Function at 0x40101e
Capabilities:
Copy file
Create directory
Delete file

Disassembly:
jmp 0x4059d0
sub esp, 0x208
push ebx
push esi
push edi
push 0
push str.SoftwareISTbarISTbar
push SysReAllocStringLen
call fcn.00401028
add esp, 0xc
test al, al
je 0x405a00
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x208
ret
mov edi, 0x40dfec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.istbar.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x110]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x21c]
push ecx
call fcn.00401032
add esp, 8
test eax, eax
jne 0x405a85
pop edi
pop esi
mov eax, 0xa
pop ebx
add esp, 0x208
ret
or ecx, 0xffffffff
mov edi, 0x40e0f0
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40c9dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ISTbar
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
lea edx, [esp + 0xc]
mov edi, 0x40c9dc
jne 0x405bcf
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.istbar.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea ecx, [esp + 0x118]
push ecx
call esi
test eax, eax
jne 0x405c74
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0xc]
dec ecx
sub edx, 5
push eax
lea eax, [esp + 0x10]
mov byte [ecx + edx], 0x32
lea ecx, [esp + 0x114]
push eax
push ecx
call esi
test eax, eax
jne 0x405c74
pop edi
pop esi
mov eax, 0xc
pop ebx
add esp, 0x208
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.istbar.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.DLL_CopyFileA]
lea ecx, [esp + 0x118]
push ecx
call esi
test eax, eax
jne 0x405c74
lea edi, [esp + 0xc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0xc]
dec ecx
sub edx, 5
push eax
lea eax, [esp + 0x10]
mov byte [ecx + edx], 0x32
lea ecx, [esp + 0x114]
push eax
push ecx
call esi
test eax, eax
jne 0x405c74
pop edi
pop esi
mov eax, 0xb
pop ebx
add esp, 0x208
ret
lea edx, [esp + 0xc]
push str.DllRegisterServer
push edx
call fcn.004010aa
add esp, 8
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
mov eax, 5
pop ebx
add esp, 0x208
ret