Function at 0x4131f4
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov eax, 0x491208
call fcn.004696b8
mov dword [ebp - 0x2c], 1
lea edx, [ebp - 4]
lea eax, [ebp - 4]
call fcn.00474b80
inc dword [ebp - 0x2c]
xor eax, eax
mov word [ebp - 0x38], 8
mov word [ebp - 0x38], 0x14
mov dword [ebp - 8], eax
lea eax, [ebp - 0x148]
inc dword [ebp - 0x2c]
mov esi, 1
mov word [ebp - 0x38], 8
push eax
push 0x100
mov ebx, str.NewFile.exe
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x148]
mov edx, ebx
call fcn.0045fd60
mov word [ebp - 0x38], 0x20
lea edx, [ebp - 0x148]
lea eax, [ebp - 0x10]
call fcn.00474b48
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00474d74
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00474d44
mov word [ebp - 0x38], 0x2c
mov ecx, dword [ebp - 4]
push ecx
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
push edx
inc dword [ebp - 0x2c]
call fcn.0040b3e8
mov word [ebp - 0x38], 8
mov word [ebp - 0x38], 0x38
mov word [ebp - 0x38], 0x44
mov ecx, dword [ebp - 8]
add esp, 8
test ecx, ecx
je 0x4132d4
mov edx, dword [ebp - 8]
jmp 0x4132d9
mov edx, 0x48c9b4
lea eax, [ebp - 0x14]
call fcn.00474b48
inc dword [ebp - 0x2c]
mov eax, dword [eax]
call fcn.0045f8bc
push eax
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00474d44
pop ecx
test cl, cl
je 0x413334
push 0x80
mov eax, dword [ebp - 8]
test eax, eax
je 0x413312
mov edx, dword [ebp - 8]
jmp 0x413317
mov edx, 0x48c9b5
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 8]
test eax, eax
je 0x413329
mov ecx, dword [ebp - 8]
jmp 0x41332e
mov ecx, 0x48c9b6
push ecx
call sub.KERNEL32.DLL_DeleteFileA
push 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x413342
mov edx, dword [ebp - 8]
jmp 0x413347
mov edx, 0x48c9b8
push edx
xor eax, eax
mov word [ebp - 0x38], 0x50
mov dword [ebp - 0x18], eax
mov eax, dword [0x49a444]
inc dword [ebp - 0x2c]
lea edx, [ebp - 0x18]
mov eax, dword [eax]
call fcn.004417d0
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x413371
mov ecx, dword [ebp - 0x18]
jmp 0x413376
mov ecx, 0x48c9b7
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 0x18]
dec dword [ebp - 0x2c]
call fcn.00474d44
pop ecx
test cl, cl
je 0x4133dc
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x2c]
call fcn.00474d44
dec dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x48]
mov dword fs:[0], edx
jmp 0x41359f
push 0x80
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4133ed
mov eax, dword [ebp - 8]
jmp 0x4133f2
mov eax, 0x48c9b9
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.0045f784
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41340e
xor esi, esi
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.0045f840
lea eax, [ebp - 0xc]
call fcn.00474e58
mov ecx, eax
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x413432
mov edx, dword [ebp - 0xc]
jmp 0x413437
mov edx, 0x48c9ba
mov eax, ebx
call fcn.0045f814
inc eax
jne 0x413443
xor esi, esi
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.0045f840
mov word [ebp - 0x38], 0x5c
lea eax, [ebp - 0xc]
call fcn.00474e58
xor edx, edx
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x1c]
inc dword [ebp - 0x2c]
call fcn.0045f6c4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41347b
mov edx, dword [ebp - 0x1c]
jmp 0x413480
mov edx, 0x48c9bb
mov ecx, 4
mov eax, ebx
call fcn.0045f814
inc eax
mov edx, 2
sete al
and eax, 1
push eax
lea eax, [ebp - 0x1c]
dec dword [ebp - 0x2c]
call fcn.00474d44
pop ecx
test cl, cl
je 0x4134ab
xor esi, esi
mov eax, ebx
call fcn.0045f84c
mov edx, str.NotePad.exe__1
lea eax, [ebp - 0x24]
call fcn.00474b48
inc dword [ebp - 0x2c]
mov edx, dword [eax]
lea eax, [ebp - 0x20]
push edx
mov edx, str.TxtFile
mov word [ebp - 0x38], 0x68
call fcn.00474b48
inc dword [ebp - 0x2c]
mov edx, dword [eax]
mov eax, edi
pop ecx
call fcn.004102c8
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00474d44
mov eax, dword [edi + 0x2c4]
call fcn.00424e80
push 1
push 0
push 0
mov edx, dword [ebp - 8]
test edx, edx
je 0x413522
mov ecx, dword [ebp - 8]
jmp 0x413527
mov ecx, 0x48c9d8
mov eax, dword [0x49a444]
push ecx
push 0x48c9d3
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
push eax
call sub.SHELL32.DLL_ShellExecuteA
mov edx, dword [ebp - 8]
push edx
call fcn.0040a730
pop ecx
mov word [ebp - 0x38], 8
jmp 0x41355c
test esi, esi
mov edx, 2
setne al
and eax, 1
push eax
lea eax, [ebp - 0xc]
dec dword [ebp - 0x2c]
call fcn.00474d44
dec dword [ebp - 0x2c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
dec dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x48]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret