Function at 0x4137c0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x48106c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov dword [ebp - reloc.USER32.dll_PeekMessageA], ebx
mov dword [ebp - reloc.USER32.dll_PeekMessageA], ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
push ecx
push 0x473e7c
mov edx, ebx
mov dword [ebp - reloc.USER32.dll_PeekMessageA], eax
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 4
push 0x473e98
call fcn.0041e340
mov edx, eax
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, reloc.USER32.dll_PeekMessageA
add esp, 8
push eax
call edi
xor ebx, ebx
cmp eax, reloc.USER32.dll_PeekMessageA
setne bl
jne 0x41384a
push 0
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test esi, esi
je 0x413916
cmp word [esi], 0
je 0x413916
push ecx
push str.FastCopy.ini
mov edx, esi
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
add esp, 8
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call edi
cmp eax, reloc.USER32.dll_PeekMessageA
je 0x413916
test ebx, ebx
jne 0x4138a0
push 1
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
mov edx, dword [ebp - reloc.USER32.dll_PeekMessageA]
push ecx
push str.to_OldDir_VirtualStore_.lnk
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
push ecx
lea edx, reloc.USER32.dll_PeekMessageA
mov ecx, esi
call fcn.00426db0
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push 0x473f08
push eax
call fcn.00410120
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, reloc.USER32.dll_PeekMessageA
je 0x41391c
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call esi
jmp 0x41391c
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - reloc.USER32.dll_PeekMessageA], 0
jne 0x413929
test ebx, ebx
jne 0x4139a0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call edi
cmp eax, reloc.USER32.dll_PeekMessageA
je 0x4139a0
test ebx, ebx
jne 0x413951
push 1
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - reloc.USER32.dll_PeekMessageA], 0
je 0x4139a0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push str._s.obsolete
push eax
call fcn.00410120
add esp, 0xc
lea eax, reloc.USER32.dll_PeekMessageA
push eax
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call edi
cmp eax, reloc.USER32.dll_PeekMessageA
je 0x4139a0
lea eax, reloc.USER32.dll_PeekMessageA
push eax
call esi
mov edx, dword [ebp - reloc.USER32.dll_PeekMessageA]
push ecx
push str.to_ExeDir.lnk
lea ecx, reloc.USER32.dll_PeekMessageA
call fcn.0041f690
push ecx
mov ecx, dword [ebp - reloc.USER32.dll_PeekMessageA]
lea edx, reloc.USER32.dll_PeekMessageA
call fcn.00426db0
mov ecx, dword [ebp - 8]
add esp, 0xc
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.0043c755
mov esp, ebp
pop ebp
ret