Function at 0x4225b0
Capabilities:
Check if file exists
Copy file
Enumerate pe sections
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447f80
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x4630b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push str..lnk
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x422633
push 0x208
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [0x467bc0]
call fcn.0042c2c0
add esp, 0x10
test eax, eax
js 0x422633
push 0x208
lea eax, [ebp - 0x21c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea esi, [ebp - 0x21c]
push esi
call fcn.00403400
add esp, 4
push esi
test eax, eax
jne 0x4226cc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x422682
test al, 0x10
je 0x422682
movdqu xmm0, xmmword [str.Only_files_are_supported_]
mov ax, word [0x450578]
mov word [0x4655a8], ax
movdqu xmmword [0x465590], xmm0
movq xmm0, qword [0x450570]
movq qword [0x4655a0], xmm0
jmp 0x422696
push esi
push str.Error_while_accesing_the_file__s.
push 0x465590
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push 0x465590
push dword [0x467bc0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004344b4
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x424]
push str._s.bak
push eax
call ebx
add esp, 0xc
cmp dword [0x466a00], 0
je 0x4226fc
push 1
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [0x4669fc]
test eax, eax
jne 0x422768
push esi
call fcn.004033e0
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, eax
add esp, 4
mov dword [0x465184], ecx
test ecx, ecx
je 0x42275d
push 0x24
push str.PE_Tools_v1.9.762.2018_build
push str.This_is_file_has_the_read_only_attribute_set._nWould_you_like_to_remove_this_attribute_
push dword [0x467bc0]
call edi
cmp eax, 6
jne 0x422757
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x465184]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [0x465184], ecx
jmp 0x42275d
mov ecx, dword [0x465184]
mov eax, dword [0x4669fc]
test eax, eax
je 0x422776
jmp 0x42276e
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, eax
mov dword [0x465184], ecx
push ecx
push esi
mov ecx, 0x465a18
mov dword [ebp - 4], 0
call fcn.00423860
test eax, eax
jne 0x4227a8
push 1
push esi
mov ecx, 0x465a18
call fcn.00423860
test eax, eax
je 0x4227ea
mov dword [0x465184], 1
push dword [0x465a1c]
call fcn.00403470
add esp, 4
test eax, eax
jne 0x422813
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push str.No_PE_signature_found._nThis_is_file_is_not_valid_Win32_64_module.
push dword [0x467bc0]
call edi
cmp dword [0x465a1c], 0
je 0x4226ae
mov ecx, 0x465a18
call fcn.00423e00
jmp 0x4226ae
push esi
push str.Error_while_accesing_the_file__s.
push 0x465590
call ebx
add esp, 0xc
push 0x10
push str.PE_Tools_v1.9.762.2018_build
push 0x465590
push dword [0x467bc0]
call edi
jmp 0x4226ae
mov ecx, 0x465a18
call fcn.00423b70
mov eax, dword [0x465a1c]
cmp dword [eax + 0x3c], 0x40
jae 0x42284a
push dword [0x467bc0]
call fcn.004224a0
add esp, 4
push 0x30
push str.PE_Tools_v1.9.762.2018_build
push str.Editing_of_DOS_header_is_not_possible_
push dword [0x467bc0]
call edi
call fcn.004231d0
mov eax, dword [0x465a1c]
movzx eax, word [eax]
push eax
push 0x3ec
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 2]
push eax
push 0x3ed
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 4]
push eax
push 0x3f6
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 6]
push eax
push 0x3f7
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 8]
push eax
push 0x3f8
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0xa]
push eax
push 0x3f9
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0xc]
push eax
push 0x3fa
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0xe]
push eax
push 0x3fb
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x10]
push eax
push 0x3fc
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x12]
push eax
push 0x3fd
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x14]
push eax
push 0x3fe
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x16]
push eax
push 0x3ff
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x18]
push eax
push 0x400
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x1a]
push eax
push 0x401
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x24]
push eax
push 0x402
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
movzx eax, word [eax + 0x26]
push eax
push 0x403
push dword [0x467bc0]
call fcn.00403890
mov eax, dword [0x465a1c]
add esp, 0xc
push dword [eax + 0x3c]
push 0x405
push dword [0x467bc0]
call fcn.004037f0
add esp, 0xc
cmp dword [0x465184], 0
je 0x422a89
push 0
push 0x3ea
push dword [0x467bc0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [0x465a24], 0
je 0x422a77
push str.PE_64bit_
push esi
push 0x467bc8
push str._s____s____Read_Only______s_
jmp 0x422aa9
push 0x450634
push esi
push 0x467bc8
push str._s____s____Read_Only______s_
jmp 0x422aa9
cmp dword [0x465a24], 0
je 0x422a99
push str.PE_64bit_
jmp 0x422a9e
push 0x450634
push esi
push 0x467bc8
push str._s____s_____s_
push 0x465590
call ebx
add esp, 0x14
push 0x465590
push dword [0x467bc0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, 1
jmp 0x4226b0