Function at 0x409350
Capabilities:
Get file size
Move file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 8], eax
movzx eax, byte [0x4272c9]
test eax, eax
jne 0x4093b6
movzx ecx, byte [0x4272ca]
cmp ecx, 1
jne 0x4093b6
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x2e
lea ecx, [ebp - 0x150]
push ecx
call fcn.00401020
add esp, 8
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
je 0x4093b4
mov edx, dword [ebp - 0x2a8]
mov byte [edx], 0
jmp 0x4093c7
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040124a
add esp, 8
mov dword [ebp - 0x164], eax
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040124a
add esp, 8
mov dword [ebp - 0x158], eax
movzx eax, byte [0x4272c9]
test eax, eax
je 0x409416
cmp dword [ebp - 0x164], 0
je 0x409416
mov dword [ebp - 0x2d0], 1
jmp 0x409420
mov dword [ebp - 0x2d0], 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x164], ecx
movzx edx, byte [0x4272ca]
test edx, edx
jne 0x409442
movzx eax, byte [0x4272c9]
test eax, eax
je 0x409457
cmp dword [ebp - 0x158], 0
je 0x409457
mov dword [ebp - 0x2d4], 1
jmp 0x409461
mov dword [ebp - 0x2d4], 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x158], ecx
cmp dword [ebp - 0x164], 0
jne 0x409486
cmp dword [ebp - 0x158], 0
jne 0x409486
xor eax, eax
jmp 0x409b7d
mov dword [ebp - 0x188], 0xf
mov dword [ebp - 0x180], pe_nt_image_headers32
mov dword [ebp - 0x170], 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x154], eax
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x15c], eax
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffff
jne 0x409528
xor eax, eax
jmp 0x409b7d
push 0
mov edx, dword [ebp - 0x190]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
shl eax, 1
push eax
call fcn.004017bc
add esp, 4
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x194]
shl edx, 1
push edx
call fcn.004017bc
add esp, 4
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x168], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x160], edx
push 0
lea eax, [ebp - 0x2a4]
push eax
mov ecx, dword [ebp - 0x194]
push ecx
mov edx, dword [ebp - 0x184]
push edx
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x409604
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
push eax
call fcn.00401734
add esp, 4
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x2c4], ecx
mov edx, dword [ebp - 0x2c4]
push edx
call fcn.00401734
add esp, 4
xor eax, eax
jmp 0x409b7d
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x188]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x184]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
jne 0x40964f
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
mov eax, dword [ebp - 0x184]
push eax
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x409699
push 0
push 0
mov ecx, dword [ebp - 0x194]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x2a4]
sub eax, 2
shr eax, 1
push eax
mov ecx, dword [ebp - 0x184]
add ecx, 2
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x194], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x168], edx
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x168]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x18c], edx
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x194]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x178]
cmp ecx, dword [ebp - 0x174]
ja 0x40997a
cmp dword [ebp - 0x164], 0
je 0x40974f
mov edx, dword [ebp - 0x17c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x178]
push ecx
call fcn.00401373
add esp, 0xc
test eax, eax
jne 0x40974f
mov edx, dword [ebp - 0x16c]
add edx, 1
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [ebp - 0x178]
add edx, dword [ebp - 0x17c]
mov dword [ebp - 0x178], edx
mov eax, dword [ebp - 0x18c]
add eax, dword [ebp - 0x16c]
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x170]
or ecx, 2
mov dword [ebp - 0x170], ecx
jmp 0x4096c3
cmp dword [ebp - 0x158], 0
je 0x409947
push 0xa
push str.AddService
mov edx, dword [ebp - 0x178]
push edx
call fcn.00401373
add esp, 0xc
test eax, eax
jne 0x409947
push 0xc
mov eax, dword [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [ebp - 0x178]
add edx, 0xb
mov dword [ebp - 0x178], edx
mov eax, dword [ebp - 0x18c]
add eax, 0xb
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x178]
movsx edx, byte [ecx]
cmp edx, 0x2c
je 0x409947
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x178]
push edx
call fcn.00401373
add esp, 0xc
test eax, eax
jne case.0x409820.1
mov eax, dword [ebp - 0x178]
add eax, dword [ebp - 0x154]
movsx ecx, byte [eax]
mov dword [ebp - 0x2d8], ecx
mov edx, dword [ebp - 0x2d8]
sub edx, 9
mov dword [ebp - 0x2d8], edx
cmp dword [ebp - 0x2d8], 0x23
ja case.0x409820.1
mov eax, dword [ebp - 0x2d8]
movzx ecx, byte [eax + 0x409b9c]
jmp dword [ecx*4 + 0x409b90]
mov edx, dword [ebp - 0x178]
movsx eax, byte [edx - 1]
cmp eax, 0x22
jne 0x40988c
mov ecx, dword [ebp - 0x15c]
add ecx, 1
push ecx
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x178]
add ecx, dword [ebp - 0x154]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x18c]
add edx, dword [ebp - 0x15c]
mov dword [ebp - 0x18c], edx
mov eax, dword [ebp - 0x170]
or eax, 4
mov dword [ebp - 0x170], eax
jmp 0x4097ae
jmp case.0x409820.1
mov ecx, dword [ebp - 0x178]
movsx edx, byte [ecx - 1]
cmp edx, 0x20
je 0x4098be
mov eax, dword [ebp - 0x178]
movsx ecx, byte [eax - 1]
cmp ecx, 0x3d
je 0x4098be
mov edx, dword [ebp - 0x178]
movsx eax, byte [edx - 1]
cmp eax, 9
jne case.0x409820.1
mov ecx, dword [ebp - 0x15c]
add ecx, 1
push ecx
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x178]
add ecx, dword [ebp - 0x154]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x18c]
add edx, dword [ebp - 0x15c]
mov dword [ebp - 0x18c], edx
mov eax, dword [ebp - 0x170]
or eax, 4
mov dword [ebp - 0x170], eax
jmp 0x4097ae
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x178]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x18c]
add ecx, 1
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp - 0x178]
add edx, 1
mov dword [ebp - 0x178], edx
jmp 0x4097ae
mov eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x178]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 0x18c]
add eax, 1
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x178]
add ecx, 1
mov dword [ebp - 0x178], ecx
jmp 0x4096c3
cmp dword [ebp - 0x170], 0
je 0x409b44
mov edx, dword [0x41685c]
add edx, 1
mov dword [0x41685c], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..TMP
lea edx, [ebp - 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41685c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s.ORG_i
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 2
push 0xc0000000
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2ac], eax
push 0
push 0x4272d4
mov ecx, dword [ebp - 0x18c]
sub ecx, dword [ebp - 0x160]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x160]
push edx
mov eax, dword [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x2ac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x170]
or edx, 1
mov dword [ebp - 0x170], edx
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp dword [0x41685c], 1
jne 0x409b44
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push str.UnDo.cmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xffffffff
je 0x409b44
push 2
push 0
push 0
mov ecx, dword [ebp - 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00401020
add esp, 8
add eax, 1
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
push eax
mov ecx, dword [ebp - 0x2b4]
push ecx
mov edx, dword [ebp - 0x2b4]
push edx
mov eax, dword [ebp - 0x2b4]
push eax
mov ecx, dword [str.DEL__F__Q__s_r_nREN__s.ORG1__s_r_nDEL__F__Q__s.ORG_r_n]
push ecx
push 0x104
lea edx, [ebp - 0x2a0]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x1c
push 0
push 0x4272d4
lea eax, [ebp - 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
mov edx, dword [ebp - 0x2b0]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c8], ecx
mov edx, dword [ebp - 0x2c8]
push edx
call fcn.00401734
add esp, 4
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x2cc], eax
mov ecx, dword [ebp - 0x2cc]
push ecx
call fcn.00401734
add esp, 4
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 0x14