Function at 0x439982
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
push ebx
push esi
push edi
lea eax, [ebp - 0x670]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
lea edi, [ebp - 0x670]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x670]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
dec eax
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
movsx eax, byte [ebp + eax - 0x670]
cmp eax, 0x5c
jne 0x439a33
mov edx, 0x47b57c
lea edi, [ebp - 0x670]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov al, byte [edx + 0xc]
mov byte [edi + 0xc], al
jmp 0x439a60
mov edx, str.CPT_X64A.EXE
lea edi, [ebp - 0x670]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
mov ax, word [edx + 0xc]
mov word [edi + 0xc], ax
mov edi, 0x9a3940
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x888], eax
dec dword [ebp - 0x888]
mov eax, 0x47b59c
mov ecx, 0x47b5a0
mov edx, dword [ebp - 0x888]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sCPT_X64A.NEW
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x439ba4
mov eax, 0x47b5b8
mov ecx, 0x47b5bc
mov edx, dword [ebp - 0x888]
movsx edx, byte [edx + 0x9a3940]
xor ebx, ebx
cmp edx, 0x5c
setne bl
dec ebx
sub ecx, eax
and ebx, ecx
add ebx, eax
push ebx
push 0x9a3940
push str._s_sCPT_X64A.EXE
lea eax, [ebp - 0xa88]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xa88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x888], eax
cmp dword [0x45e03c], 0
je 0x439b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x888]
push eax
lea eax, [ebp - 0xa88]
push eax
push str._n_r_DELETE__s__d__d_
call fcn.00452380
add esp, 0x10
push 3
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x884]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [ebp - 0x888], eax
cmp dword [0x45e03c], 0
je 0x439ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x888]
push eax
lea eax, [ebp - 0x884]
push eax
push str._n_r_MOVE__s__d__d_
call fcn.00452380
add esp, 0x10
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x439be0
cmp dword [0x45e03c], 0
je 0x439bdb
lea eax, [ebp - 0x670]
push eax
push str._n_rFAIL_x64_P_D__nDOES_NOT_EXIST__n____s__n
call fcn.00452380
add esp, 8
jmp 0x439cbf
lea edi, [ebp - 0x46c]
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x684]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [ebp - 0x43c], 0
lea eax, [ebp - 0x670]
push eax
push str._S__fm
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x439c56
lea eax, [ebp - 0x428]
push eax
push str._n_rCP_819ab1___S_
call fcn.00452380
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x46c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x674], eax
cmp dword [0x45e03c], 0
je 0x439cbf
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x674]
push eax
push str._n__d_gle.__d_:__S_
call fcn.00452380
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret