Function at 0x417b10
Capabilities:
Copy file
Get disk size
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push esi
push edi
xor eax, eax
mov word [ebp - 0xac], ax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x144], 0x2cacd
mov ecx, dword [0x55c92c]
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x14], 0x637dd
movzx esi, word [ebp - 0xac]
add esi, 0x93e0
and esi, 0x384e2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, 0x5142
sub edi, eax
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub edi, eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
and edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x10c]
lea eax, [eax + edx - 0xfe6d]
and edi, eax
and edi, 0xa8000000
or esi, edi
mov dword [ebp - 0x10c], esi
mov esi, 0xfffd417d
sub esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, 0x2952
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
or esi, eax
xor ecx, ecx
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea edx, [eax + edx + 0x2a182]
xor eax, eax
sub edx, dword [ebp - 0x70]
sbb eax, dword [ebp - 0x6c]
or esi, edx
or ecx, eax
mov dword [ebp - 0x10c], esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor ecx, ecx
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], ecx
mov edx, dword [ebp - 0x150]
cmp edx, dword [ebp - 0x70]
jne 0x417c9a
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x6c]
jne 0x417c9a
movzx ecx, word [ebp - 0xac]
cmp ecx, 0x6cf0f
jne 0x417c9a
movzx edx, word [ebp - 0xac]
sub edx, 0xe735
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
sub edx, 0x40677
mov esi, edx
xor edi, edi
sub esi, dword [ebp - 0x70]
sbb edi, dword [ebp - 0x6c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
sub esi, eax
sbb edi, ecx
or esi, 0x43534
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
jmp 0x417cef
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
sub eax, 0xdb92
sub eax, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
lea eax, [eax + edx + 0x1955e]
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
add eax, dword [ebp - 0x70]
adc ecx, dword [ebp - 0x6c]
movzx edx, word [ebp - 0xac]
mov esi, dword [ebp - 0x10c]
lea edx, [edx + esi - 0x72004]
xor esi, esi
or eax, edx
or ecx, esi
mov byte [ebp - 0x81], al
cmp dword [ebp - 0x10c], 0x7b235
je 0x417d07
cmp dword [ebp - 0x10c], 0x7587
jae 0x417d1b
mov eax, dword [ebp - 0x70]
or eax, 0x19314
mov ecx, dword [ebp - 0x6c]
mov word [ebp - 0xac], ax
jmp 0x417d56
mov esi, dword [ebp - 0x10c]
xor edi, edi
add esi, dword [ebp - 0x70]
adc edi, dword [ebp - 0x6c]
or esi, 0x7a3e4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor edx, edx
or esi, eax
or edi, edx
mov eax, dword [ebp - 0x10c]
add eax, 0x54583
xor ecx, ecx
or esi, eax
or edi, ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
movzx edx, byte [ebp - 0x81]
sub eax, edx
xor eax, 0x66f2a
mov dword [ebp - 0x10c], eax
mov esi, dword [ebp - 0x70]
add esi, 0x19888
mov edi, dword [ebp - 0x6c]
adc edi, 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ecx, eax
add ecx, 0x691aa
mov eax, esi
mov edx, edi
call fcn.0043dfd0
mov esi, eax
mov edi, edx
and esi, 0x4b53c
and edi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
and esi, edx
and edi, eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
add eax, dword [ebp - 0x10c]
xor ecx, ecx
and esi, eax
and edi, ecx
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
xor eax, eax
or esi, edx
or edi, eax
mov ecx, dword [ebp - 0x10c]
xor edx, edx
or esi, ecx
or edi, edx
mov dword [ebp - 0x10c], esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
test eax, eax
je 0x417e2f
movzx eax, byte [ebp - 0x81]
cmp dword [ebp - 0x10c], eax
je 0x417e2f
movzx ecx, byte [ebp - 0x81]
cmp ecx, dword [ebp - 0x10c]
jbe 0x417e2b
xor edx, edx
jne 0x417e2f
xor eax, eax
je 0x417e42
mov ecx, 0x5960a
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
jmp 0x417e70
mov esi, 0x51d54
sub esi, dword [ebp - 0x10c]
movzx edx, word [ebp - 0xac]
add esi, edx
or esi, 0x43e19
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
or esi, eax
mov dword [ebp - 0x10c], esi
movzx eax, word [ebp - 0xac]
mov ecx, 0x4fd
sub ecx, dword [ebp - 0x10c]
or eax, ecx
mov dword [ebp - 0x10c], eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov esi, eax
add esi, 0x199cc
and esi, 0x5868f
mov edi, dword [ebp - 0x10c]
add edi, 0x4324e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
sub edi, eax
and esi, edi
mov dword [ebp - 0x10c], esi
movzx edx, byte [ebp - 0x81]
add edx, 0x13e4c
movzx eax, word [ebp - 0xac]
or edx, eax
or edx, 0x987fd
mov byte [ebp - 0x81], dl
movzx esi, word [ebp - 0xac]
or esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edi, eax
movzx ecx, word [ebp - 0xac]
add edi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea edx, [edi + eax + 0xcd2f]
sub edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea ecx, [edx + eax + 0x4019e]
or esi, ecx
or esi, 0x33b0c
or esi, 0x245a8
or esi, 0xa975
mov dword [ebp - 0x10c], esi
movzx esi, byte [ebp - 0x81]
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
sub esi, eax
mov edi, dword [ebp - 0x10c]
add edi, 0xdfcb
sub edi, dword [ebp - 0x10c]
add edi, 0x55230
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
sub edi, eax
and esi, edi
and esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
sub eax, 0x62993
and esi, eax
or esi, 0x3be28
mov dword [ebp - 0x10c], esi
mov edx, 0xe1c
mov word [ebp - 0xac], dx
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
test eax, eax
je 0x417fd8
cmp dword [ebp - 0x10c], 0x3e752
jae 0x417feb
mov eax, dword [ebp - 0x10c]
or eax, 0x3dc0c
mov dword [ebp - 0x10c], eax
jmp 0x418004
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov ecx, 0x2c379
sub ecx, dword [ebp - 0x10c]
and eax, ecx
mov byte [ebp - 0x81], al
movzx esi, word [ebp - 0xac]
push 0
push 0
call sub.KERNEL32.dll_Module32First
mov edi, eax
add esi, dword [ebp - 0x10c]
add edi, esi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
movzx edx, byte [ebp - 0x81]
add eax, edx
sub eax, dword [ebp - 0x10c]
movzx ecx, word [ebp - 0xac]
sub eax, ecx
movzx edx, byte [ebp - 0x81]
lea esi, [eax + edx - 0xf9c3]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
sub esi, eax
shl esi, 0x5d
and edi, esi
mov dword [ebp - 0x10c], edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
sub eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
add ecx, 0x11875d
and eax, ecx
or eax, 0x3e582
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8