Function at 0x401a35
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
mov eax, 0x402e7c
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x948
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x253]
mov byte [ebp - 0x254], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x153]
mov byte [ebp - 0x154], bl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x553]
mov byte [ebp - 0x554], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x254]
mov esi, 0xfa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x154]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x154]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
je 0x401c89
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x554]
push str._s_abs.exe
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x554]
push ebx
push eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x353]
mov byte [ebp - 0x354], bl
push 0x3f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x453]
mov byte [ebp - 0x454], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x2e
push dword [ebp - 0x18]
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x401b3f
mov byte [eax], bl
mov edi, dword [ebp + 8]
lea eax, [edi + 0x100]
push eax
mov eax, dword [ebp - 0x18]
inc eax
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x354]
push str._s_s._s
push eax
call esi
lea eax, [ebp - 0x254]
push edi
push eax
lea eax, [ebp - 0x454]
push str._s_s
push eax
call esi
mov ecx, dword [ebp - 0x10]
add esp, 0x24
lea eax, [ebp - 0x14]
mov edi, 0x4050a4
push eax
push edi
push 0x4050dc
mov dword [ebp - 0x14], ebx
call fcn.004017b3
cmp eax, ebx
je 0x401c89
mov byte [ebp - 0x46], 8
mov byte [ebp - 0x47], 8
mov byte [ebp - 0x45], 4
mov byte [ebp - 0x44], 2
lea ecx, [ebp - 0x354]
mov dword [ebp - 4], ebx
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.004015c2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push edi
push 0x4050d4
mov dword [ebp - 0x14], ebx
call fcn.004017b3
cmp eax, ebx
je 0x401c89
lea ecx, [ebp - 0x454]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.004015c2
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push ebx
lea eax, [ebp - 0x454]
push ebx
push eax
push ebx
push ebx
call edi
push 5
push ebx
lea eax, [ebp - 0x354]
push ebx
push eax
push ebx
push ebx
call edi
mov eax, dword [ebp - 0x10]
push 0x4050c0
add eax, 0xc4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x953]
mov byte [ebp - 0x954], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x154]
push 0xfa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x954]
push str._s__s
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x954]
push 5
push ebx
push eax
lea eax, [ebp - 0x554]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4