Function at 0x404f10
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get file size
Read file on windows
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xf68
mov eax, dword [0x4c7008]
xor eax, esp
mov dword [esp + 0xf64], eax
push esi
push edi
lea eax, [esp + 0x540]
push eax
push 0
push 0
push 0x801c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x540]
push str.Temp
push eax
call edi
push str.2C842907_671F_42FF_82E3_134CCA9B21EE
lea eax, [esp + 0x544]
push eax
call edi
push 0
lea eax, [esp + 0x544]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [esp + 0x540]
push eax
lea eax, [esp + 0xb5c]
push 0x104
push eax
call fcn.0040d30e
add esp, 0xc
lea eax, [esp + 0xb58]
push str.__icon__.ico
push eax
call edi
lea ecx, [esp + 0xb58]
call fcn.00404d00
push 0x104
lea eax, [esp + 0xd64]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshta.exe
lea eax, [esp + 0xd64]
push eax
call edi
push 0x104
lea eax, [esp + 0x954]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00401250
mov ecx, eax
test ecx, ecx
je 0x405a43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x950]
test eax, 0xffff0000
jne 0x405024
movzx eax, ax
lea ecx, [esp + 0x10]
push eax
call fcn.00405d60
jmp 0x405051
lea ecx, [esp + 0x950]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405030
sub ecx, edx
lea eax, [esp + 0x950]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00405fe0
mov edi, dword [esp + 0x10]
push 0x5c
push edi
mov dword [esp + 0x1c], edi
call fcn.00407a61
add esp, 8
test eax, eax
je 0x405105
sub eax, edi
sar eax, 1
js 0x405105
lea ecx, [eax + 1]
mov eax, dword [edi - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.00405c10
mov eax, dword [esp + 0x18]
lea edx, [edi - 0x10]
mov dword [esp + 0x18], edx
lea esi, [eax - 0x10]
cmp esi, edx
je 0x4050f0
cmp dword [edx + 0xc], 0
lea edi, [edx + 0xc]
jl 0x4050db
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x4050db
mov ecx, esi
call fcn.00405f00
mov dword [esp + 0x20], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4050d6
mov edi, dword [esp + 0x18]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x20]
lea edi, [eax + 0x10]
jmp 0x4050ec
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
push eax
call fcn.00405fe0
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], edi
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x405105
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esp + 0x540]
push eax
lea eax, [esp + 0x74c]
push 0x104
push eax
call fcn.0040d30e
add esp, 0xc
lea eax, [esp + 0x748]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [esp + 0x74c]
push eax
lea eax, [esp + 0xd68]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40539e
push 2
push 0
lea eax, [esp + 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x405198
xor eax, eax
mov dword [esp + 0x18], 1
mov word [0x4c8824], ax
lea eax, [esp + 0x18]
push eax
push 0x404ce0
push 0x423268
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
lea eax, [esp + 0x74c]
push eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x4051c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov esi, eax
jmp 0x405a04
movzx eax, word [0x4c8824]
push 0
push 0x80
push 3
push 0
push 1
mov dword [esp + 0x34], eax
lea eax, [esp + 0xb6c]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x40534e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.00406b98
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
push 0
push eax
push esi
mov esi, dword [esp + 0x1c]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, word [esi + 4]
dec ecx
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax*2 + 0x14]
push eax
mov dword [esp + 0x30], eax
call fcn.00406b98
movzx ecx, word [esi]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], 0
mov word [eax], cx
movzx ecx, word [esi + 2]
mov word [eax + 2], cx
movzx ecx, word [esi + 4]
mov word [eax + 4], cx
xor ecx, ecx
cmp cx, word [esi + 4]
jae 0x40531e
add eax, 7
add esi, 6
mov dword [esp + 0x1c], eax
nop dword [eax]
mov edi, dword [esp + 0x1c]
movzx eax, byte [esi]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
add edx, dword [esp + 0x10]
mov byte [edi - 1], al
movzx eax, byte [esi + 1]
mov byte [edi], al
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
movzx eax, byte [esi + 3]
mov byte [edi + 2], al
movzx eax, word [esi + 4]
mov word [edi + 3], ax
movzx eax, word [esi + 6]
mov word [edi + 5], ax
mov eax, dword [esi + 8]
push ecx
mov dword [edi + 7], eax
mov eax, dword [esp + 0x2c]
push edx
push dword [esp + 0x28]
inc eax
mov word [edi + 0xb], ax
movzx eax, ax
push eax
push 3
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov edi, dword [esp + 0x14]
test eax, eax
je 0x40534e
mov eax, dword [esp + 0x10]
add esi, 0x10
mov ecx, dword [esp + 0x28]
add dword [esp + 0x1c], 0xe
inc ecx
mov dword [esp + 0x28], ecx
movzx eax, word [eax + 4]
cmp ecx, eax
jl 0x405290
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push dword [esp + 0x2c]
push eax
push dword [esp + 0x28]
push 0
push 0xe
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
test eax, eax
je 0x40534e
push esi
call fcn.0040662d
add esp, 4
push dword [esp + 0x18]
call fcn.0040662d
add esp, 4
push 0
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
test eax, eax
jne 0x40536f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov esi, eax
jmp 0x405a04
lea eax, [esp + 0xb58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x50
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00408090
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00403fc0
add esp, 8
test eax, eax
jne 0x4053af
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0x14]
jmp 0x405a04
mov esi, dword [esp + 0x80]
xor ecx, ecx
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
cmp ecx, eax
jge 0x4057d2
test esi, esi
je 0x4053e1
cmp ecx, eax
jae 0x4053e1
mov eax, dword [esi + 0x10]
lea edi, [ecx*4]
mov eax, dword [eax + edi]
add eax, dword [esi]
jmp 0x4053ea
xor eax, eax
lea edi, [ecx*4]
push ecx
lea edx, [esp + 0xec]
push edx
mov edx, ecx
lea ecx, [esp + 0x40]
push eax
call fcn.00404090
mov esi, dword [esp + 0x8c]
add esp, 0xc
test eax, eax
je 0x405742
test esi, esi
je 0x40544c
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x48]
jae 0x40544c
mov eax, dword [esi + 0x10]
mov eax, dword [eax + edi]
add eax, dword [esi]
je 0x40544c
movzx ecx, word [eax + 0x1c]
test ecx, ecx
je 0x40543c
cmp byte [eax + ecx + 0x2d], 0x2f
je 0x40570e
test byte [eax + 0x26], 0x10
je 0x405454
mov ecx, dword [esp + 0x24]
inc ecx
jmp 0x4053b8
mov dword [esp + 0x54], 0x18
mov eax, dword [esp + 0x118]
push eax
mov dword [esp + 0x20], eax
call fcn.00406b98
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x144]
add esp, 4
lea ecx, [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], edi
push eax
sub esp, 8
call fcn.00404460
add esp, 0xc
test eax, eax
je 0x405707
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x38]
sub esp, 0xc
push esi
push edi
call fcn.00404730
add esp, 0x14
test eax, eax
je 0x405707
call fcn.00401250
mov ecx, eax
test ecx, ecx
je 0x405a43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x540]
test eax, 0xffff0000
jne 0x4054ef
movzx eax, ax
lea ecx, [esp + 0x10]
push eax
call fcn.00405d60
jmp 0x405521
lea ecx, [esp + 0x540]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405500
sub ecx, edx
lea eax, [esp + 0x540]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00405fe0
push 1
push 0x423154
lea ecx, [esp + 0x18]
call fcn.00406160
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0x14]
call fcn.00405a50
mov edi, dword [esp + 0x10]
push 0x5c
push edi
call fcn.00407a61
mov esi, eax
add esp, 8
test esi, esi
je 0x40564e
sub esi, edi
sar esi, 1
mov dword [esp + 0x20], esi
js 0x40564e
cmp esi, dword [edi - 0xc]
jl 0x40557b
lea ecx, [edi - 0x10]
call fcn.00405f00
lea esi, [eax + 0x10]
jmp 0x4055e2
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x40558f
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4055a7
call fcn.00401250
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x405a43
mov eax, dword [ecx]
push 2
push esi
mov eax, dword [eax]
call eax
test eax, eax
je 0x405a3e
lea esi, [eax + 0x10]
mov eax, dword [esp + 0x20]
cmp eax, dword [esi - 8]
jg 0x405a34
mov dword [esi - 0xc], eax
xor ecx, ecx
add eax, eax
mov word [eax + esi], cx
test eax, eax
je 0x4055e2
push eax
push edi
push esi
call fcn.00407b10
add esp, 0xc
lea ecx, [esp + 0x540]
mov eax, esi
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405616
test dx, dx
je 0x405612
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405616
add eax, 4
add ecx, 4
test dx, dx
jne 0x4055f0
xor eax, eax
jmp 0x40561b
sbb eax, eax
or eax, 1
test eax, eax
je 0x405636
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405636
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40564e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x40571f
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push 0
push ecx
push esi
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x28], esi
jne 0x405718
push dword [esp + 0x18]
call fcn.0040662d
mov ecx, dword [esp + 0x104]
add esp, 4
mov eax, dword [esp + 0x104]
add ecx, 0xb6109100
mov edx, 0x989680
adc eax, 2
mul edx
mov esi, eax
mov eax, ecx
mov ecx, 0x989680
mul ecx
mov dword [esp + 0x30], eax
add esi, edx
lea eax, [esp + 0x30]
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0x20]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x405707
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x80]
mov ecx, dword [esp + 0x24]
inc ecx
jmp 0x4053b8
mov esi, 1
jmp 0x405721
xor esi, esi
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x405a00
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x405a00
test esi, esi
je 0x4057c0
cmp dword [esp + 0x60], 0
je 0x4057c0
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4057c0
cmp dword [esp + 0x4c], 1
jne 0x4057c0
mov dword [esp + 0x80], 0
push dword [esi]
push dword [esp + 0x70]
call eax
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push dword [esi + 0x10]
push dword [esp + 0x78]
call dword [esp + 0x74]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push dword [esi + 0x20]
push dword [esp + 0x80]
call dword [esp + 0x7c]
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
push esi
push dword [esp + 0x88]
call dword [esp + 0x84]
add esp, 0x20
mov dword [esp + 0x4c], 0
mov esi, 1
jmp 0x405a00
mov dword [esp + 0x54], 0x18
mov esi, 1
jmp 0x405a00
test esi, esi
je 0x405848
cmp dword [esp + 0x60], 0
je 0x405848
mov eax, dword [esp + 0x64]
test eax, eax
je 0x405848
cmp dword [esp + 0x4c], 1
jne 0x405848
mov dword [esp + 0x80], 0
push dword [esi]
push dword [esp + 0x70]
call eax
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push dword [esi + 0x10]
push dword [esp + 0x78]
call dword [esp + 0x74]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push dword [esi + 0x20]
push dword [esp + 0x80]
call dword [esp + 0x7c]
xorps xmm0, xmm0
movups xmmword [esi + 0x20], xmm0
push esi
push dword [esp + 0x88]
call dword [esp + 0x84]
add esp, 0x20
mov dword [esp + 0x4c], 0
jmp 0x405850
mov dword [esp + 0x54], 0x18
call fcn.00401250
mov ecx, eax
test ecx, ecx
je 0x405a43
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, 0x423270
test eax, 0xffff0000
jne 0x405888
movzx eax, ax
push eax
call fcn.00405d60
jmp 0x405894
push 1
push 0x423270
call fcn.00405fe0
lea ecx, [esp + 0x748]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4058a0
sub ecx, edx
lea eax, [esp + 0x748]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00406160
push 3
push 0x423274
lea ecx, [esp + 0x18]
call fcn.00406160
lea ecx, [esp + 0x540]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4058e0
sub ecx, edx
lea eax, [esp + 0x540]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00406160
push 1
push 0x423154
lea ecx, [esp + 0x18]
call fcn.00406160
mov ecx, str.3.hta
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405920
sub ecx, edx
sar ecx, 1
push ecx
push str.3.hta
lea ecx, [esp + 0x18]
call fcn.00406160
push 1
push 0x423270
lea ecx, [esp + 0x18]
call fcn.00406160
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0xb8], eax
xorps xmm0, xmm0
mov dword [esp + 0xc8], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0xb4], eax
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x8c]
movlpd qword [esp + 0x98], xmm0
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
push esi
push 0
movlpd qword [esp + 0xc4], xmm0
movlpd qword [esp + 0xcc], xmm0
movlpd qword [esp + 0xd4], xmm0
movlpd qword [esp + 0xe8], xmm0
movaps xmmword [esp + 0xf8], xmm0
mov dword [esp + 0xb0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4059fe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov edi, dword [esp + 0x14]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x405a1c
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0xf6c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0040661f
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00401040
call fcn.00406150
push 0x80004005
call fcn.00401040
int3