Function at 0x4111f0
Capabilities:
Allocate or change rwx memory
Copy file
Create directory
Delete file
Get common file path
Hide graphical window
Inspect load icon resource
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
cld
mov ebp, esp
push edi
xor eax, eax
push esi
lea edi, [ebp - 0x5c]
push ebx
mov ecx, 0xc
sub esp, 0x3b4
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3b4], 0
lea edi, [ebp - 0x38c]
mov cl, 0x1e
rep stosb byte es:[edi], al
push 0x412e44
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
mov dword [ebp - 0x5c], 0x30
lea esi, [ebp - 0x16c]
mov dword [ebp - 0x54], 0x4014fe
push ecx
mov dword [ebp - 0x48], ecx
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x34], 0x412e3c
call sub.USER32.dll_RegisterClassExA
cld
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [0x413521], eax
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
push 0x412e4b
not ecx
dec ecx
mov word [0x413525], cx
call sub.KERNEL32.dll_LoadLibraryA
push 0x412e54
mov edi, 0x41412c
call sub.KERNEL32.dll_LoadLibraryA
push 0x412e5d
call sub.KERNEL32.dll_LoadLibraryA
lea eax, [ebp - 0x3a0]
push eax
push 5
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x41412c
push dword [ebp - 0x3a0]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push 0x412e65
push 0x41412c
call sub.msvcrt.dll_strcat
cld
xor eax, eax
mov dword [0x413532], 0x41412c
mov ecx, ebx
repne scasb al, byte es:[edi]
push 0x41423c
not ecx
dec ecx
push 0x104
mov edi, 0x41423c
mov word [0x413536], cx
call sub.KERNEL32.dll_GetTempPathA
cld
xor eax, eax
mov dword [0x413543], 0x41423c
mov ecx, ebx
lea ebx, [ebp - 0x3a4]
repne scasb al, byte es:[edi]
push 0x104
not ecx
dec ecx
push esi
push 0
mov word [0x413547], cx
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
push 0
push 0
push 0x118
push eax
mov dword [ebp - 0x3b0], eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x3a8]
push ebx
push 4
push eax
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_ReadFile
pop edi
mov edx, dword [ebp - 0x3a8]
pop eax
cmp edx, 1
sbb eax, eax
and eax, 2
sub edx, 0x20
push eax
push 0
push edx
push dword [ebp - 0x3b0]
mov dword [ebp - 0x3a4], eax
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebx
push 0x20
push 0x41410c
push dword [ebp - 0x3b0]
mov dword [ebp - 0x3a8], eax
call sub.KERNEL32.dll_ReadFile
mov eax, dword [0x414128]
test eax, eax
je 0x4113bb
cmp eax, dword [ebp - 0x3a8]
jl 0x4114c3
push dword [ebp - 0x3b0]
mov edi, esi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x3ac]
push eax
push 0x41434c
push 0x104
push esi
call sub.KERNEL32.dll_GetFullPathNameA
mov eax, dword [ebp - 0x3ac]
mov dword [eax], 0x5c62696c
mov word [eax + 4], 0x24
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x16c], 0x22
pop ecx
pop ebx
jne 0x411420
lea eax, [ebp - 0x16b]
push eax
push esi
call sub.msvcrt.dll_strcpy
push 0x22
push esi
call sub.msvcrt.dll_strrchr
mov byte [eax], 0
add esp, 0x10
push 0x2e
push edi
call sub.msvcrt.dll_strrchr
pop ebx
mov ebx, eax
pop edx
push 0x5c
push edi
call sub.msvcrt.dll_strrchr
pop edx
cmp ebx, eax
pop ecx
ja 0x411447
push 0x412e67
push edi
call sub.msvcrt.dll_strcat
pop edi
pop eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
push 2
push 0
push 0
push eax
mov dword [ebp - 0x3b0], eax
call sub.KERNEL32.dll_SetFilePointer
mov dword [ebp - 0x3a8], eax
mov dword [0x414128], eax
add eax, 0x11b00
cmp eax, 0x211700
mov dword [0x414114], 0x80000000
mov dword [0x414118], 0x80000000
mov dword [0x41411c], 1
mov dword [0x414120], 0
jge 0x4114b2
mov eax, 0x211700
mov dword [0x41410c], eax
mov dword [0x414110], 0
jmp 0x41150a
push 0x41434c
push 0
push 0x412e6c
push 0x41423c
call sub.KERNEL32.dll_GetTempFileNameA
push 0x41434c
call sub.KERNEL32.dll_DeleteFileA
push 0
push 0x41434c
call sub.KERNEL32.dll_CreateDirectoryA
push 0x412e70
push 0x41434c
call sub.msvcrt.dll_strcat
pop ecx
mov dword [ebp - 0x3b4], 1
pop ebx
mov dword [ebp - 0x38c], 1
mov dword [ebp - 0x384], 0x41434c
mov word [ebp - 0x37c], 0x214
jmp 0x41153d
mov eax, dword [0x41369c]
mov edx, 2
mov ecx, edx
cdq
idiv ecx
mov dword [0x41369c], eax
mov eax, dword [0x41369c]
cmp eax, dword [0x41410c]
jle 0x411579
push 0x40
push 0x2000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x411529
push 0x40
push 0x1000
push dword [0x41410c]
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x4140b8], eax
test eax, eax
jne 0x411596
push 0x30
push 0x412e34
push 0x412e74
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 1
jmp 0x411ad8
mov dword [eax + 0x11700], 0xffff00
mov ebx, eax
lea ecx, [eax + 0x11700]
add ebx, dword [0x41410c]
mov dword [0x4140b4], ecx
mov eax, 3
cmp dword [ebp - 0x3b0], 0xffffffff
mov dword [0x4140b0], ebx
je 0x411ad8
mov edx, dword [0x414128]
lea eax, [ecx + edx]
cmp eax, ebx
jae 0x411937
lea eax, [ebp - 0x3ac]
mov esi, dword [ebp - 0x3a8]
mov edi, 0x41445c
push eax
lea eax, [ebp - 0x16c]
sub esi, edx
push 0x41445c
push 0x104
push eax
sub esi, dword [0x414110]
call sub.KERNEL32.dll_GetFullPathNameA
push dword [ebp - 0x3ac]
lea eax, [ebp - 0x36c]
push eax
call sub.msvcrt.dll_strcpy
cld
mov eax, dword [ebp - 0x3ac]
or edx, 0xffffffff
mov ecx, edx
mov byte [eax], 0
xor eax, eax
mov dword [0x4134e1], 0x41445c
repne scasb al, byte es:[edi]
mov dword [0x4134f2], 0x41434c
not ecx
mov edi, 0x41434c
dec ecx
mov word [0x4134e5], cx
mov ecx, edx
repne scasb al, byte es:[edi]
pop eax
not ecx
sub ecx, 2
mov word [0x4134f6], cx
pop edx
mov eax, dword [ebp - 0x3a8]
sub eax, dword [0x414128]
cmp esi, eax
jge 0x4118ec
push 0
lea ebx, [ebp - 0x16c]
push 0
push esi
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x3a4]
push eax
push 0x104
push ebx
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_ReadFile
movsx ecx, byte [ebp - 0x16c]
lea edx, [ebp - 0x167]
mov eax, dword [ebp - 0x16b]
cld
mov edi, edx
mov dword [ebp - 0x3bc], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x3b8], eax
xor eax, eax
repne scasb al, byte es:[edi]
test byte [ebp - 0x3bc], 2
not ecx
lea esi, [esi + ecx + 5]
je 0x411704
movzx eax, word [0x4134f6]
push ecx
push edx
lea eax, [ebx + eax]
push eax
call sub.msvcrt.dll_memmove
movzx eax, word [0x4134f6]
push eax
push 0x41434c
jmp 0x411723
movzx eax, word [0x4134e5]
push ecx
push edx
lea eax, [ebx + eax]
push eax
call sub.msvcrt.dll_memmove
movzx eax, word [0x4134e5]
push eax
push 0x41445c
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0x16c]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
mov edi, eax
je 0x4117fc
push 0
push 0
push esi
push dword [ebp - 0x3b0]
mov dword [ebp - 0x3c0], 0
call sub.KERNEL32.dll_SetFilePointer
jmp 0x4117bb
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x3a4]
mov eax, dword [0x414124]
mov dword [ebp - 0x3a4], eax
mov eax, dword [0x41410c]
push ecx
cmp eax, edx
jle 0x411791
mov eax, edx
push eax
push dword [0x4140b8]
push dword [ebp - 0x3b0]
call fcn.00411b3c
push dword [ebp - 0x3a4]
push dword [0x4140b8]
push edi
call fcn.00411af0
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jne 0x4117e6
push 1
mov eax, dword [ebp - 0x3b8]
push 0
push 0
lea ebx, [esi + eax]
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_SetFilePointer
mov edx, ebx
sub edx, eax
test edx, edx
jg 0x41176e
push edi
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x3c0], 0
jne 0x4117fc
inc edi
jne 0x4118e1
push 0
lea ebx, [ebp - 0x16c]
push 0
push 2
push 0
push 0
push 0x40000000
push 0x41434c
call sub.KERNEL32.dll_CreateFileA
push eax
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x388], 1
lea eax, [ebp - 0x38c]
push eax
mov dword [ebp - 0x380], ebx
call sub.SHELL32.DLL_SHFileOperationA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
mov edi, eax
je 0x411a9c
push 0
push 0
push esi
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x4118b9
push dword [ebp - 0x3bc]
lea ebx, [ebp - 0x3a4]
mov eax, dword [0x414124]
mov dword [ebp - 0x3a4], eax
mov eax, dword [0x41410c]
push ebx
cmp eax, edx
jle 0x411892
mov eax, edx
push eax
push dword [0x4140b8]
push dword [ebp - 0x3b0]
call fcn.00411b3c
push 0
push ebx
push dword [ebp - 0x3a4]
push dword [0x4140b8]
push edi
call sub.KERNEL32.dll_WriteFile
push 1
mov ecx, dword [ebp - 0x3b8]
push 0
push 0
lea ebx, [esi + ecx]
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_SetFilePointer
mov edx, ebx
sub edx, eax
test edx, edx
jg 0x41186f
push edi
call sub.KERNEL32.dll_CloseHandle
add esi, dword [ebp - 0x3b8]
jmp 0x411667
push 0
mov eax, dword [ebp - 0x3a8]
sub eax, dword [0x414128]
push 0
push eax
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_SetFilePointer
push dword [0x414120]
mov eax, dword [0x414124]
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x3a4]
push eax
push dword [0x414128]
push dword [0x4140b4]
push dword [ebp - 0x3b0]
call fcn.00411b3c
push dword [ebp - 0x3b0]
call sub.KERNEL32.dll_CloseHandle
test byte [0x414120], 8
je 0x4119aa
push 0
mov eax, dword [0x414114]
push 0x2cf0000
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x394], eax
mov eax, dword [0x414118]
mov dword [ebp - 0x398], 0
mov dword [ebp - 0x390], eax
lea eax, [ebp - 0x39c]
push eax
call sub.USER32.dll_AdjustWindowRect
mov eax, dword [ebp - 0x394]
sub eax, dword [ebp - 0x39c]
mov dword [0x414114], eax
mov eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0x398]
mov dword [0x414118], eax
push 0
lea eax, [ebp - 0x36c]
push dword [ebp + 8]
movzx esi, word [0x4134f6]
push 0
push 0
push dword [0x414118]
push dword [0x414114]
push 0x80000000
push 0x80000000
push 0x2cf0000
push eax
push 0x412e3c
push 0
call sub.USER32.dll_CreateWindowExA
mov ebx, eax
mov eax, dword [0x41411c]
cmp eax, 1
je 0x4119f7
push eax
jmp 0x4119fa
push dword [ebp + 0x14]
push ebx
call sub.USER32.dll_ShowWindow
push ebx
mov dword [0x4133a4], ebx
call sub.USER32.dll_UpdateWindow
cmp dword [0x4133a4], 0
je 0x411a64
jmp 0x411a51
mov eax, dword [0x413422]
test eax, eax
je 0x411a2b
push ebx
push eax
call sub.USER32.dll_TranslateMDISysAccel
test eax, eax
jne 0x411a51
mov eax, dword [0x413414]
test eax, eax
je 0x411a45
push ebx
push eax
push dword [0x41343f]
call sub.USER32.dll_TranslateAcceleratorA
test eax, eax
jne 0x411a51
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
push 0
lea ebx, [ebp - 0x2c]
push 0
push 0
push ebx
call sub.USER32.dll_GetMessageA
test eax, eax
jne 0x411a17
cmp dword [ebp - 0x3b4], 0
je 0x411a8c
mov word [esi + 0x41434b], 0
lea eax, [ebp - 0x38c]
push eax
mov dword [ebp - 0x388], 3
call sub.SHELL32.DLL_SHFileOperationA
cmp dword [0x4133a4], 0
mov eax, 4
je 0x411ad8
jmp 0x411ad5
push 0x14
push 0x412e88
push dword [0x4140b8]
call sub.msvcrt.dll_memcpy
push ebx
push dword [0x4140b8]
call sub.msvcrt.dll_strcat
push 0x30
push 0x412e34
push dword [0x4140b8]
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 2
jmp 0x411ad8
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10