InterlockedIncrement
mov eax, dword [0x4010c0]
xor edx, edx
div dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
call sym.imp.SHLWAPI.dll_PathIsDirectoryA
mov eax, dword [ebp - 0x18]
add eax, 0x87f8
cmp eax, 0x8df9b475
je 0x40253c
mov edx, dword [ebp - 0x14]
and edx, dword [0x43b0b1]
mov dword [ebp - 0x14], edx
call sym.imp.KERNEL32.DLL_DosDateTimeToFileTime
mov esp, ebp
pop ebp
ret