Function at 0x402a96
Capabilities:
Copy file
Get disk information
Set file attributes

Disassembly:
mov eax, 0x4173bb
call fcn.0040c8a0
mov eax, 0x2ae4
call fcn.0040d510
push ebx
push esi
push edi
call fcn.00401c0a
test eax, eax
je 0x40302b
mov eax, dword [0x4269c0]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [0x4269c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ebx, 0x104
mov esi, 0x424b90
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x424d98
push 1
push edi
push esi
call fcn.00401058
add esp, 0xc
test eax, eax
je 0x40302b
push ebx
push 0x424988
push 0x424eb4
call fcn.00401238
add esp, 0xc
test eax, eax
je 0x40302b
push esi
push 0x424988
call fcn.0040d591
pop ecx
test eax, eax
pop ecx
je 0x402e5c
mov eax, 0x1c28
call fcn.0040d510
mov esi, edi
mov ecx, 0x70a
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00401cb0
add esp, 0x1c28
test eax, eax
jne 0x402ba3
xor edx, edx
cmp dword [0x424d9e], edx
je 0x403020
and byte [ebp - 0x15c], dl
push 0x40
pop ecx
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push edx
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
push 0x424b90
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x4269c0]
lea edx, [ebp - 0x15c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
jmp 0x403020
push 0x424988
call fcn.00401466
test al, al
pop ecx
je 0x402d08
xor esi, esi
mov ecx, 0x709
xor eax, eax
lea edi, [ebp - 0x2aee]
mov word [ebp - 0x2af0], si
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2af0]
push eax
push 0x424988
call fcn.00401058
add esp, 0xc
test eax, eax
je 0x402d0a
mov ax, word [0x424d98]
cmp ax, word [ebp - 0x2af0]
jbe 0x403020
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0x9f4]
mov dword [ebp - 0x9f8], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9f8]
push eax
push 0x4000000
push 0x424988
call fcn.00401173
add esp, 0xc
test eax, eax
je 0x402d0a
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x362]
mov word [ebp - 0x364], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x364]
push ebx
push eax
lea eax, [ebp - 0x964]
push eax
call fcn.00401238
add esp, 0xc
test eax, eax
je 0x402d0a
and byte [ebp - 0x58], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x57]
and byte [ebp - 0x15c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
lea eax, [ebp - 0x364]
push ebx
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x58]
push str._u__d
push eax
call fcn.0040d53f
mov eax, dword [0x4269c0]
add esp, 0xc
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x15c]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x402d0a
xor edi, edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x364]
push eax
call fcn.00401466
test al, al
pop ecx
je 0x402d0a
inc edi
cmp edi, 0x78
jl 0x402ce4
jmp 0x402d0a
xor esi, esi
mov edi, 0x424988
push 1
push edi
call fcn.00401369
pop ecx
test eax, eax
pop ecx
je 0x403020
push esi
push edi
push 0x424b90
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x403020
and byte [ebp - 0x15c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x15b]
push 0x80
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x424988
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call fcn.00402974
cmp dword [0x424da2], esi
pop ecx
je 0x402d9c
mov eax, 0x1c28
call fcn.0040d510
mov ecx, 0x70a
mov esi, 0x424d98
mov edi, esp
push 0x424988
rep movsd dword es:[edi], dword [esi]
call fcn.00402056
add esp, 0x1c2c
xor esi, esi
mov edi, 0x424988
push esi
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x4269c0]
lea edx, [ebp - 0x15c]
push esi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x403020
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x936]
mov word [ebp - 0x938], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 3
lea eax, [ebp - 0x938]
push 0x424b90
push eax
call fcn.0040c433
add esp, 0xc
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x402e4c
and byte [ebp - 0x260], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x25f]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x260]
push ebx
push eax
push ebx
push 0x424b90
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x4269c0]
lea edx, [ebp - 0x260]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [0x4269c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
jmp 0x403045
push 3
call fcn.00401ee0
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [esp], 0x208
lea eax, [ebp - 0xc00]
push edi
push eax
call fcn.0040c470
push ebx
lea eax, [ebp - 0xc00]
push esi
push eax
call fcn.0040c433
lea eax, [ebp - 0xc00]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004052ca
add esp, 0x20
cmp eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
jle 0x402f40
and dword [ebp - 0x730], 0
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0x72c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0xc00]
push dword [ebp - 0x10]
push eax
call fcn.004056a3
add esp, 0xc
test al, al
je 0x402f31
mov eax, dword [ebp - 0x72c]
xor ecx, ecx
cmp word [0x4269ae], cx
ja 0x402ef6
test eax, 0x4010000
je 0x402f31
test al, 0x30
je 0x402f17
cmp dword [ebp - 0x14], 1
jne 0x402f09
test byte [ebp - 0x728], 2
je 0x402f31
cmp dword [ebp - 0x14], ecx
jne 0x402f1e
test byte [ebp - 0x728], 4
jmp 0x402f1c
test eax, 0x10000
je 0x402f31
push ecx
lea eax, [ebp - 0xc00]
push dword [ebp - 0x10]
push eax
call fcn.00404fbf
add esp, 0xc
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jl 0x402eab
and dword [ebp - 0xec8], 0
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0xec4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xec8]
push eax
push 0x4000000
push esi
call fcn.00401173
add esp, 0xc
test eax, eax
je 0x40301c
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x66e]
mov word [ebp - 0x670], si
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0xe34]
push eax
call fcn.00401238
add esp, 0xc
test eax, eax
je 0x40301c
and byte [ebp - 0x38], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x37]
and byte [ebp - 0x468], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x467]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
push esi
lea eax, [ebp - 0x468]
push ebx
push eax
lea eax, [ebp - 0x670]
push ebx
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x38]
push str._i__d
push eax
call fcn.0040d53f
mov eax, dword [0x4269c0]
add esp, 0xc
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x468]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jne 0x40302f
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x4269c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
jmp 0x403048
mov eax, dword [0x4269c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret