Function at 0x402fc0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x432248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a4
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x28]
call fcn.0042854a
push ecx
mov dword [esp + 0x4bc], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x43f1c8
call fcn.00426b49
lea eax, [esp + 0x14]
push eax
call fcn.004016e0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x4b8], 1
call fcn.0040bbe2
mov ecx, dword [esp + 0x10]
push 0
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x4c0], 2
call fcn.0040bca5
test eax, eax
je 0x4032d4
lea edx, [esp + 0x1ac]
xor edi, edi
push 0x104
push edx
push edi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00402f90
test eax, eax
je 0x403149
lea eax, [esp + 0xa8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xa8]
lea edx, [esp + 0xa8]
push ecx
push edi
push 0x43f1c4
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0xa8]
push edi
lea ecx, [esp + 0x1b0]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push 0x4000000
push 3
push edi
push 1
lea edx, [esp + 0xbc]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x10]
mov edi, eax
mov eax, dword [esi + 0xf4]
lea edx, [esp + 0x1ac]
push eax
push ecx
push edx
lea eax, [esp + 0xb4]
push edi
push eax
lea ecx, [esp + 0x2c4]
push str.__s___d_s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x54]
lea ecx, [esp + 0x64]
push eax
push ecx
push 0
push 0
push 0
push 1
push 0
lea edx, [esp + 0x2cc]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4032ac
lea eax, [esp + 0x1ac]
lea ecx, [esp + 0xc]
push eax
call fcn.00426b49
push 0x2e
lea ecx, [esp + 0x10]
mov byte [esp + 0x4bc], 3
call fcn.004254a1
inc eax
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00425429
push 0x43f1ac
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x4c4], 4
call fcn.00426d70
lea ecx, [esp + 0x24]
mov byte [esp + 0x4b8], 6
call fcn.00426adb
push 0x2e
lea ecx, [esp + 0x10]
call fcn.004254a1
inc eax
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00425429
push 0x43f1c8
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x4c4], 7
call fcn.00426d70
lea ecx, [esp + 0x18]
mov byte [esp + 0x4b8], 9
call fcn.00426adb
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.00413bfe
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.00413bfe
mov ecx, dword [esi + 0xf4]
mov edx, dword [esp + 0x1c]
add esp, 0x10
lea eax, [esp + 0x2b0]
push ecx
push edx
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x5c
call fcn.004254a1
inc eax
lea ecx, [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00425429
mov esi, dword [esi + 0xf4]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push 1
push edx
push esi
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x1c]
call fcn.00426adb
lea ecx, [esp + 0x20]
mov byte [esp + 0x4b8], 6
call fcn.00426adb
lea ecx, [esp + 0x14]
mov byte [esp + 0x4b8], 3
call fcn.00426adb
lea ecx, [esp + 0xc]
mov byte [esp + 0x4b8], 2
call fcn.00426adb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402f90
test eax, eax
je 0x4032cc
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebp
call esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4b8], 1
call fcn.0040bc1f
lea ecx, [esp + 0x10]
mov byte [esp + 0x4b8], 0
call fcn.00426adb
lea ecx, [esp + 0x28]
mov dword [esp + 0x4b8], 0xffffffff
call fcn.0042859f
mov ecx, dword [esp + 0x4b0]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebp
add esp, 0x4b0
ret