Function at 0x41cdc0
Capabilities:
Check if file exists
Copy file
Get file attributes
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d7650
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x64
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
call fcn.00431f10
push 0xfffe
mov dword [esp + 0x84], edi
call fcn.004691cd
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x41ce62
mov eax, dword [esp + 0x30]
cmp eax, edi
je 0x41ce44
push eax
call fcn.004699ce
add esp, 4
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.004699ce
add esp, 4
jmp 0x41d4bb
cmp byte [0x594aaa], 0
je 0x41ce85
push ebx
push str.Current_file:__s_n
push 0x7fff
push esi
call fcn.00469c7b
push esi
call fcn.0041a5a0
add esp, 0x14
mov ecx, dword [0x594ab8]
cmp ecx, edi
jne 0x41d3b6
push 0xfffe
call fcn.004691cd
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
jne 0x41ceb8
push esi
call fcn.004690f0
add esp, 4
jmp 0x41d4b2
push 0xfffe
call fcn.004691cd
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
jne 0x41cee1
push edi
call fcn.004690f0
push esi
call fcn.004690f0
add esp, 8
jmp 0x41d4b2
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41d34e
push ebx
call fcn.00420910
add esp, 4
test al, al
jne 0x41cf17
push esi
call fcn.004690f0
push edi
call fcn.004690f0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004690f0
add esp, 0xc
jmp 0x41d4b2
push ebx
push 0x7fff
push esi
call fcn.0046a38b
mov eax, 0x584898
add esp, 0xc
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cf30
sub eax, edx
sar eax, 1
je 0x41d29b
lea ecx, [esp + 0x24]
call fcn.00430ad0
push 0x2e
push esi
call fcn.00469757
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
je 0x41cf89
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x28]
call fcn.0044b870
add edi, 2
push 0x2e
push edi
call fcn.00469757
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x41cf63
mov ecx, str..qwe
mov eax, 0x584898
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41cfb9
test dx, dx
je 0x41cfb5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41cfb9
add eax, 4
add ecx, 4
test dx, dx
jne 0x41cf93
xor eax, eax
jmp 0x41cfbe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41d05e
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x28]
call fcn.0041b5e0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], edx
call fcn.0041b610
push eax
lea ecx, [esp + 0x14]
call fcn.0041b2f0
test al, al
je 0x41d29b
lea ecx, [esp + 0x10]
call fcn.0042feb0
mov eax, dword [eax]
push 0x584898
push eax
call fcn.0046977d
add esp, 8
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0042feb0
cmp edi, dword [eax]
je 0x41d149
push 0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041b320
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x28]
call fcn.0041b610
push eax
lea ecx, [esp + 0x14]
call fcn.0041b2f0
test al, al
jne 0x41d001
jmp 0x41d29b
mov ecx, 0x4e17b4
mov eax, 0x584898
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d08e
test dx, dx
je 0x41d08a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d08e
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d068
xor eax, eax
jmp 0x41d093
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41d15e
push esi
push ebx
call fcn.00420910
add esp, 8
test al, al
jne 0x41d29b
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x28]
call fcn.0041b5e0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], edx
call fcn.0041b610
push eax
lea ecx, [esp + 0x14]
call fcn.0041b2f0
test al, al
je 0x41d29b
jmp 0x41d0f0
lea ecx, [esp + 0x10]
call fcn.0042feb0
mov eax, dword [eax]
push 0x4e17a8
push eax
call fcn.0046977d
add esp, 8
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0042feb0
cmp edi, dword [eax]
je 0x41d149
push 0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041b320
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x28]
call fcn.0041b610
push eax
lea ecx, [esp + 0x14]
call fcn.0041b2f0
test al, al
jne 0x41d0f0
jmp 0x41d29b
lea ecx, [esp + 0x10]
call fcn.0042feb0
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
jmp 0x41d29b
mov ecx, str.Crypted
mov eax, 0x584898
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d18e
test dx, dx
je 0x41d18a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d18e
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d168
xor eax, eax
jmp 0x41d193
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d274
mov ecx, str.hb15
mov eax, 0x584898
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41d1cb
test dx, dx
je 0x41d1c7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41d1cb
add eax, 4
add ecx, 4
test dx, dx
jne 0x41d1a5
xor eax, eax
jmp 0x41d1d0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41d274
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x28]
call fcn.0041b640
mov ecx, dword [eax]
mov edx, dword [eax + 4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], edx
call fcn.0041b670
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.0041b7a0
add esp, 8
test al, al
je 0x41d29b
lea ecx, [esp + 0x10]
call fcn.0041b360
mov edx, dword [eax]
push 0x584898
push edx
call fcn.0046a5d3
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
je 0x41d266
push 0
lea eax, [esp + 0x48]
push eax
call fcn.0041b6a0
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x28]
call fcn.0041b670
push eax
lea edx, [esp + 0x14]
push edx
call fcn.0041b7a0
add esp, 8
test al, al
jne 0x41d217
jmp 0x41d29b
call fcn.0041b360
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
jmp 0x41d29b
push 0x584898
push esi
call fcn.0046977d
mov edi, eax
lea eax, [edi + 2]
push 0x584898
push eax
call fcn.0046977d
add esp, 0x10
test eax, eax
jne 0x41d29b
xor edx, edx
mov word [edi], dx
mov ebx, dword [esp + 0x1c]
push esi
push 0x7fff
push ebx
call fcn.0046a38b
push 0x2e
push ebx
call fcn.004690c4
push 0x5c
push ebx
mov edi, eax
call fcn.004690c4
add esp, 0x1c
test edi, edi
je 0x41d2f7
test eax, eax
je 0x41d2f7
cmp edi, eax
jbe 0x41d2e6
mov eax, dword [esp + 0x18]
push edi
push 0x7fff
push eax
call fcn.0046a38b
add esp, 0xc
xor ecx, ecx
mov word [edi], cx
jmp 0x41d30e
mov edx, dword [esp + 0x18]
push 0x4e1788
push 0x7fff
push edx
jmp 0x41d306
mov eax, dword [esp + 0x18]
push 0x4e1788
push 0x7fff
push eax
call fcn.0046a38b
add esp, 0xc
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d3da
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edi
push edx
push str._s__d__s
push esi
call ebx
add esp, 0x14
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d326
jmp 0x41d3da
cmp eax, 1
jne 0x41d3a0
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push eax
mov eax, dword [esp + 0x24]
push eax
push str._s_k_d
push esi
call ebx
add esp, 0x10
push esi
mov edi, 2
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d3da
jmp 0x41d380
mov ecx, dword [esp + 0x20]
push edi
push ecx
push str._s_k_d
push esi
call ebx
add esp, 0x10
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41d380
jmp 0x41d3da
mov edx, dword [ebp + 0x10]
push edx
push ebx
push str._s_k_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x41d3da
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
push ebx
call edx
test al, al
je 0x41ceaa
mov ecx, dword [0x594ab8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push 0x7fff
push esi
push ebx
call edx
mov edi, dword [esp + 0x20]
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41d42a
push 0x4e1754
call fcn.0041b850
push esi
call fcn.004690f0
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x41d410
push eax
call fcn.004690f0
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41d4b2
push eax
call fcn.004690f0
add esp, 4
jmp 0x41d4b2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
lea ecx, [esp + 0x50]
call fcn.00424dc0
mov ecx, dword [0x594ab8]
push edi
lea eax, [esp + 0x50]
mov byte [esp + 0x84], 1
push eax
test ecx, ecx
jne 0x41d469
call dword [0x584a9c]
add esp, 8
jmp 0x41d470
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
call edx
inc dword [0x584a98]
push esi
call fcn.004690f0
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x41d490
push eax
call fcn.004690f0
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41d4a1
push eax
call fcn.004690f0
add esp, 4
lea ecx, [esp + 0x4c]
mov byte [esp + 0x80], 0
call fcn.00424ce0
lea ecx, [esp + 0x24]
call fcn.00431690
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004690b5
mov esp, ebp
pop ebp
ret