Function at 0x404cc4
Capabilities:
Copy file
Move file
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, 0x4104d0
xor edx, edx
push ebp
push 0x405004
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x404d04
mov esi, 0x101
mov ebx, 0x410363
mov eax, pe_nt_image_headers32
call fcn.004028d8
mov byte [ebx], al
inc ebx
dec esi
jne 0x404cf4
cmp byte [0x4104c6], 0
je 0x404d59
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x4104b4]
mov edx, dword [0x41048c]
call fcn.00403514
mov eax, dword [ebp - 4]
call fcn.004036c8
push eax
push dword [0x410480]
push dword [0x4104b0]
push dword [0x4104b4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403588
mov eax, dword [ebp - 8]
call fcn.004036c8
push eax
call sub.kernel32.dll_CopyFileA
cmp byte [0x4104c6], 0
je 0x404d84
push dword [0x41048c]
push 0x40501c
push dword [0x41047c]
mov eax, 0x4104a0
mov edx, 3
call fcn.00403588
jmp 0x404daf
push dword [0x41048c]
lea edx, [ebp - 0xc]
mov eax, 0x405028
call fcn.00403fdc
push dword [ebp - 0xc]
push dword [0x41047c]
mov eax, 0x4104a0
mov edx, 3
call fcn.00403588
push 0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 1
push 0x4104d8
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [edi], eax
push 0
push 0x41056c
push 0x7c00
push 0x408864
mov eax, dword [edi]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 3
push 0
push 0
push 0x40000000
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
push 0x41057c
push 0x41057c
push 0x41057c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x4104c6], 0
je 0x404e7b
push dword [0x410480]
push dword [0x4104b0]
push dword [0x4104b4]
mov eax, 0x4104a4
mov edx, 3
call fcn.00403588
jmp 0x404e9b
push dword [0x410484]
push 0x40501c
push dword [0x410478]
mov eax, 0x4104a4
mov edx, 3
call fcn.00403588
cmp byte [0x4104c6], 0
je 0x404f13
lea edx, [ebp - 0x10]
mov eax, 0x405038
call fcn.00403fdc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, 0x408764
mov ecx, pe_nt_image_headers32
call fcn.004034b0
mov edx, dword [ebp - 0x14]
mov eax, 0x41049c
pop ecx
call fcn.00403514
mov eax, dword [0x41049c]
call fcn.004036c8
push eax
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
mov eax, dword [0x4104a4]
call fcn.004036c8
push eax
lea edx, [ebp - 0x18]
mov eax, 0x405050
call fcn.00403fdc
mov eax, dword [ebp - 0x18]
call fcn.004036c8
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x404f30
push 5
mov eax, dword [0x4104a4]
call fcn.004036c8
push eax
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_MoveFileExA
push dword [0x410494]
push 0x40501c
lea edx, [ebp - 0x1c]
mov eax, 0x405060
call fcn.00403fdc
push dword [ebp - 0x1c]
mov eax, 0x4104a0
mov edx, 3
call fcn.00403588
xor eax, eax
push ebp
push 0x404fdf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
push 0
push 0
push 0
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [edi], eax
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
push 2
push 0x4104d8
mov eax, dword [0x4104a0]
call fcn.004036c8
push eax
call sub.kernel32.dll_OpenFile
mov dword [edi], eax
push 0x410574
push 0x410594
call sub.kernel32.dll_SystemTimeToFileTime
push 0x410574
push 0x410574
push 0x410574
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x404fe9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40500b
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403368
ret