Function at 0x401647
Capabilities:
Copy file
Get file size
Parse pe header
Read file on windows
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push ecx
push edx
push esi
push edi
mov dword [ebp - 4], 1
push 0x402167
push dword fs:[0]
mov dword [0x404371], esp
mov dword [0x404375], ebp
mov dword [0x404379], ebx
mov dword [0x40437d], esi
mov dword [0x404381], edi
mov dword [0x404385], 0x401c89
mov dword fs:[0], esp
push 0x104
push 0x40455d
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_GetDlgItemTextA
push 0x10
push 0x404765
push 0xbba
push dword [0x40438d]
call sub.user32.dll_GetDlgItemTextA
push 0x10
push 0x404775
push 0xbc2
push dword [0x40438d]
call sub.user32.dll_GetDlgItemTextA
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x40455d
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401745
push 0x10
push str.Protector__by_iiiila_
push 0x40309c
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 4], 0
jmp 0x401c94
mov dword [0x40426d], eax
push 0x404765
call sub.kernel32.dll_lstrlenA
or eax, eax
jne 0x401791
push 0x10
push str.Protector__by_iiiila_
push 0x4030ab
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0xbba
push dword [0x40438d]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
mov dword [ebp - 4], 0
jmp 0x401c89
mov dword [ebp - 0xc], eax
push 0x404775
push 0x404765
call sub.kernel32.dll_lstrcmpA
or eax, eax
je 0x4017ee
push 0x10
push str.Protector__by_iiiila_
push 0x4030ba
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0
push 0xbba
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbc2
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
mov dword [ebp - 4], 0
jmp 0x401c89
push 0xbbb
push dword [0x40438d]
call sub.user32.dll_IsDlgButtonChecked
cmp eax, 1
jne 0x401832
push 0x40455d
push 0x404661
call sub.kernel32.dll_lstrcpyA
push str..bak
push 0x404661
call sub.kernel32.dll_lstrcatA
push 1
push 0x404661
push 0x40455d
call sub.kernel32.dll_CopyFileA
push 0
push esp
push 0x40
push 0x4043fd
push dword [0x40426d]
call sub.kernel32.dll_ReadFile
cmp word [0x4043fd], 0x5a4d
je 0x4019d3
push 0
push dword [0x40426d]
call sub.kernel32.dll_GetFileSize
or eax, eax
jne 0x4018e5
push 0x10
push str.Protector__by_iiiila_
push 0x4030e2
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbba
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbc2
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_SetFocus
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call sub.user32.dll_SendMessageA
mov dword [ebp - 4], 0
jmp 0x401c89
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push 0
push dword [0x40426d]
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x405ba9], eax
push 0
push 0
push 0
push 6
push dword [0x405ba9]
call sub.kernel32.dll_MapViewOfFile
mov dword [0x405bad], eax
mov esi, dword [0x405bad]
xor ecx, ecx
xor edx, edx
mov edi, 0x404765
mov al, byte [ecx + esi]
mov ah, byte [edx + edi]
xor al, ah
rol al, 3
mov byte [ecx + esi], al
inc ecx
inc edx
cmp edx, dword [ebp - 0xc]
jbe 0x401940
xor edx, edx
cmp ecx, dword [ebp - 8]
jbe 0x401929
push 0
push 0
push 0
push dword [0x40426d]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x405bb1
push dword [ebp - 8]
push dword [0x405bad]
push dword [0x40426d]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0xc]
push 0x404765
call fcn.00401114
mov dword [0x404248], eax
push 2
push 0
push 0
push dword [0x40426d]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x405bb1
push 0x20
push dword [0x404248]
push dword [0x40426d]
call sub.kernel32.dll_WriteFile
push dword [0x405bad]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x405ba9]
call sub.kernel32.dll_CloseHandle
mov dword [0x405ba9], 0
jmp 0x401c89
push 0
push 0
push dword [0x404439]
push dword [0x40426d]
call sub.kernel32.dll_SetFilePointer
push 0
push esp
push 0xf8
push 0x40443d
push dword [0x40426d]
call sub.kernel32.dll_ReadFile
cmp dword [0x40443d], 0x4550
je 0x401a65
push 0x10
push str.Protector__by_iiiila_
push 0x4030f1
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbba
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbc2
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
mov dword [ebp - 4], 0
jmp 0x401c89
xor eax, eax
xor edx, edx
movzx ecx, word [0x404443]
push ecx
push eax
push edx
push 0
push esp
push 0x28
push 0x404535
push dword [0x40426d]
call sub.kernel32.dll_ReadFile
push 0x404535
push 0x40310c
call sub.kernel32.dll_lstrcmpA
or eax, eax
jne 0x401abe
push 0x10
push str.Protector__by_iiiila_
push 0x403110
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
mov dword [ebp - 4], 0
jmp 0x401c89
pop edx
mov eax, dword [0x404549]
add eax, dword [0x404545]
cmp eax, edx
jbe 0x401ad0
mov edx, eax
pop eax
mov ecx, dword [0x404541]
add ecx, dword [0x40453d]
cmp eax, ecx
jae 0x401ae3
mov eax, ecx
pop ecx
loop 0x401a70
mov dword [0x404535], 0x646b2e
mov dword [0x40453d], 0x1020
mov dword [0x404541], eax
mov dword [0x404545], 0x1020
mov dword [0x404549], edx
mov dword [0x40454d], ecx
mov dword [0x404551], ecx
mov dword [0x404555], ecx
mov edx, 0xfff
test dword [0x404541], edx
je 0x401b42
and edx, dword [0x404541]
sub edx, 0x1000
neg edx
add dword [0x404541], edx
xor edx, edx
mov eax, dword [0x404549]
mov ecx, 0x200
div ecx
test edx, edx
je 0x401b62
sub edx, 0x200
neg edx
add dword [0x404549], edx
mov dword [0x404559], 0xe00000e0
push 0
push esp
push 0x28
push 0x404535
push dword [0x40426d]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [0x404549]
push dword [0x40426d]
call sub.kernel32.dll_SetFilePointer
push esi
push edi
mov esi, section.code
mov edi, 0x404785
mov ecx, 0x408
rep movsd dword es:[edi], dword [esi]
mov ecx, 0
rep movsb byte es:[edi], byte [esi]
mov esi, 0x404785
mov ecx, 0x1020
mov eax, dword [esi]
and eax, 0xfffff000
cmp eax, section.code
jne 0x401bdd
mov eax, dword [esi]
sub eax, section.code
add eax, dword [0x404471]
add eax, dword [0x404541]
mov dword [esi], eax
inc esi
loop 0x401bba
mov eax, dword [0x404465]
add eax, dword [0x404471]
mov dword [0x405454], eax
call fcn.00402267
lea ebx, [0x404765]
call fcn.0040228f
mov dword [esi], eax
mov edi, 0x404eae
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push esp
push 0x111d
push 0x404785
push dword [0x40426d]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [0x404439]
push dword [0x40426d]
call sub.kernel32.dll_SetFilePointer
mov eax, dword [0x404541]
add eax, 0x8a1
inc word [0x404443]
mov dword [0x404465], eax
push dword [0x404475]
push 0x111d
call fcn.004022b3
add dword [0x40448d], eax
push 0
pop dword [0x40450d]
push 0
push esp
push 0xf8
push 0x40443d
push dword [0x40426d]
call sub.kernel32.dll_WriteFile
push dword [0x40426d]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 4], 1
jne 0x401ce7
push 0x40
push str.Protector__by_iiiila_
push 0x403125
push dword [0x40438d]
call sub.user32.dll_MessageBoxA
push 0
push 0xbb9
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbba
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
push 0
push 0xbc2
push dword [0x40438d]
call sub.user32.dll_SetDlgItemTextA
pop dword fs:[0]
add esp, 4
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret