Function at 0x402186
Capabilities:
Check if file exists
Create process on windows
Delete file
Get disk information
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402fdc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x4051a0]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x17bbe], ecx
xor ebx, ebx
mov eax, dword [0x4051a0]
mov dword [eax + 0x18226], ebx
push ebx
mov eax, dword [0x4051a0]
add eax, 0x137b2
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ecx, dword [0x4051a0]
mov dword [ecx + 0x1031c], eax
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x1031c]
cmp ecx, 0xffffffff
jne 0x402205
add eax, 0x137b2
push eax
push dword [0x405004]
jmp 0x402229
push ebx
push dword [eax + 0x17bc2]
push ecx
call dword [sym.imp.KERNEL32.dll__llseek]
cmp eax, 0xffffffff
jne 0x402235
mov eax, dword [0x4051a0]
add eax, 0x137b2
push eax
push dword [0x40500c]
call fcn.004011b0
xor eax, eax
jmp 0x402939
push 4
mov eax, dword [0x4051a0]
add eax, 0x13aba
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [ebp - 0x2e], 0x5c
mov dword [ebp - 0x24], ebx
cmp byte [ebp - 0x30], bl
je 0x402263
cmp byte [ebp - 0x2f], 0x3a
jne 0x402263
lea eax, [ebp - 0x30]
jmp 0x402265
xor eax, eax
push ebx
push ebx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0xa001
call fcn.00401247
mov eax, dword [0x4051a0]
mov dword [eax + 0x10304], ebx
push 2
pop edi
push edi
lea eax, [ebp - 0x48]
push eax
mov eax, dword [0x4051a0]
push dword [eax + 0x1031c]
mov esi, dword [sym.imp.KERNEL32.dll__lread]
call esi
cmp eax, edi
jne 0x4028aa
cmp word [ebp - 0x48], bx
je 0x4028aa
movsx eax, word [ebp - 0x48]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x4051a0]
mov dword [ecx + 0x10304], eax
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
cmp ecx, ebx
jne 0x402303
push 0x10
lea ecx, [eax + 0x17bc6]
push ecx
push dword [0x405020]
push dword [eax + 0x17bbe]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40289b
mov ax, word [ebp - 0x48]
mov word [ecx], ax
movsx eax, word [ebp - 0x48]
sub eax, edi
push eax
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
add ecx, edi
push ecx
push dword [eax + 0x1031c]
call esi
movsx ecx, word [ebp - 0x48]
sub ecx, edi
cmp eax, ecx
mov eax, dword [0x4051a0]
jne 0x40288a
mov eax, dword [eax + 0x10304]
cmp byte [eax + 2], 0x2d
jne 0x402885
cmp byte [eax + 3], 0x6c
jne 0x402885
cmp byte [eax + 4], 0x68
jne 0x402885
cmp byte [eax + 6], 0x2d
jne 0x402885
movzx eax, byte [eax + 5]
push eax
push str.04567d
call sub.CRTDLL.dll_strchr
pop ecx
pop ecx
test eax, eax
je 0x402885
mov eax, dword [0x4051a0]
mov esi, dword [eax + 0x10304]
add esi, 0x18
mov dword [eax + 0x1030a], ebx
mov eax, dword [0x4051a0]
mov word [eax + 0x10318], bx
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
movzx cx, byte [ecx + 0x13]
mov word [eax + 0x10316], cx
mov ax, word [esi]
cmp ax, bx
je 0x4023d1
movsx edi, ax
push edi
lea eax, [esi + 2]
push eax
call fcn.0040294a
add esi, edi
jmp 0x4023b8
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x1030a]
cmp ecx, ebx
je 0x40288a
mov word [ecx], bx
mov eax, dword [0x4051a0]
mov word [eax + 0x10324], bx
movsx eax, word [ebp - 0x48]
push eax
mov eax, dword [0x4051a0]
push dword [eax + 0x10304]
call fcn.00401291
mov ecx, dword [0x4051a0]
cmp ax, word [ecx + 0x10308]
je 0x402423
add ecx, 0x137b2
push ecx
jmp 0x402890
mov ax, word [ecx + 0x10318]
cmp ax, bx
je 0x40244d
movzx eax, ax
inc eax
push eax
push dword [ecx + 0x1030e]
add ecx, 0x10200
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [0x4051a0]
movzx eax, word [ecx + 0x1031a]
inc eax
push eax
push dword [ecx + 0x10312]
movzx eax, word [ecx + 0x10318]
lea eax, [eax + ecx + 0x10200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x2f
mov eax, dword [0x4051a0]
add eax, 0x10200
push eax
call fcn.004011f5
push 1
pop edi
cmp dword [ebp + 0xc], edi
push 0x405124
mov eax, dword [0x4051a0]
jne 0x4024ca
add eax, 0x10200
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4028aa
mov eax, dword [0x4051a0]
or dword [eax + 0x10320], 0xffffffff
mov eax, dword [0x4051a0]
mov byte [eax + 0x18225], bl
mov eax, dword [0x4051a0]
jmp 0x4026b9
add eax, 0x10200
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4024ec
call fcn.00402139
test eax, eax
je 0x4028aa
jmp 0x402283
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x10200]
push ecx
lea ecx, [eax + 0x13aba]
push ecx
add eax, 0x138b6
push eax
call fcn.00401091
push 0x2f
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
call fcn.004011f5
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x138b6]
cmp byte [ecx], bl
je 0x40253a
cmp byte [eax + 0x138b7], 0x3a
jne 0x40253a
lea ecx, [eax + 0x138b8]
xor eax, eax
cmp dword [ebp - 0x24], 0xff
sete al
push eax
push ecx
call fcn.0040205c
push 0x20
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x138b6]
push ecx
add eax, 0x17e25
push eax
call fcn.0040112a
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x17e25]
push ecx
push 0x65
push dword [eax + 0x17bbe]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
call esi
push 0x405118
push 0x66
mov eax, dword [0x4051a0]
push dword [eax + 0x17bbe]
call esi
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
call fcn.004010ec
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
cmp byte [ecx + 5], 0x64
je 0x402674
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x34], eax
cmp eax, 0xffffffff
je 0x40266f
push dword [0x405014]
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x138b6]
push ecx
push str.__s___s
add eax, 0x17e25
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x23
mov eax, dword [0x4051a0]
lea ecx, [eax + 0x17bc6]
push ecx
lea ecx, [eax + 0x17e25]
push ecx
push dword [eax + 0x17bbe]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x402846
cmp eax, 7
jne 0x40264b
call fcn.00402139
test eax, eax
jne 0x402283
mov eax, dword [0x4051a0]
add eax, 0x137b2
push eax
push dword [0x40500c]
jmp 0x402896
mov eax, dword [0x4051a0]
cmp byte [eax + 0x17e1c], bl
je 0x402674
test byte [ebp - 0x34], 0x10
jne 0x402674
push 0x80
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
cmp byte [ecx + 5], 0x64
je 0x4026b9
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x4051a0]
mov dword [ecx + 0x10320], eax
mov eax, dword [0x4051a0]
cmp dword [eax + 0x10320], 0xffffffff
je 0x4027fe
mov word [eax + 0x10324], bx
mov eax, dword [0x4051a0]
or dword [eax + 0x17bba], 0xffffffff
mov dword [ebp - 4], ebx
mov eax, dword [0x4051a0]
mov eax, dword [eax + 0x10304]
mov cl, byte [eax + 5]
cmp cl, 0x30
jne 0x4026ec
push dword [eax + 0xb]
call fcn.00401e6a
jmp 0x4026f6
cmp cl, 0x64
je 0x4026f6
call fcn.00401c0d
or dword [ebp - 4], 0xffffffff
jmp 0x402715
cmp dword [ebp + 0xc], edi
mov eax, dword [0x4051a0]
jne 0x402755
cmp dword [eax + 0x18226], ebx
jne 0x4028aa
push 0x24
lea ecx, [eax + 0x17bc6]
push ecx
lea ecx, [eax + 0x17e25]
push ecx
push dword [eax + 0x17bbe]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x4028aa
jmp 0x402846
cmp dword [eax + 0x18226], ebx
je 0x40278f
mov ecx, dword [eax + 0x10304]
cmp byte [ecx + 5], 0x64
je 0x4028aa
push dword [eax + 0x10320]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4028aa
mov eax, dword [eax + 0x10304]
cmp byte [eax + 5], 0x64
je 0x40280c
lea ecx, [ebp - 0x44]
push ecx
push dword [eax + 0xf]
call fcn.00401f20
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
mov eax, dword [0x4051a0]
push dword [eax + 0x10320]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov eax, dword [0x4051a0]
push dword [eax + 0x10320]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40280c
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
push dword [0x405008]
jmp 0x402841
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
mov dx, word [eax + 0x10324]
cmp dx, word [ecx + 0x15]
je 0x402853
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x4051a0]
add eax, 0x138b6
push eax
push dword [0x405018]
call fcn.004011b0
mov eax, dword [0x4051a0]
mov dword [eax + 0x18226], edi
jmp 0x4028aa
cmp byte [eax + 0x17e1c], bl
je 0x40286f
movzx ecx, word [eax + 0x10316]
push ecx
add eax, 0x138b6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x4051a0]
push dword [eax + 0x10304]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x402283
mov eax, dword [0x4051a0]
add eax, 0x137b2
push eax
push dword [0x405010]
call fcn.004011b0
mov eax, dword [0x4051a0]
mov dword [eax + 0x18226], 1
mov eax, dword [0x4051a0]
push dword [eax + 0x1031c]
call dword [sym.imp.KERNEL32.dll__lclose]
cmp dword [ebp + 0xc], ebx
mov eax, dword [0x4051a0]
jne 0x402916
lea ecx, [eax + 0x17d18]
cmp byte [ecx], bl
je 0x402916
cmp dword [eax + 0x18226], ebx
jne 0x402916
push ecx
add eax, 0x17e25
push eax
call fcn.004020c8
mov esi, eax
push 5
mov ecx, dword [0x4051a0]
lea eax, [ecx + 0x13aba]
push eax
mov al, byte [esi]
neg al
sbb eax, eax
and eax, esi
push eax
lea eax, [ecx + 0x17e25]
push eax
push ebx
push dword [ecx + 0x17bbe]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x4051a0]
mov ecx, dword [eax + 0x10304]
cmp ecx, ebx
je 0x40292c
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4051a0]
xor ecx, ecx
cmp dword [eax + 0x18226], ebx
sete cl
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8