Function at 0x4015a5
Capabilities:
Check if file exists
Create process on windows
Delete file
Get disk information
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [0x4063e4]
mov ecx, dword [esp + 4]
sub esp, 0x1c
mov dword [eax + 0x30], ecx
mov eax, dword [0x4063e4]
push ebx
push ebp
xor ebp, ebp
push esi
mov dword [eax + 0x18], ebp
mov eax, dword [0x4063e4]
push edi
add eax, 0x13a30
push ebp
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ecx, dword [0x4063e4]
mov dword [ecx + 0x34], eax
mov ecx, dword [0x4063e4]
mov eax, dword [ecx + 0x34]
cmp eax, 0xffffffff
jne 0x4015fc
add ecx, 0x13a30
push ecx
call fcn.00403c3b
jmp 0x401e22
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebp
push eax
call esi
mov ecx, dword [0x4063e4]
push ebp
mov dword [ecx + 0x1c], eax
mov eax, dword [0x4063e4]
push dword [eax + 0x344f]
push dword [eax + 0x34]
call esi
cmp eax, 0xffffffff
jne 0x401631
call fcn.00402464
jmp 0x401e22
mov ecx, dword [0x4063e4]
cmp eax, dword [ecx + 0x1c]
jbe 0x401646
call fcn.00403be0
jmp 0x401e22
add ecx, 0x13d38
push 4
lea eax, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp byte [esp + 0x10], 0
mov byte [esp + 0x12], 0x5c
mov dword [esp + 0x14], ebp
je 0x401677
cmp byte [esp + 0x11], 0x3a
jne 0x401677
lea eax, [esp + 0x10]
jmp 0x401679
xor eax, eax
push ebp
lea ecx, [esp + 0x1c]
push ebp
push ecx
lea ecx, [esp + 0x20]
push ecx
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [0x4063e4]
test byte [eax + 0x36a8], 4
je 0x4016af
lea ecx, [eax + 0x3448]
push 2
push ecx
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll__lread]
push 0xa001
call fcn.004023c5
mov word [0x4063f4], bp
mov eax, dword [0x4063e4]
push 2
pop edi
mov esi, dword [sym.imp.KERNEL32.dll__lread]
mov dword [eax + 0x36aa], ebp
lea eax, [esp + 0x30]
push edi
push eax
mov eax, dword [0x4063e4]
push dword [eax + 0x34]
call esi
cmp eax, edi
jne 0x401d4a
cmp word [esp + 0x30], bp
je 0x401d4a
movsx eax, word [esp + 0x30]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x4063e4]
mov dword [ecx + 0x36aa], eax
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
cmp ecx, ebp
je 0x401c98
mov ax, word [esp + 0x30]
mov word [ecx], ax
movsx eax, word [esp + 0x30]
sub eax, edi
push eax
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
add ecx, edi
push ecx
push dword [eax + 0x34]
call esi
movsx ecx, word [esp + 0x30]
sub ecx, edi
cmp eax, ecx
jne 0x401d45
mov eax, dword [0x4063e4]
mov eax, dword [eax + 0x36aa]
cmp word [eax + 2], 0x6c2d
jne 0x401d45
cmp byte [eax + 4], 0x68
jne 0x401d45
cmp byte [eax + 6], 0x2d
jne 0x401d45
movzx eax, byte [eax + 5]
push eax
push str.04567d
call sub.CRTDLL.dll_strchr
pop ecx
test eax, eax
pop ecx
je 0x401d45
mov eax, dword [0x4063e4]
mov esi, dword [eax + 0x36aa]
mov dword [eax + 0x3c], ebp
mov eax, dword [0x4063e4]
add esi, 0x18
mov word [eax + 0x24c], bp
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
movzx cx, byte [ecx + 0x13]
mov word [eax + 0x24a], cx
mov ax, word [esi]
cmp ax, bp
je 0x4017e7
movsx edi, ax
lea eax, [esi + 2]
push edi
push eax
call fcn.00403072
add esi, edi
jmp 0x4017ce
mov eax, dword [0x4063e4]
mov eax, dword [eax + 0x3c]
cmp eax, ebp
je 0x401d45
mov word [eax], bp
mov eax, dword [0x4063e4]
mov word [eax + 0x250], bp
movsx eax, word [esp + 0x30]
push eax
mov eax, dword [0x4063e4]
push dword [eax + 0x36aa]
call fcn.0040240d
mov ecx, dword [0x4063e4]
cmp ax, word [ecx + 0x248]
jne 0x401d45
mov ax, word [ecx + 0x24c]
cmp ax, bp
je 0x401859
movzx eax, ax
inc eax
add ecx, 0x136ae
push eax
push dword [ecx - 0x1366e]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [0x4063e4]
movzx eax, word [ecx + 0x24e]
inc eax
push eax
movzx eax, word [ecx + 0x24c]
push dword [ecx + 0x44]
lea eax, [eax + ecx + 0x136ae]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [0x4063e4]
push 0x2f
add eax, 0x136ae
push eax
call fcn.00401e2c
cmp dword [esp + 0x34], 1
jne 0x401907
mov eax, dword [0x4063e4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x406258
mov ecx, dword [eax + 0x36aa]
add eax, 0x136ae
push eax
mov cx, word [ecx + 0x15]
xor word [0x4063f4], cx
call esi
test eax, eax
jne 0x4018ce
mov eax, dword [0x4063e4]
mov byte [eax + 0x344e], 1
jmp 0x4018f4
mov eax, dword [0x4063e4]
push 0x406254
add eax, 0x136ae
push eax
call esi
test eax, eax
jne 0x401c86
mov eax, dword [0x4063e4]
mov byte [eax + 0x344e], 2
mov eax, dword [0x4063e4]
or dword [eax + 0x38], 0xffffffff
mov eax, dword [0x4063e4]
jmp 0x401b4b
mov eax, dword [0x4063e4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
add eax, 0x136ae
push 0x406258
push eax
call esi
test eax, eax
je 0x401c86
mov eax, dword [0x4063e4]
push 0x406254
add eax, 0x136ae
push eax
call esi
test eax, eax
je 0x401c86
mov eax, dword [0x4063e4]
lea ecx, [eax + 0x136ae]
push ecx
lea ecx, [eax + 0x13d38]
add eax, 0x13b34
push ecx
push eax
call fcn.00401eab
mov eax, dword [0x4063e4]
push 0x2f
add eax, 0x13b34
push eax
call fcn.00401e2c
mov eax, dword [0x4063e4]
cmp byte [eax + 0x13b34], 0
lea ecx, [eax + 0x13b34]
je 0x401994
cmp byte [eax + 0x13b35], 0x3a
jne 0x401994
lea ecx, [eax + 0x13b36]
xor eax, eax
cmp dword [esp + 0x14], 0xff
sete al
push eax
push ecx
call fcn.00403372
mov eax, dword [0x4063e4]
push 0x20
lea ecx, [eax + 0x13b34]
add eax, 0x17e38
push ecx
push eax
call fcn.004022fc
mov eax, dword [0x4063e4]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [eax + 0x17e38]
push ecx
push 0x65
push dword [eax + 0x30]
call esi
mov eax, dword [0x4063e4]
push str.Extract..._0_
push 0x66
push dword [eax + 0x30]
call esi
mov eax, dword [0x4063e4]
add eax, 0x13b34
push eax
call fcn.00401e6d
cmp dword [0x4063d8], ebp
je 0x401a17
mov eax, dword [0x4063e4]
mov eax, dword [eax + 0x36aa]
add eax, 0xf
push eax
call fcn.00403114
mov eax, dword [0x4063e4]
mov eax, dword [eax + 0x36aa]
push dword [eax + 0xf]
call fcn.004031a5
mov dword [esp + 0x1c], eax
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
cmp byte [ecx + 5], 0x64
je 0x401b0c
add eax, 0x13b34
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov eax, dword [0x4063e4]
cmp ebx, 0xffffffff
je 0x401b0c
add eax, 0x13b34
push eax
call fcn.00401030
mov esi, eax
mov eax, dword [0x4063e4]
push str.Overwrite_
lea ecx, [eax + 0x13b34]
add eax, 0x17e38
push ecx
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [0x4063ec], ebp
je 0x401aa3
cmp esi, dword [esp + 0x1c]
jb 0x401aa3
push 7
jmp 0x401aad
cmp dword [0x4063d0], ebp
je 0x401ab0
push 6
pop eax
jmp 0x401ad1
mov eax, dword [0x4063e4]
push 0x2023
lea ecx, [eax + 0x3453]
push ecx
lea ecx, [eax + 0x17e38]
push ecx
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x401d37
cmp eax, 7
je 0x401c86
mov eax, dword [0x4063e4]
cmp byte [eax + 0x36a9], 0
je 0x401b0c
test bl, 0x10
jne 0x401b0c
add eax, 0x13b34
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
cmp byte [ecx + 5], 0x64
je 0x401b4b
push ebp
push 0x80
push 2
push ebp
push ebp
add eax, 0x13b34
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x4063e4]
mov dword [ecx + 0x38], eax
mov eax, dword [0x4063e4]
cmp dword [eax + 0x38], 0xffffffff
je 0x401cb7
mov word [eax + 0x250], bp
mov eax, dword [0x4063e4]
or dword [eax], 0xffffffff
mov eax, dword [0x4063e4]
mov eax, dword [eax + 0x36aa]
mov cl, byte [eax + 5]
cmp cl, 0x30
jne 0x401b77
push dword [eax + 0xb]
call fcn.00402ffb
jmp 0x401b81
cmp cl, 0x64
je 0x401b81
call fcn.00402488
push 1
pop esi
cmp dword [esp + 0x34], esi
jne 0x401be8
mov ecx, dword [0x4063e4]
cmp dword [ecx + 0x18], ebp
jne 0x401cc7
mov al, byte [ecx + 0x344e]
cmp al, 1
jne 0x401bce
lea eax, [ecx + 0x3453]
push 0x2024
push eax
lea eax, [ecx + 0x17e38]
push eax
push dword [ecx + 0x30]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x401bd7
mov eax, dword [0x4063e4]
mov dword [eax + 0x18], esi
jmp 0x401bd7
cmp al, 2
jne 0x401bd7
call fcn.0040352e
mov eax, dword [0x4063e4]
and byte [eax + 0x344e], 0
jmp 0x4016c0
mov eax, dword [0x4063e4]
cmp dword [eax + 0x18], ebp
jne 0x401cd0
mov eax, dword [eax + 0x36aa]
cmp byte [eax + 5], 0x64
je 0x4016c0
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x20]
push dword [esp + 0x26]
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [esp + 0x24]
push eax
mov eax, dword [0x4063e4]
push ebp
push ebp
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [0x4063e4]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
mov eax, dword [0x4063e4]
je 0x401cf8
mov ecx, dword [eax + 0x36aa]
mov dx, word [eax + 0x250]
cmp dx, word [ecx + 0x15]
jne 0x401d16
cmp byte [eax + 0x36a9], 0
je 0x4016c0
movzx ecx, word [eax + 0x24a]
add eax, 0x13b34
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x4016c0
call fcn.00403c04
test eax, eax
je 0x401d4a
jmp 0x4016c0
lea ecx, [eax + 0x3453]
push 0x2010
push ecx
push str.Not_enough_memory
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401d37
add eax, 0x13b34
push eax
call fcn.00403c3b
jmp 0x401d4a
and byte [ecx + 0x344e], 0
jmp 0x401d4a
mov ecx, dword [eax + 0x36aa]
cmp byte [ecx + 5], 0x64
je 0x401d4a
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4063e4]
add eax, 0x13b34
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401d4a
add eax, 0x13b34
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4063e4]
add eax, 0x13b34
push eax
push str.Close_ERROR
jmp 0x401d32
add eax, 0x13b34
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4063e4]
add eax, 0x13b34
push eax
push str.CRC_ERROR
call fcn.00402380
mov eax, dword [0x4063e4]
mov dword [eax + 0x18], 1
jmp 0x401d4a
call fcn.00403c5a
mov eax, dword [0x4063e4]
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x4063e4]
push 1
pop esi
cmp dword [esp + 0x34], esi
jne 0x401da1
cmp dword [eax + 0x18], ebp
jne 0x401da1
test byte [eax + 0x36a8], 4
je 0x401da1
mov cx, word [0x4063f4]
cmp cx, word [eax + 0x3448]
je 0x401da1
add eax, 0x13b34
push eax
push str.Tampered_DATA
call fcn.00402380
mov eax, dword [0x4063e4]
mov dword [eax + 0x18], esi
mov eax, dword [0x4063e4]
cmp dword [esp + 0x34], ebp
jne 0x401e02
push dword [eax + 0x30]
call fcn.00403710
mov eax, dword [0x4063e4]
cmp byte [eax + 0x35a5], 0
lea ecx, [eax + 0x35a5]
je 0x401e02
cmp dword [eax + 0x18], ebp
jne 0x401e02
add eax, 0x17e38
push ecx
push eax
call fcn.004034bb
mov ecx, dword [0x4063e4]
push 5
lea edx, [ecx + 0x13d38]
push edx
mov dl, byte [eax]
neg dl
sbb edx, edx
and edx, eax
lea eax, [ecx + 0x17e38]
push edx
push eax
push ebp
push dword [ecx + 0x30]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x4063e4]
mov ecx, dword [eax + 0x36aa]
cmp ecx, ebp
je 0x401e18
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4063e4]
xor ecx, ecx
cmp dword [eax + 0x18], ebp
sete cl
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8