Function at 0x404ee4
Capabilities:
Copy file
Move file
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, 0x4107f0
xor edx, edx
push ebp
push 0x405224
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x404f24
mov esi, 0x101
mov ebx, 0x410683
mov eax, pe_nt_image_headers32
call fcn.004028d8
mov byte [ebx], al
inc ebx
dec esi
jne 0x404f14
cmp byte [0x4107e6], 0
je 0x404f79
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x4107d4]
mov edx, dword [0x4107ac]
call fcn.00403514
mov eax, dword [ebp - 4]
call fcn.004036c8
push eax
push dword [0x4107a0]
push dword [0x4107d0]
push dword [0x4107d4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403588
mov eax, dword [ebp - 8]
call fcn.004036c8
push eax
call sub.kernel32.dll_CopyFileA
cmp byte [0x4107e6], 0
je 0x404fa4
push dword [0x4107ac]
push 0x40523c
push dword [0x41079c]
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
jmp 0x404fcf
push dword [0x4107ac]
lea edx, [ebp - 0xc]
mov eax, 0x405248
call fcn.004041ac
push dword [ebp - 0xc]
push dword [0x41079c]
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 1
push 0x4107f8
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [edi], eax
push 0
push 0x41088c
push 0x7e00
push 0x408984
mov eax, dword [edi]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
push 0x41089c
push 0x41089c
push 0x41089c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x4107e6], 0
je 0x40509b
push dword [0x4107a0]
push dword [0x4107d0]
push dword [0x4107d4]
mov eax, 0x4107c4
mov edx, 3
call fcn.00403588
jmp 0x4050bb
push dword [0x4107a4]
push 0x40523c
push dword [0x410798]
mov eax, 0x4107c4
mov edx, 3
call fcn.00403588
cmp byte [0x4107e6], 0
je 0x405133
lea edx, [ebp - 0x10]
mov eax, 0x405258
call fcn.004041ac
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, 0x408884
mov ecx, pe_nt_image_headers32
call fcn.004034b0
mov edx, dword [ebp - 0x14]
mov eax, 0x4107bc
pop ecx
call fcn.00403514
mov eax, dword [0x4107bc]
call fcn.004036c8
push eax
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
mov eax, dword [0x4107c4]
call fcn.004036c8
push eax
lea edx, [ebp - 0x18]
mov eax, 0x405270
call fcn.004041ac
mov eax, dword [ebp - 0x18]
call fcn.004036c8
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x405150
push 5
mov eax, dword [0x4107c4]
call fcn.004036c8
push eax
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_MoveFileExA
push dword [0x4107b4]
push 0x40523c
lea edx, [ebp - 0x1c]
mov eax, 0x405280
call fcn.004041ac
push dword [ebp - 0x1c]
mov eax, 0x4107c0
mov edx, 3
call fcn.00403588
xor eax, eax
push ebp
push 0x4051ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
push 0
push 0
push 0
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 2
push 0x4107f8
mov eax, dword [0x4107c0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [edi], eax
push 0x410894
push 0x4108b4
call sub.kernel32.dll_SystemTimeToFileTime
push 0x410894
push 0x410894
push 0x410894
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x405209
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40522b
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403368
ret