Function at 0x4102c0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1230
call fcn.00401000
mov ecx, dword [ebp + 0x10]
call fcn.004162d0
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [ebp - 0x35d], 0
lea ecx, [ebp - 0x358]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00410b30
add esp, 8
movzx eax, al
test eax, eax
je 0x410310
mov byte [ebp - 0x35d], 1
jmp 0x4104f1
mov byte [ebp - 0x369], 0
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jl 0x410369
cmp dword [ebp - 0x368], 0x19
jg 0x410369
mov edx, dword [ebp - 0x368]
push edx
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.SHLWAPI.dll_PathBuildRootA]
lea ecx, [ebp - 0x364]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x410369
mov byte [ebp - 0x369], 1
movzx edx, byte [ebp - 0x369]
test edx, edx
je 0x4103b8
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.DENKIPM.dll_Ordinal_1276]
mov dword [ebp - 0x1230], eax
lea eax, [ebp - 0x364]
push eax
mov ecx, dword [ebp - 0x1230]
push ecx
push 0x41
push 0xbc0
push 0x7fb
mov edx, dword [ebp + 8]
push edx
call fcn.00428bd0
add esp, 0x18
cmp eax, 1
je 0x4103b3
jmp 0x4104f1
jmp 0x4104ec
lea ecx, [ebp - 0x374]
call dword [sym.imp.DENKIPM.dll_Ordinal_1075]
push str.8.00
lea ecx, [ebp - 0x370]
call dword [sym.imp.DENKIPM.dll_Ordinal_1077]
lea eax, [ebp - 0x374]
push eax
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.DENKIPM.dll_Ordinal_1244]
movzx ecx, al
test ecx, ecx
je 0x410492
lea edx, [ebp - 0x370]
push edx
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.DENKIPM.dll_Ordinal_1086]
movzx ecx, al
test ecx, ecx
je 0x410492
mov ecx, dword [ebp + 0x10]
call fcn.00416360
push eax
lea edx, [ebp - 0x680]
push edx
call fcn.0040ef60
add esp, 8
mov ecx, dword [ebp + 0x10]
call fcn.00416360
push eax
push 0x425
push 0x200
lea eax, [ebp - 0x578]
push eax
call fcn.004289c0
add esp, 0x10
lea ecx, [ebp - 0x578]
push ecx
push 0x104
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x358]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00429240
add esp, 0x14
movzx edx, al
test edx, edx
jne 0x410490
lea ecx, [ebp - 0x370]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
lea ecx, [ebp - 0x374]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
jmp 0x4104f1
jmp 0x4104d4
push 0
push 0x104
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x358]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004291e0
add esp, 0x14
movzx eax, al
test eax, eax
jne 0x4104d4
lea ecx, [ebp - 0x370]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
lea ecx, [ebp - 0x374]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
jmp 0x4104f1
lea ecx, [ebp - 0x370]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
lea ecx, [ebp - 0x374]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
jmp 0x4102ea
movzx ecx, byte [ebp - 0x35d]
test ecx, ecx
jne 0x410503
xor al, al
jmp 0x410b29
push 0x42c54c
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x35c]
call dword [sym.imp.DENKIPM.dll_Ordinal_1075]
push str.8.00
lea ecx, [ebp - 4]
call dword [sym.imp.DENKIPM.dll_Ordinal_1077]
lea ecx, [ebp - 0x35c]
push ecx
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.DENKIPM.dll_Ordinal_1244]
movzx edx, al
test edx, edx
je 0x4106a8
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x35c]
push ecx
call dword [sym.imp.DENKIPM.dll_Ordinal_1087]
movzx edx, al
test edx, edx
je 0x4106a8
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0xffffffff
je 0x4106a3
mov edx, dword [ebp - 0x250]
and edx, 0x10
je 0x4105a4
jmp 0x41067a
push str.Setup.
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x4105e6
push str.Setup32.
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x4105e6
push str.Setup64.
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
je 0x4105eb
jmp 0x41067a
push str.autorun.inf
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x410603
jmp 0x41067a
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x790]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x898]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x898]
push ecx
lea edx, [ebp - 0x790]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x410650
jmp 0x410696
lea eax, [ebp - 0x898]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.0041a3a0
push 0
lea ecx, [ebp - 0x898]
push ecx
lea edx, [ebp - 0x790]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call fcn.0040e680
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x684]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410594
mov edx, dword [ebp - 0x684]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x410b07
mov al, byte [0x42b726]
mov byte [ebp - 0x9a0], al
push 0x103
push 0
lea ecx, [ebp - 0x99f]
push ecx
call fcn.00425e10
add esp, 0xc
mov ecx, dword [ebp + 0x10]
call fcn.00416360
push eax
lea edx, [ebp - 0xaa8]
push edx
call fcn.0040ef60
add esp, 8
lea eax, [ebp - 0xaa8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xbb0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 0x42c514
lea eax, [ebp - 0xaa8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x410725
push str.ACAD_EL
lea ecx, [ebp - 0xaa8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41073e
push str.SamplesSampleSymbols
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x9a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x9a0]
push ecx
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xbb0]
push eax
lea ecx, [ebp - 0x358]
push ecx
call fcn.00410ce0
add esp, 0x10
movzx edx, al
test edx, edx
jne 0x41078d
mov byte [ebp - 0x1229], 0
lea ecx, [ebp - 4]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
lea ecx, [ebp - 0x35c]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
mov al, byte [ebp - 0x1229]
jmp 0x410b29
push str....
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xbb4], eax
cmp dword [ebp - 0xbb4], 0xffffffff
je 0x410b07
mov ecx, dword [ebp - 0x250]
and ecx, 0x10
je 0x4109f3
push 0x42c4e4
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4107f7
jmp 0x410ade
push str...MISC_
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push str.MISC_
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x1228]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x410846
push 0
lea edx, [ebp - 0x1228]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str...MISC.
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x1120]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [ebp - 0xf08]
push edx
lea eax, [ebp - 0x1120]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xf0c], eax
cmp dword [ebp - 0xf0c], 0xffffffff
je 0x4109f3
mov ecx, dword [ebp - 0xf08]
and ecx, 0x10
je 0x410945
movzx edx, byte [ebp + 0x1c]
test edx, edx
je 0x410945
push str.MSDE
lea eax, [ebp - 0xedc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4108cd
push str.MYDB
lea ecx, [ebp - 0xedc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x410940
push str...MISC
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x1018]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0xedc]
push ecx
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x42c4e4
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x1228]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea edx, [ebp - 0xedc]
push edx
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x1228]
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.00410ce0
add esp, 0x10
jmp 0x4109ca
push str...MISC_
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0xedc]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.MISC_
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0xedc]
push ecx
lea edx, [ebp - 0x1228]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x1228]
push eax
lea ecx, [ebp - 0x1018]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4109ca
lea edx, [ebp - 0x1228]
push edx
lea eax, [ebp - 0x1018]
push eax
call fcn.00413ca0
add esp, 8
lea ecx, [ebp - 0xf08]
push ecx
mov edx, dword [ebp - 0xf0c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410886
mov eax, dword [ebp - 0xf0c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.Setup.
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x410a35
push str.Setup32.
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x410a35
push str.Setup64.
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
je 0x410a3a
jmp 0x410ade
push str.autorun.inf
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x410a55
jmp 0x410ade
push 0x42c4a8
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0xcc0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0xcc0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0xdc8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0xdc8]
push eax
lea ecx, [ebp - 0xcc0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x410ab4
jmp 0x410afa
lea edx, [ebp - 0xdc8]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.0041a3a0
lea eax, [ebp - 0xdc8]
push eax
lea ecx, [ebp - 0xcc0]
push ecx
call fcn.00413ca0
add esp, 8
call fcn.0040e680
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0xbb4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4107cd
mov ecx, dword [ebp - 0xbb4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 0x122a], 1
lea ecx, [ebp - 4]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
lea ecx, [ebp - 0x35c]
call dword [sym.imp.DENKIPM.dll_Ordinal_1078]
mov al, byte [ebp - 0x122a]
mov esp, ebp
pop ebp
ret