Function at 0x403440
Capabilities:
Copy file
Delete file
Get common file path
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e8
push esi
push edi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x158], 0x17
mov dword [ebp - 4], 0x40
mov dword [ebp - 0xe8], 0x40
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xe8]
lea edx, [eax + ecx + 4]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0xf4], 0x100000
push 0x400
push 0
lea eax, [ebp - 0x560]
push eax
call fcn.004078c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], ecx
cmp dword [ebp + 0xc], 0
je 0x40391e
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x40391e
lea ecx, [ebp - 0xe0]
push ecx
lea edx, [ebp - 0x5e0]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004031f0
mov dword [ebp - 0x150], eax
lea ecx, [ebp - 0x5e0]
mov dword [ebp + 0xc], ecx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [0x417140]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffff
je 0x40391c
push 0
mov eax, dword [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xec], eax
push 0
push 0
push 0
push 2
push 0
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [0x417148]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40390f
mov edx, dword [ebp - 0x5c]
push edx
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x403905
mov ecx, dword [ebp - 0x158]
mov edi, str.This_is_encryped_file
mov esi, dword [ebp - 0x154]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4038ef
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x158]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xe8]
mov edx, dword [eax + ecx]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0xe4]
push eax
push 3
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x150]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x154]
add edx, dword [ebp - 0x158]
push edx
call fcn.00403170
add esp, 0x1c
mov eax, dword [ebp - 0xe4]
push eax
push 3
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x150]
push edx
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 0x154]
add edx, dword [ebp - 0x158]
add edx, dword [ebp - 4]
push edx
call fcn.00403170
add esp, 0x1c
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x154], 0
mov ecx, dword [ebp - 4]
mov edi, 0x416120
lea esi, [ebp - 0x58]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4038e8
mov ecx, dword [ebp - 0xe8]
mov edi, 0x416160
lea esi, [ebp - 0x138]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4038e8
lea ecx, [ebp - 0x560]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x13c]
push eax
movzx ecx, word [ebp - 0x148]
push ecx
movzx edx, word [ebp - 0x140]
push edx
movzx eax, word [ebp - 0x13a]
push eax
movzx ecx, word [ebp - 0x13e]
push ecx
lea edx, [ebp - 0x560]
push edx
push 0x413a28
lea eax, [ebp - 0x560]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x560]
push ecx
call dword [0x417140]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffff
je 0x4038e6
push 0
mov edx, dword [ebp - 0xec]
sub edx, dword [ebp - 0x5c]
push edx
push 0
push 4
push 0
mov eax, dword [ebp - 0xf0]
push eax
call dword [0x417148]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4038ae
mov dword [ebp - 0x5e4], 0
mov ecx, dword [ebp - 0xec]
sub ecx, dword [ebp - 0x5c]
mov dword [ebp - 0xf8], ecx
mov edx, dword [ebp - 0x5e4]
cmp edx, dword [ebp - 0xf8]
jae 0x40388f
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0xf4]
jae 0x40378c
mov ecx, dword [ebp - 0xf8]
sub ecx, dword [ebp - 0x5e4]
mov dword [ebp - 0x5e8], ecx
jmp 0x403798
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x5e8], edx
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x5e4]
push edx
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jne 0x4037d1
jmp 0x40388f
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x5e4]
push edx
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40380f
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x154], 0
jmp 0x40388f
mov edx, dword [ebp - 0xe4]
push edx
push 3
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x154]
add ecx, dword [ebp - 0x5c]
push ecx
call fcn.00403170
add esp, 0x1c
mov dword [ebp - 0x14c], eax
mov edx, dword [ebp - 0x14c]
cmp edx, dword [ebp - 0x14]
je 0x403850
jmp 0x40388f
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov edx, dword [ebp - 0x5e4]
add edx, dword [ebp - 0x14c]
mov dword [ebp - 0x5e4], edx
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x403752
mov edx, dword [ebp - 0x5e4]
cmp edx, dword [ebp - 0xf8]
jne 0x4038a4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x417144]
cmp dword [ebp - 8], 0
jne 0x4038d9
push 0
push 0
mov ecx, dword [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0xf0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0xf0]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0xf0]
push ecx
call dword [0x417144]
jmp 0x4038ef
mov dword [ebp - 8], 1
cmp dword [ebp - 0x154], 0
je 0x403905
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0xc]
push eax
call dword [0x417144]
mov ecx, dword [ebp - 0x15c]
push ecx
call dword [0x417144]
jmp 0x403925
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x403949
push 0
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x560]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403949
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x560]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret