Function at 0x411050
Capabilities:
Allocate or change rwx memory
Copy file
Create directory
Delete file
Get common file path
Hide graphical window
Inspect load icon resource
Move file
Read file on windows
Write file on windows

Disassembly:
push ebp
cld
mov ebp, esp
push edi
xor eax, eax
push esi
lea edi, [ebp - 0x5c]
push ebx
mov ecx, 0xc
sub esp, 0x3d4
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3d4], 0
lea edi, [ebp - 0x3ac]
mov cl, 0x1e
rep stosb byte es:[edi], al
push 0x412cc4
mov ecx, dword [ebp + 8]
or ebx, 0xffffffff
mov dword [ebp - 0x5c], 0x30
lea esi, [ebp - 0x16c]
mov dword [ebp - 0x54], 0x4014fe
push ecx
mov dword [ebp - 0x48], ecx
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x34], 0x412cbc
call sub.USER32.dll_RegisterClassExA
cld
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [0x41352d], eax
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
push 0x412ccb
not ecx
dec ecx
mov word [0x413531], cx
call sub.KERNEL32.dll_LoadLibraryA
push 0x412cd4
mov edi, 0x41410c
call sub.KERNEL32.dll_LoadLibraryA
push 0x412cdd
call sub.KERNEL32.dll_LoadLibraryA
lea eax, [ebp - 0x3c0]
push eax
push 5
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x41410c
push dword [ebp - 0x3c0]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push 0x412ce5
push 0x41410c
call sub.msvcrt.dll_strcat
cld
xor eax, eax
mov dword [0x41353e], 0x41410c
mov ecx, ebx
repne scasb al, byte es:[edi]
push 0x41421c
not ecx
dec ecx
push 0x104
mov edi, 0x41421c
mov word [0x413542], cx
call sub.KERNEL32.dll_GetTempPathA
cld
xor eax, eax
mov dword [0x41354f], 0x41421c
mov ecx, ebx
lea ebx, [ebp - 0x3c4]
repne scasb al, byte es:[edi]
push 0x104
not ecx
dec ecx
push esi
push 0
mov word [0x413553], cx
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
push 0
push 0
push 0x118
push eax
mov dword [ebp - 0x3d0], eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x3c8]
push ebx
push 4
push eax
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_ReadFile
pop edi
mov edx, dword [ebp - 0x3c8]
pop eax
cmp edx, 1
sbb eax, eax
and eax, 2
sub edx, 0x20
push eax
push 0
push edx
push dword [ebp - 0x3d0]
mov dword [ebp - 0x3c4], eax
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebx
push 0x20
mov dword [ebp - 0x3c8], eax
lea eax, [ebp - 0x38c]
push eax
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 0x370]
test eax, eax
je 0x41121e
cmp eax, dword [ebp - 0x3c8]
jl 0x411328
push dword [ebp - 0x3d0]
mov edi, esi
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x3cc]
push eax
push 0x41432c
push 0x104
push esi
call sub.KERNEL32.dll_GetFullPathNameA
mov eax, dword [ebp - 0x3cc]
mov dword [eax], 0x5c62696c
mov word [eax + 4], 0x24
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_strcpy
cmp byte [ebp - 0x16c], 0x22
pop ecx
pop ebx
jne 0x411283
lea eax, [ebp - 0x16b]
push eax
push esi
call sub.msvcrt.dll_strcpy
push 0x22
push esi
call sub.msvcrt.dll_strrchr
mov byte [eax], 0
add esp, 0x10
push 0x2e
push edi
call sub.msvcrt.dll_strrchr
pop ebx
mov ebx, eax
pop edx
push 0x5c
push edi
call sub.msvcrt.dll_strrchr
pop edx
cmp ebx, eax
pop ecx
ja 0x4112aa
push 0x412ce7
push edi
call sub.msvcrt.dll_strcat
pop edi
pop eax
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push esi
call sub.KERNEL32.dll_CreateFileA
push 2
push 0
push 0
push eax
mov dword [ebp - 0x3d0], eax
call sub.KERNEL32.dll_SetFilePointer
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x370], eax
add eax, 0x11b00
cmp eax, 0x211700
mov dword [ebp - 0x384], 0x80000000
mov dword [ebp - 0x380], 0x80000000
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x378], 0
jge 0x411316
mov eax, 0x211700
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x388], 0
jmp 0x41136f
push 0x41432c
push 0
push 0x412cec
push 0x41421c
call sub.KERNEL32.dll_GetTempFileNameA
push 0x41432c
call sub.KERNEL32.dll_DeleteFileA
push 0
push 0x41432c
call sub.KERNEL32.dll_CreateDirectoryA
push 0x412cf0
push 0x41432c
call sub.msvcrt.dll_strcat
pop ecx
mov dword [ebp - 0x3d4], 1
pop ebx
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x3a4], 0x41432c
mov word [ebp - 0x39c], 0x214
jmp 0x4113a2
mov eax, dword [0x413658]
mov edx, 2
mov ecx, edx
cdq
idiv ecx
mov dword [0x413658], eax
mov eax, dword [0x413658]
cmp eax, dword [ebp - 0x38c]
jle 0x4113de
push 0x40
push 0x2000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x41138e
push 0x40
push 0x1000
push dword [ebp - 0x38c]
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov dword [0x4140b8], eax
test eax, eax
jne 0x4113fb
push 0x30
push 0x412cb4
push 0x412cf4
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 1
jmp 0x411949
mov dword [eax + 0x11700], 0xffff00
mov ebx, eax
lea ecx, [eax + 0x11700]
add ebx, dword [ebp - 0x38c]
mov dword [0x4140b4], ecx
mov eax, 3
cmp dword [ebp - 0x3d0], 0xffffffff
mov dword [0x4140b0], ebx
je 0x411949
mov edx, dword [ebp - 0x370]
lea eax, [ecx + edx]
cmp eax, ebx
jae 0x4117a1
lea eax, [ebp - 0x3cc]
mov esi, dword [ebp - 0x3c8]
mov edi, 0x41443c
push eax
lea eax, [ebp - 0x16c]
sub esi, edx
push 0x41443c
push 0x104
push eax
sub esi, dword [ebp - 0x388]
call sub.KERNEL32.dll_GetFullPathNameA
push dword [ebp - 0x3cc]
lea eax, [ebp - 0x36c]
push eax
call sub.msvcrt.dll_strcpy
cld
mov eax, dword [ebp - 0x3cc]
or edx, 0xffffffff
mov ecx, edx
mov byte [eax], 0
xor eax, eax
mov dword [0x4134ed], 0x41443c
repne scasb al, byte es:[edi]
mov dword [0x4134fe], 0x41432c
not ecx
mov edi, 0x41432c
dec ecx
mov word [0x4134f1], cx
mov ecx, edx
repne scasb al, byte es:[edi]
pop eax
not ecx
sub ecx, 2
mov word [0x413502], cx
pop edx
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x370]
cmp esi, eax
jge 0x411755
push 0
lea ebx, [ebp - 0x16c]
push 0
push esi
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x3c4]
push eax
push 0x104
push ebx
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_ReadFile
movsx ecx, byte [ebp - 0x16c]
lea edx, [ebp - 0x167]
mov eax, dword [ebp - 0x16b]
cld
mov edi, edx
mov dword [ebp - 0x3dc], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x3d8], eax
xor eax, eax
repne scasb al, byte es:[edi]
test byte [ebp - 0x3dc], 2
not ecx
lea esi, [esi + ecx + 5]
je 0x411569
movzx eax, word [0x413502]
push ecx
push edx
lea eax, [ebx + eax]
push eax
call sub.msvcrt.dll_memmove
movzx eax, word [0x413502]
push eax
push 0x41432c
jmp 0x411588
movzx eax, word [0x4134f1]
push ecx
push edx
lea eax, [ebx + eax]
push eax
call sub.msvcrt.dll_memmove
movzx eax, word [0x4134f1]
push eax
push 0x41443c
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0x16c]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
mov edi, eax
je 0x411663
push 0
push 0
push esi
push dword [ebp - 0x3d0]
mov dword [ebp - 0x3e0], 0
call sub.KERNEL32.dll_SetFilePointer
jmp 0x411622
push dword [ebp - 0x3dc]
lea ecx, [ebp - 0x3c4]
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x38c]
push ecx
cmp eax, edx
jle 0x4115f8
mov eax, edx
push eax
push dword [0x4140b8]
push dword [ebp - 0x3d0]
call fcn.004119ac
push dword [ebp - 0x3c4]
push dword [0x4140b8]
push edi
call fcn.00411960
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jne 0x41164d
push 1
mov eax, dword [ebp - 0x3d8]
push 0
push 0
lea ebx, [esi + eax]
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_SetFilePointer
mov edx, ebx
sub edx, eax
test edx, edx
jg 0x4115d3
push edi
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x3e0], 0
jne 0x411663
inc edi
jne 0x41174a
push 0
lea ebx, [ebp - 0x16c]
push 0
push 2
push 0
push 0
push 0x40000000
push 0x41432c
call sub.KERNEL32.dll_CreateFileA
push eax
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 0x3a8], 1
lea eax, [ebp - 0x3ac]
push eax
mov dword [ebp - 0x3a0], ebx
call sub.SHELL32.DLL_SHFileOperationA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
mov edi, eax
je 0x41190d
push 0
push 0
push esi
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x411722
push dword [ebp - 0x3dc]
lea ebx, [ebp - 0x3c4]
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x38c]
push ebx
cmp eax, edx
jle 0x4116fb
mov eax, edx
push eax
push dword [0x4140b8]
push dword [ebp - 0x3d0]
call fcn.004119ac
push 0
push ebx
push dword [ebp - 0x3c4]
push dword [0x4140b8]
push edi
call sub.KERNEL32.dll_WriteFile
push 1
mov ecx, dword [ebp - 0x3d8]
push 0
push 0
lea ebx, [esi + ecx]
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_SetFilePointer
mov edx, ebx
sub edx, eax
test edx, edx
jg 0x4116d6
push edi
call sub.KERNEL32.dll_CloseHandle
add esi, dword [ebp - 0x3d8]
jmp 0x4114cc
push 0
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x370]
push 0
push eax
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_SetFilePointer
push dword [ebp - 0x378]
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x3c4], eax
lea eax, [ebp - 0x3c4]
push eax
push dword [ebp - 0x370]
push dword [0x4140b4]
push dword [ebp - 0x3d0]
call fcn.004119ac
push dword [ebp - 0x3d0]
call sub.KERNEL32.dll_CloseHandle
test byte [ebp - 0x378], 8
je 0x411818
push 0
mov eax, dword [ebp - 0x384]
push 0x2cf0000
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x3b0], eax
lea eax, [ebp - 0x3bc]
push eax
call sub.USER32.dll_AdjustWindowRect
mov eax, dword [ebp - 0x3b4]
sub eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x3b0]
sub eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x380], eax
push 0
lea eax, [ebp - 0x36c]
push dword [ebp + 8]
movzx esi, word [0x413502]
push 0
push 0
push dword [ebp - 0x380]
push dword [ebp - 0x384]
push 0x80000000
push 0x80000000
push 0x2cf0000
push eax
push 0x412cbc
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x4133a8], eax
mov edx, dword [ebp - 0x37c]
cmp edx, 1
je 0x411869
push edx
jmp 0x41186c
push dword [ebp + 0x14]
push eax
call sub.USER32.dll_ShowWindow
push dword [0x4133a8]
call sub.USER32.dll_UpdateWindow
cmp dword [0x4133a8], 0
je 0x4118d5
jmp 0x4118c2
mov eax, dword [0x413426]
test eax, eax
je 0x41189c
push ebx
push eax
call sub.USER32.dll_TranslateMDISysAccel
test eax, eax
jne 0x4118c2
mov eax, dword [0x413418]
test eax, eax
je 0x4118b6
push ebx
push eax
push dword [0x413443]
call sub.USER32.dll_TranslateAcceleratorA
test eax, eax
jne 0x4118c2
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
push 0
lea ebx, [ebp - 0x2c]
push 0
push 0
push ebx
call sub.USER32.dll_GetMessageA
test eax, eax
jne 0x411888
cmp dword [ebp - 0x3d4], 0
je 0x4118fd
mov word [esi + 0x41432b], 0
lea eax, [ebp - 0x3ac]
push eax
mov dword [ebp - 0x3a8], 3
call sub.SHELL32.DLL_SHFileOperationA
cmp dword [0x4133a8], 0
mov eax, 4
je 0x411949
jmp 0x411946
push 0x14
push 0x412d08
push dword [0x4140b8]
call sub.msvcrt.dll_memcpy
push ebx
push dword [0x4140b8]
call sub.msvcrt.dll_strcat
push 0x30
push 0x412cb4
push dword [0x4140b8]
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 2
jmp 0x411949
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10