Function at 0x416600
Capabilities:
Copy file
Create pipe
Get disk information
Get disk size
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0x413e8
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x10c]
and eax, 0x5fc87
or eax, 0x6c700
mov dword [ebp - 0x10c], eax
movzx ecx, byte [ebp - 0x81]
cmp ecx, dword [ebp - 0x10c]
jb 0x416669
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, 0xb85a
jae 0x416686
mov edx, 1
test edx, edx
je 0x416686
xor eax, eax
je 0x416686
xor ecx, ecx
je 0x416686
movzx edx, word [ebp - 0xac]
add edx, 0x5212c
or edx, dword [ebp - 0x10c]
xor eax, eax
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], eax
jmp 0x4166ae
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x10c]
lea edx, [eax + edx + 0x7da33]
xor ecx, edx
or ecx, dword [ebp - 0x10c]
mov word [ebp - 0xac], cx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
movzx ecx, byte [ebp - 0x81]
sub ecx, dword [ebp - 0x10c]
mov edx, dword [ebp - 0x10c]
lea ecx, [ecx + edx + 0x38ded]
and eax, ecx
movzx edx, word [ebp - 0xac]
mov ecx, 0x22d12
sub ecx, edx
sub ecx, 0x69c47
sub ecx, dword [ebp - 0x10c]
sub ecx, dword [ebp - 0x10c]
or eax, ecx
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
add edx, 0x62139
or edx, 0x31c3
mov dword [ebp - 0x10c], edx
push 0
push 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x6cc16
je 0x41676e
mov esi, dword [ebp - 0x10c]
and esi, 0x9efe
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax - 0x1ce43]
and esi, edx
and esi, 0x5da78
xor esi, 0x50192
or esi, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], esi
jmp 0x4167e8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, eax
movzx edi, word [ebp - 0xac]
movzx ebx, word [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
sub ebx, eax
and edi, ebx
mov eax, dword [ebp - 0x10c]
add eax, 0x664a1
and edi, eax
or esi, edi
xor edi, edi
mov ebx, dword [ebp - 0x70]
add ebx, 0x1ee81
mov eax, dword [ebp - 0x6c]
adc eax, 0
push 0
mov dword [ebp - 0x14c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp - 0x14c]
sbb eax, ecx
mov edx, dword [ebp - 0x10c]
xor ecx, ecx
sub ebx, edx
sbb eax, ecx
or esi, ebx
or edi, eax
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
add esi, dword [ebp - 0x10c]
movzx edi, word [ebp - 0xac]
add edi, 0x99b03
call dword [sym.imp.KERNEL32.dll_GetACP]
sub edi, eax
and esi, edi
movzx edx, word [ebp - 0xac]
or esi, edx
xor edi, edi
mov ebx, dword [ebp - 0x70]
sub ebx, 0x28258
mov eax, dword [ebp - 0x6c]
sbb eax, 0
push 0
mov dword [ebp - 0x150], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xb573b
xor ecx, ecx
and ebx, eax
mov eax, dword [ebp - 0x150]
and eax, ecx
or esi, ebx
or edi, eax
mov edx, dword [ebp - 0x10c]
add edx, 0x421b5
xor eax, eax
or esi, edx
or edi, eax
mov dword [ebp - 0x10c], esi
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
or esi, 0x74810
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
mov edi, 0x5fb36
sub edi, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add edi, dword [ebp - 0x10c]
add eax, edi
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x3002c
and eax, ecx
and eax, dword [ebp - 0x10c]
or esi, eax
mov dword [ebp - 0x10c], esi
mov edx, dword [ebp - 0x10c]
add edx, 0x71350
and edx, 0x6cfe
movzx eax, word [ebp - 0xac]
or edx, eax
mov dword [ebp - 0x10c], edx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
sub eax, 0x67
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x86
ja case.0x41691c.1
mov ecx, dword [ebp - 0x154]
movzx edx, byte [ecx + 0x416db8]
jmp dword [edx*4 + 0x416d9c]
movzx eax, word [ebp - 0xac]
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea ecx, [ecx + edx - 0x87969]
sub ecx, dword [ebp - 0x10c]
and eax, ecx
mov dword [ebp - 0xbc], eax
jmp 0x416aa2
movzx esi, word [ebp - 0xac]
add esi, dword [ebp - 0x10c]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
add esi, eax
movzx edx, word [ebp - 0xac]
lea esi, [esi + edx + 0xdff16]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esi, eax
sub esi, dword [ebp - 0x10c]
mov dword [ebp - 0xbc], esi
jmp 0x416aa2
movzx esi, byte [ebp - 0x81]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esi + eax + 0xeeed8]
sub eax, dword [ebp - 0x10c]
and eax, dword [ebp - 0x10c]
and eax, 0x4a9cf
movzx ecx, byte [ebp - 0x81]
mov edx, 0xd026
sub edx, ecx
movzx ecx, byte [ebp - 0x81]
lea edx, [edx + ecx + 0xe4bb]
and eax, edx
mov dword [ebp - 0xbc], eax
jmp 0x416aa2
mov eax, dword [ebp - 0x10c]
add eax, 0xb2c45
mov word [ebp - 0xac], ax
jmp 0x416aa2
mov esi, dword [ebp - 0x10c]
sub esi, dword [ebp - 0x10c]
sub esi, 0x6e5dd
and esi, dword [ebp - 0x10c]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
and esi, eax
mov dword [ebp - 0xbc], esi
jmp 0x416aa2
mov dword [ebp - 0xbc], 0x3cac7
jmp 0x416aa2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
mov esi, eax
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0x10c]
lea edi, [ecx + edx + 0x19aa6]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea ecx, [ebx + eax + 0x4631a]
movzx eax, word [ebp - 0xac]
add ecx, eax
shl edi, cl
and esi, edi
mov dword [ebp - 0x10c], esi
movzx esi, byte [ebp - 0x81]
and esi, 0x3f0b5
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
movzx ecx, byte [ebp - 0x81]
add eax, ecx
and eax, dword [ebp - 0x10c]
or esi, eax
or esi, 0x36e97
mov dword [ebp - 0x10c], esi
movzx edx, word [ebp - 0xac]
mov ecx, 0x252b9
sub ecx, edx
sub ecx, 0x333b2
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
call fcn.0043dfb0
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x10c], 0
jmp 0x416b20
mov eax, dword [ebp - 0x10c]
add eax, 0xbb1
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xbb1
jae 0x416b77
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov ecx, dword [ebp - 0x10c]
sub ecx, eax
add ecx, 0x67a30
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x10c]
add edx, 0x6c492
movzx eax, byte [ebp - 0x81]
sub edx, eax
and edx, dword [ebp - 0x10c]
or ecx, edx
mov dword [ebp - 0xbc], ecx
jmp 0x416b0f
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x158]
sub edx, 0x39
mov dword [ebp - 0x158], edx
cmp dword [ebp - 0x158], 0xb2
ja case.0x416baf.1
mov eax, dword [ebp - 0x158]
movzx ecx, byte [eax + 0x416e54]
jmp dword [ecx*4 + 0x416e40]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
movzx edx, byte [ebp - 0x81]
sub eax, edx
mov esi, eax
xor edi, edi
and esi, dword [ebp - 0x70]
and edi, dword [ebp - 0x6c]
movzx eax, word [ebp - 0xac]
sub eax, dword [ebp - 0x10c]
xor ecx, ecx
and esi, eax
and edi, ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
movzx edx, byte [ebp - 0x81]
add edx, 0x60b37
sub edx, dword [ebp - 0x10c]
add edx, 0x6a95d
and eax, edx
xor ecx, ecx
or esi, eax
or edi, ecx
mov edx, dword [ebp - 0x10c]
xor eax, eax
add edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
adc ecx, eax
or esi, edx
or edi, ecx
mov dword [ebp - 0xbc], esi
jmp 0x416d36
mov ebx, dword [ebp - 0x10c]
add ebx, 0x7cf69
mov edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
add edx, dword [ebp - 0x10c]
and ebx, edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
add eax, dword [ebp - 0x10c]
and ebx, eax
or ebx, dword [ebp - 0x10c]
mov byte [ebp - 0x81], bl
jmp 0x416d36
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov ecx, dword [ebp - 0x10c]
lea edx, [ecx + eax + 0x1a2c]
sub edx, dword [ebp - 0x10c]
movzx eax, byte [ebp - 0x81]
add eax, 0x6351b
sub eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x10c]
lea eax, [eax + ecx + 0x6291c]
or edx, eax
mov dword [ebp - 0xbc], edx
jmp 0x416d36
mov ecx, dword [ebp - 0x70]
add ecx, 0xa4e58
mov esi, dword [ebp - 0x6c]
adc esi, 0
mov edx, dword [ebp - 0x10c]
xor eax, eax
add ecx, edx
adc esi, eax
sub ecx, 0x77d7
sbb esi, 0
mov edx, dword [ebp - 0x10c]
and edx, 0x83376
movzx eax, word [ebp - 0xac]
and edx, eax
xor eax, eax
or ecx, edx
or esi, eax
movzx eax, byte [ebp - 0x81]
add eax, 0x298b3
cdq
or ecx, eax
or esi, edx
mov dword [ebp - 0xbc], ecx
jmp 0x416d36
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor edx, edx
add eax, dword [ebp - 0x70]
adc edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
call fcn.0043dfd0
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x10c]
jne 0x416d54
push 0
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
mov dword [ebp - 0x10c], eax
jmp 0x416d8a
movzx edx, word [ebp - 0xac]
mov esi, 0x7418f
sub esi, edx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
add esi, eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esi, eax
or esi, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], esi
mov al, byte [ebp - 0x81]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c