Function at 0x41a3a0
Capabilities:
Copy file
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb0
push ebx
mov dword [ebp - 0x350], 0
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x41a3da
mov eax, 0xfffffff8
pop ebx
leave
ret 0xc
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x20c]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x41a41f
cmp dword [ebp - 0x228], 0
jne 0x41a41f
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff5
pop ebx
leave
ret 0xc
cmp dword [ebp - 0x224], 0x20000000
ja 0x41a434
cmp dword [ebp - 0x228], 0
jbe 0x41a43e
mov eax, 0xfffffffc
pop ebx
leave
ret 0xc
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x234], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x20c]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x41a478
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff7
pop ebx
leave
ret 0xc
mov dword [ebp - 0x214], eax
push 0
push 0
push 0
push 0
push 4
push dword [ebp - 0x214]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x41a4b7
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff6
pop ebx
leave
ret 0xc
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x21c]
call fcn.0041ab50
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 1
jne 0x41a565
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x230], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x21c]
call fcn.0041a926
or eax, eax
jne 0x41a52d
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff4
pop ebx
leave
ret 0xc
cmp eax, 0xffffffff
jne 0x41a55d
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff3
pop ebx
leave
ret 0xc
mov dword [ebp - 0x238], eax
jmp 0x41a5d0
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x240], 0
jne 0x41a596
mov eax, 0xffffffff
jmp 0x41a5cb
cmp dword [ebp - 0x240], 2
jne 0x41a5a6
mov eax, 0xfffffffe
jmp 0x41a5cb
cmp dword [ebp - 0x240], 3
jne 0x41a5b6
mov eax, 0xfffffffe
jmp 0x41a5cb
cmp dword [ebp - 0x240], 4
jne 0x41a5c6
mov eax, 0xfffffffd
jmp 0x41a5cb
mov eax, 0xfffffffd
pop ebx
leave
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x41a62b
lea eax, [ebp - 0x34c]
push eax
push dword [ebp + 8]
call fcn.0041abf0
push str..bif
lea eax, [ebp - 0x34c]
push eax
call fcn.00411ac0
lea eax, [ebp - 0x34c]
push eax
call fcn.00411c00
mov dword [ebp - 0x248], eax
inc dword [ebp - 0x248]
mov eax, dword [ebp - 0x230]
add eax, 0x10
sub eax, 4
add eax, dword [ebp - 0x248]
add eax, 0xc
mov dword [ebp - 0x22c], eax
jmp 0x41a63a
mov eax, dword [ebp - 0x230]
add eax, 0xc
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0xc]
or eax, eax
jne 0x41a66d
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00411bd0
push str..tmp
lea eax, [ebp - 0x104]
push eax
call fcn.00411ac0
mov dword [ebp - 0x350], 1
jmp 0x41a6c1
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00411b90
or eax, eax
jne 0x41a6a8
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00411bd0
push str..tmp
lea eax, [ebp - 0x104]
push eax
call fcn.00411ac0
mov dword [ebp - 0x350], 1
jmp 0x41a6c1
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.00411bd0
mov dword [ebp - 0x350], 0
push 0
push 0x100
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x41a71a
push dword [ebp - 0x238]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffb
pop ebx
leave
ret 0xc
mov dword [ebp - 0x210], eax
push 0
push dword [ebp - 0x22c]
push 0
push 4
push 0
push dword [ebp - 0x210]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x41a77e
push dword [ebp - 0x238]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x210]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffffa
pop ebx
leave
ret 0xc
mov dword [ebp - 0x218], eax
push 0
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x218]
call sub.kernel32.dll_MapViewOfFileEx
or eax, eax
jne 0x41a7ec
push dword [ebp - 0x238]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x218]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x210]
call sub.kernel32.dll_CloseHandle
mov eax, 0xfffffff9
pop ebx
leave
ret 0xc
mov dword [ebp - 0x220], eax
cmp dword [ebp + 0x10], 0
jne 0x41a865
mov ebx, dword [ebp - 0x220]
mov eax, 0x20464942
mov dword [ebx], eax
mov eax, 0x302e3156
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x244], eax
push dword [ebp - 0x248]
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x244]
call sub.kernel32.dll_lstrcpynA
mov ebx, dword [ebp - 0x220]
add ebx, 0x10
sub ebx, 4
add ebx, dword [ebp - 0x248]
mov eax, dword [ebp - 0x234]
mov dword [ebx], eax
mov eax, dword [ebp - 0x230]
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
mov dword [ebp - 0x23c], eax
jmp 0x41a892
mov ebx, dword [ebp - 0x220]
mov eax, 0x43464942
mov dword [ebx], eax
mov eax, 0x302e3156
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x234]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x220]
add eax, 0xc
mov dword [ebp - 0x23c], eax
push dword [ebp - 0x230]
push dword [ebp - 0x238]
push dword [ebp - 0x23c]
call sub.kernel32.dll_RtlMoveMemory
push dword [ebp - 0x238]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x21c]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x214]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20c]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x220]
call sub.kernel32.dll_UnmapViewOfFile
push dword [ebp - 0x218]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x210]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x350], 1
jne 0x41a91c
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, 0
pop ebx
leave
ret 0xc