Function at 0x403892
Capabilities:
Copy file
Create process on windows
Set file attributes

Disassembly:
enter 0xb10, 1
push ebx
push esi
push edi
push 0x40a758
push 0x403c4b
call fcn.004081d8
or esi, 0xffffffff
lea eax, [ebp - 0x6f0]
push eax
push dword [0x40b570]
push 0xff
call fcn.00407bbc
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.004066af
lea eax, [ebp - 0x5ed]
push eax
push dword [0x40b570]
call fcn.00407bec
mov byte [ebp - 0x5ee], 0x30
mov byte [ebp - 0x5ef], 0x30
call fcn.00403794
push 0x4000
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 0x5ed]
push eax
call sub.kernel32.dll_OpenFile
cmp eax, 0xffffffff
je 0x403927
cmp byte [ebp - 0x5ee], 0x39
jne 0x4038fc
push 0
mov eax, dword [ebp - 0x5ed]
push eax
mov eax, dword [0x40b570]
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x403991
cmp esi, 0xffffffff
jne 0x403991
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0x6f4]
push eax
lea eax, [ebp - 0x6f0]
push eax
call fcn.00401090
push eax
call fcn.00407286
lea eax, [ebp - 0x294]
push eax
call fcn.00407a08
lea eax, [ebp - 0x394]
push eax
call fcn.00407a08
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407bec
and esi, 0
jmp 0x4038ee
push 2
mov eax, dword [ebp - 0x5ed]
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0x40b739
push dword [ebp - 0x5ed]
call fcn.00407bec
mov byte [0x40fd51], 4
push 0x6eac
push dword [ebp - 0x5ed]
call fcn.00403514
test eax, eax
jne 0x4039cf
jmp 0x403c33
call fcn.00408810
test eax, eax
jne 0x403a21
push 0x40a6fb
push dword [ebp - 0x5ed]
call fcn.00407e20
test eax, eax
je 0x403a21
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0x6f8]
push eax
push 0x40a705
call fcn.00407c24
push dword [ebp - 0x5ed]
call fcn.00407c88
push 0x40a70f
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
call fcn.00408810
test eax, eax
je 0x403bae
push 0x40a719
push dword [ebp - 0x5ed]
call fcn.00407e20
test eax, eax
je 0x403b4f
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0x6fc]
push eax
push 0x40a723
call fcn.00407c24
push dword [ebp - 0x5ed]
call fcn.00407c88
push 0x40a72d
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
call fcn.00408810
mov esi, eax
mov edi, 1
jmp 0x403b45
lea eax, [ebp - 0x7fc]
push eax
push edi
call fcn.00408818
pop eax
cmp byte [eax + 1], 0x22
jne 0x403aee
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0x5ed]
call fcn.00407c24
push 0x40a737
call fcn.00407c88
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x900]
push eax
push edi
call fcn.00408818
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
jmp 0x403b44
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0x908]
push eax
push dword [ebp - 0x5ed]
call fcn.00407c24
push 0x40a741
call fcn.00407c88
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xa08]
push eax
push edi
call fcn.00408818
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
push 0x40a74c
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
inc edi
cmp esi, edi
jge 0x403a8c
jmp 0x403bae
call fcn.00408810
mov esi, eax
mov edi, 1
jmp 0x403baa
lea eax, [ebp - 0x5ed]
push eax
lea eax, [ebp - 0xa10]
push eax
push dword [ebp - 0x5ed]
call fcn.00407c24
push 0x40a756
call fcn.00407c88
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0xb10]
push eax
push edi
call fcn.00408818
call fcn.00407b38
pop eax
push dword [eax]
call fcn.00407c88
pop eax
push dword [eax]
call fcn.00407bec
inc edi
cmp esi, edi
jge 0x403b5d
mov dword [ebp - 0x3d8], 0x44
and dword [ebp - 0x3d4], 0
and dword [ebp - 0x3d0], 0
and dword [ebp - 0x3cc], 0
mov dword [ebp - 0x3ac], 1
and word [ebp - 0x3a6], 0
and dword [ebp - 0x3a4], 0
mov word [ebp - 0x3a8], 5
lea eax, [ebp - 0x5e9]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004071f5
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x5e9]
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x5ed]
push eax
mov eax, dword [0x40b739]
push eax
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop dword fs:[eax]
add esp, 8
push 0x403c52
push 0x40a758
call fcn.0040822c
ret