Function at 0x402f0d
Capabilities:
Copy file
Get disk information
Set file attributes

Disassembly:
mov eax, 0x418143
call fcn.0040cfd0
mov eax, 0x30e8
call fcn.0040dc40
push ebx
push esi
push edi
call fcn.00401c95
test eax, eax
je 0x4034c8
mov eax, dword [0x427ff4]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [0x427ff4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov ebx, 0x104
mov esi, 0x425bc0
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x425dc8
push 1
push edi
push esi
call fcn.00401058
add esp, 0xc
test eax, eax
je 0x4034c8
push ebx
push 0x4259b8
push 0x425ee4
call fcn.00401293
add esp, 0xc
test eax, eax
je 0x4034c8
push esi
push 0x4259b8
call fcn.0040dcc1
pop ecx
test eax, eax
pop ecx
je 0x4032d3
mov eax, 0x222c
call fcn.0040dc40
mov esi, edi
mov ecx, 0x88b
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00401d3b
add esp, 0x222c
test eax, eax
jne 0x40301a
xor edx, edx
cmp dword [0x425dce], edx
je 0x4034bd
and byte [ebp - 0x15c], dl
push 0x40
pop ecx
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
push edx
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
push 0x425bc0
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x427ff4]
lea edx, [ebp - 0x15c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
jmp 0x4034bd
push 0x4259b8
call fcn.004014c0
test al, al
pop ecx
je 0x40317f
xor esi, esi
mov ecx, 0x88a
xor eax, eax
lea edi, [ebp - 0x30f2]
mov word [ebp - 0x30f4], si
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x30f4]
push eax
push 0x4259b8
call fcn.00401058
add esp, 0xc
test eax, eax
je 0x403181
mov ax, word [0x425dc8]
cmp ax, word [ebp - 0x30f4]
jbe 0x4034bd
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0xbfc]
mov dword [ebp - 0xc00], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc00]
push eax
push 0x4000010
push 0x4259b8
call fcn.00401173
add esp, 0xc
test eax, eax
je 0x403181
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x62a]
mov word [ebp - 0x62c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x62c]
push ebx
push eax
lea eax, [ebp - 0xb6c]
push eax
call fcn.00401293
add esp, 0xc
test eax, eax
je 0x403181
and byte [ebp - 0x38], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x37]
and byte [ebp - 0x15c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x15b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
lea eax, [ebp - 0x62c]
push ebx
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x38]
push str._u__d
push eax
call fcn.0040dc6f
mov eax, dword [0x427ff4]
add esp, 0xc
lea edx, [ebp - 0x38]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x15c]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x403181
xor edi, edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x62c]
push eax
call fcn.004014c0
test al, al
pop ecx
je 0x403181
inc edi
cmp edi, 0x78
jl 0x40315b
jmp 0x403181
xor esi, esi
mov edi, 0x4259b8
push 1
push edi
call fcn.004013c4
pop ecx
test eax, eax
pop ecx
je 0x4034bd
push esi
push edi
push 0x425bc0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x4034bd
and byte [ebp - 0x15c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x15b]
push 0x80
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x4259b8
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call fcn.00402a05
cmp dword [0x425dd2], esi
pop ecx
je 0x403213
mov eax, 0x222c
call fcn.0040dc40
mov ecx, 0x88b
mov esi, 0x425dc8
mov edi, esp
push 0x4259b8
rep movsd dword es:[edi], dword [esi]
call fcn.004020e7
add esp, 0x2230
xor esi, esi
mov edi, 0x4259b8
push esi
push esi
lea eax, [ebp - 0x15c]
push ebx
push eax
push ebx
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x427ff4]
lea edx, [ebp - 0x15c]
push esi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x4034bd
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xb3e]
mov word [ebp - 0xb40], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 3
lea eax, [ebp - 0xb40]
push 0x425bc0
push eax
call fcn.0040cb55
add esp, 0xc
lea eax, [ebp - 0xb40]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x4032c3
and byte [ebp - 0x528], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x527]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x528]
push ebx
push eax
push ebx
push 0x425bc0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x427ff4]
lea edx, [ebp - 0x528]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [0x427ff4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
jmp 0x4034e2
push 3
call fcn.00401f71
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [esp], 0x208
lea eax, [ebp - 0x938]
push edi
push eax
call fcn.0040cba0
push ebx
lea eax, [ebp - 0x938]
push esi
push eax
call fcn.0040cb55
lea eax, [ebp - 0x938]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00405771
add esp, 0x20
cmp eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
jle 0x4033dd
and dword [ebp - 0x424], 0
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0x420]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x938]
push dword [ebp - 0x10]
push eax
call fcn.00405bb9
add esp, 0xc
test al, al
je 0x4033ce
xor edi, edi
cmp word [0x427fee], di
ja 0x40336b
test word [ebp - 0x41e], 0x401
je 0x4033ce
test word [ebp - 0x420], 0x1040
je 0x403383
push 0x425dc8
push esi
call fcn.00402be3
pop ecx
pop ecx
test byte [ebp - 0x420], 0x30
je 0x4033a9
cmp dword [ebp - 0x14], 1
jne 0x40339b
test byte [ebp - 0x41c], 2
je 0x4033ce
cmp dword [ebp - 0x14], edi
jne 0x4033bb
test byte [ebp - 0x41c], 4
jmp 0x4033b9
test byte [ebp - 0x41c], 0x18
jne 0x4033ce
test byte [ebp - 0x41e], 1
je 0x4033ce
push edi
lea eax, [ebp - 0x938]
push dword [ebp - 0x10]
push eax
call fcn.0040545b
add esp, 0xc
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jl 0x403322
and dword [ebp - 0xec8], 0
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0xec4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xec8]
push eax
push 0x4000010
push esi
call fcn.00401173
add esp, 0xc
test eax, eax
je 0x4034b9
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x362]
mov word [ebp - 0x364], si
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0xe34]
push eax
call fcn.00401293
add esp, 0xc
test eax, eax
je 0x4034b9
and byte [ebp - 0x58], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x57]
and byte [ebp - 0x730], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x72f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
push esi
lea eax, [ebp - 0x730]
push ebx
push eax
lea eax, [ebp - 0x364]
push ebx
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x58]
push str._i__d
push eax
call fcn.0040dc6f
mov eax, dword [0x427ff4]
add esp, 0xc
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x730]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jne 0x4034cc
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x427ff4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
jmp 0x4034e5
mov eax, dword [0x427ff4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret