Function at 0x402a20
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push 4
push 0x3000
push 0xfffe
movdqa xmmword [esp + 0x1c], xmm0
mov esi, ecx
push 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x402ad0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0xa
push 1
push str.SingleScan__:_Critical_Error__failed_to_allocate_extended_path:_0x_X
call fcn.00404640
mov esi, eax
add esp, 0x14
test esi, esi
je 0x402b5c
push edi
push 1
push edi
push esi
call fcn.004013b0
add esp, 0x10
push edi
push edi
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x41e37c]
test eax, eax
jne 0x402ab5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004048b1
mov esp, ebp
pop ebp
ret
push str.___
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402b6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 0xa
push 1
push str.SingleScan__:_Critical_Error__invalid_path__last_error:_0x_X
call fcn.00404640
mov esi, eax
add esp, 0x14
test esi, esi
je 0x402b4c
push 0
push 1
push 0
push esi
call fcn.004013b0
add esp, 0x10
push 0
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x41e37c]
test eax, eax
jne 0x402b42
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x41e37c], eax
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push edi
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004048b1
mov esp, ebp
pop ebp
ret
test al, 0x10
je 0x402bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
push 1
push str.SingleScan__:_Path:__ws__is_a_directory._Decrypting_It...
call fcn.00404640
add esp, 0x18
test eax, eax
je 0x402ba0
mov ecx, eax
call fcn.00404450
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [edi + eax*2 - 2], 0x5c
je 0x402bc2
push 0x418eb8
push edi
call esi
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.00402370
jmp 0x402b4c
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41e3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x41e320], 1
push 0x41e3b8
adc dword [0x41e324], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 1
push str.SingleScan__:_Path:__ws__is_a_file._Decrypting_It...
call fcn.00404640
add esp, 0x14
test eax, eax
je 0x402c26
mov ecx, eax
call fcn.00404450
xor esi, esi
mov dword [esp + 8], esi
cmp dword [0x41e318], esi
jne 0x402cf7
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push str._s.KRABBACKUP
call fcn.00404640
mov esi, eax
add esp, 0x14
mov dword [esp + 8], esi
test esi, esi
jne 0x402c86
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 1
push 0xa
push str.SingleScan__:_Error_allocating_memory_for_backup_name_0x_X_r_n
call fcn.004013b0
mov ecx, dword [esp + 0x40]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.004048b1
mov esp, ebp
pop ebp
ret
cmp dword [0x41e318], 0
jne 0x402cf7
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402cf7
call fcn.00404610
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push edi
push 2
push 1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
push str.___________________________________________FILE:__ws__ERROR_BACKUPING:_0x_X_______________________________________r_n
call fcn.004013b0
add esp, 0x18
call esi
push eax
push edi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
push 1
push str.ERROR_BACKUPING_FILE:__ws___GetLastError____d_n
call fcn.00404640
add esp, 0x18
test eax, eax
je 0x402db8
mov ecx, eax
jmp 0x402db3
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.004018f0
test eax, eax
je 0x402d57
call fcn.004045e0
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 1
push str.Single_decryption:_File__ws__SUCCESSFULLY_DECRYPTED
call fcn.00404640
add esp, 0x14
mov dword [esp + 0xc], eax
test eax, eax
je 0x402d45
push 0
push 1
push 0
push eax
call fcn.004013b0
mov ecx, dword [esp + 0x1c]
add esp, 0x10
call fcn.00404450
cmp dword [0x41e318], 0
jne 0x402db8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402db8
call fcn.00404610
cmp dword [0x41e318], 0
jne 0x402d78
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402d78
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xa
push eax
push 1
push str.SingleScan__:_Single_decryption:_File__ws__FAILED_TO_DECRYPT__LAST_ERROR_0x_X
call fcn.00404640
mov esi, eax
add esp, 0x18
test esi, esi
je 0x402db8
push 0
push 1
push 0
push esi
call fcn.004013b0
add esp, 0x10
mov ecx, esi
call fcn.00404450
mov eax, dword [esp + 8]
test eax, eax
je 0x402b4c
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push eax
call esi
jmp 0x402b52