Function at 0x41c1f0
Capabilities:
Check if file exists
Copy file
Create process on windows
Get file attributes
Self delete
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4434f8
mov eax, dword fs:[0]
push eax
sub esp, 0x95c
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xff
lea eax, [ebp - 0x4ac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x4ac], 0
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b8], 0xf
mov dword [ebp - 0x6bc], 0
mov byte [ebp - 0x6cc], 0
jne 0x41c26d
xor ecx, ecx
jmp 0x41c27f
lea ecx, [ebp - 0x4ac]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c276
sub ecx, edx
push ecx
lea eax, [ebp - 0x4ac]
push eax
lea ecx, [ebp - 0x6cc]
call fcn.00422680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3ac]
push 0xff
push 0
push eax
call fcn.00429a90
xor eax, eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x6f0], eax
xor edx, edx
mov dword [ebp - 0x6f8], ecx
cmp dword [ebp - 0x6bc], eax
jbe 0x41c410
mov esi, dword [ebp - 0x6b8]
mov edi, dword [ebp - 0x6cc]
nop dword [eax]
test eax, eax
lea eax, [ebp - 0x6cc]
jne 0x41c3ad
cmp esi, 0x10
cmovae eax, edi
cmp byte [eax + edx - 5], 0x55
jne 0x41c395
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
cmp byte [eax + edx - 4], 0x73
jne 0x41c395
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
cmp byte [eax + edx - 3], 0x65
jne 0x41c395
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
cmp byte [eax + edx - 2], 0x72
jne 0x41c395
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
cmp byte [eax + edx - 1], 0x73
jne 0x41c395
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
cmp byte [eax + edx], 0x5c
jne 0x41c395
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x6f0], 1
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41c372
mov eax, dword [0x4502f0]
mov dword [ecx], eax
mov eax, dword [str.ername_]
mov dword [ecx + 4], eax
mov eax, dword [0x4502f8]
mov dword [ecx + 8], eax
jmp 0x41c3f7
cmp esi, 0x10
lea eax, [ebp - 0x6cc]
cmovae eax, edi
mov al, byte [eax + edx]
mov byte [ebp + edx - 0x3ac], al
jmp 0x41c3fd
cmp esi, 0x10
cmovae eax, edi
cmp byte [eax + edx], 0x5c
jne 0x41c3c0
inc ecx
mov dword [ebp - 0x6f8], ecx
cmp ecx, 1
jl 0x41c3fd
lea ecx, [ebp - 0x3ac]
lea eax, [ecx + 1]
mov dword [ebp - 0x6f4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c3d4
sub ecx, dword [ebp - 0x6f4]
lea eax, [ebp - 0x6cc]
cmp esi, 0x10
cmovae eax, edi
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x3ac], al
mov ecx, dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x6f0]
inc edx
cmp edx, dword [ebp - 0x6bc]
jb 0x41c2e0
mov eax, 0x20
push 0x15c
mov word [ebp - 0x2ac], ax
lea eax, [ebp - 0x2aa]
push 0
push eax
call fcn.00429a90
push str.SystemDrive
call fcn.0042e57a
lea edx, [ebp - 0x2ac]
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x41c444
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
movups xmmword [ebp - 0x28], xmm0
movq qword [ebp - 0x18], xmm0
call fcn.0041e110
lea edx, [ebp - 0x38]
sub edx, eax
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x41c470
push 0xaa
lea eax, [ebp - 0x14c]
push 0
push eax
call fcn.00429a90
mov eax, dword [0x450310]
add esp, 0xc
movq xmm0, qword [0x450308]
mov dword [ebp - 0x704], eax
mov al, byte [0x450314]
mov byte [ebp - 0x700], al
xor eax, eax
cmp word [ebp - 0x38], 0x58
mov dword [ebp - 0x6ff], eax
mov word [ebp - 0x6fb], ax
mov eax, dword [0x450318]
movq qword [ebp - 0x70c], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0x6ec], eax
mov eax, dword [0x45031c]
mov dword [ebp - 0x6e8], eax
movups xmmword [ebp - 0x6e4], xmm0
mov dword [ebp - 0x6d4], 0
mov word [ebp - 0x6d0], 0
jne 0x41c52c
cmp word [ebp - 0x36], 0x50
jne 0x41c52c
lea edi, [ebp - 0x2ac]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c513
mov ecx, 8
mov esi, 0x450320
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41c566
lea ecx, [ebp - 0x2ac]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x41c533
mov eax, dword [0x450344]
mov dword [ecx], eax
mov eax, dword [0x450348]
mov dword [ecx + 4], eax
mov eax, dword [0x45034c]
mov dword [ecx + 8], eax
mov ax, word [0x450350]
mov word [ecx + 0xc], ax
mov al, byte [0x450352]
mov byte [ecx + 0xe], al
lea edx, [ebp - 0x2ac]
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41c570
lea edi, [ebp - 0x14c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c580
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x6ec]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41c5a0
lea edi, [ebp - 0x14c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c5b0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x70c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x41c5d0
lea edi, [ebp - 0x2ac]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x41c5e0
mov ecx, edx
lea eax, [ebp - 0x2ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call esi
cmp eax, 0xffffffff
lea eax, [ebp - 0x14c]
jne 0x41cb3e
sub esp, 0xc
lea ecx, [ebp - 0x8b0]
push eax
call fcn.00420a70
mov byte [ebp - 4], 1
cmp word [ebp - 0x38], 0x58
jne 0x41c670
cmp word [ebp - 0x36], 0x50
jne 0x41c670
mov edx, str.chcp_1252_n_echo_off_n
lea ecx, [ebp - 0x8b0]
call fcn.00425560
mov edx, str.del__
lea ecx, [ebp - 0x8b0]
call fcn.00425560
lea edx, [ebp - 0x3ac]
mov ecx, eax
call fcn.00425560
mov edx, 0x45036c
mov ecx, eax
call fcn.00425560
jmp 0x41c6a4
mov edx, str._echo_off_n
lea ecx, [ebp - 0x8b0]
call fcn.00425560
mov edx, str.del
lea ecx, [ebp - 0x8b0]
call fcn.00425560
lea edx, [ebp - 0x3ac]
mov ecx, eax
call fcn.00425560
mov ecx, eax
call fcn.00425320
mov edx, 0x450378
lea ecx, [ebp - 0x8b0]
call fcn.00425560
cmp dword [ebp - 0x860], 0
lea esi, [ebp - 0x8ac]
jne 0x41c6c7
xor esi, esi
jmp 0x41c6ee
lea ecx, [ebp - 0x8ac]
call fcn.00423440
push dword [ebp - 0x860]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.0042ff68
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x8ac]
call fcn.004235c0
test esi, esi
jne 0x41c728
mov eax, dword [ebp - 0x8b0]
lea ecx, [ebp - 0x8b0]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], esi
jne 0x41c720
or eax, 4
push 0
push eax
call fcn.00403730
push 0
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 2
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x8c
call fcn.00426810
add esp, 4
mov dword [ebp - 0x6f0], eax
lea eax, [ebp - 0x6b4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 8
lea eax, [ebp - 0x6b4]
lea ecx, [ebp - 0x968]
push 0x21
push eax
call fcn.0041f350
mov byte [ebp - 4], 2
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffdc
lea ecx, [ebp - 0x968]
call fcn.00420140
mov edi, dword [ebp - 0x6f4]
xor esi, esi
nop word [eax + eax]
lea ecx, [ebp - 0x968]
call fcn.004204c0
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x41c7ca
mov edi, eax
mov eax, dword [ebp - 0x6f0]
mov word [eax + esi*2], di
inc esi
cmp esi, 0x24
jl 0x41c7b0
cmp dword [ebp - 0x90c], 0
lea esi, [ebp - 0x958]
jne 0x41c7ed
xor esi, esi
jmp 0x41c814
lea ecx, [ebp - 0x958]
call fcn.00422b70
push dword [ebp - 0x90c]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.0042ff68
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x958]
call fcn.00422d00
test esi, esi
jne 0x41c84e
mov eax, dword [ebp - 0x968]
lea ecx, [ebp - 0x968]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], esi
jne 0x41c846
or eax, 4
push 0
push eax
call fcn.00403730
sub esp, 0xc
lea eax, [ebp - 0x2ac]
lea ecx, [ebp - 0x800]
push eax
call fcn.0041ef80
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6f0]
cmp word [eax], 0x2a
je 0x41c8fe
cmp word [eax + 2], 0x2a
je 0x41c8fe
push ecx
push 0
push 0
lea ecx, [ebp - 0x800]
call fcn.0041ff10
call fcn.0041cdd0
sub esp, 0x18
mov esi, eax
mov edx, esp
mov dword [ebp - 0x6f4], esp
xor eax, eax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [esi], ax
jne 0x41c8c0
xor ecx, ecx
jmp 0x41c8d4
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c8c5
sub ecx, edi
sar ecx, 1
push ecx
push esi
mov ecx, edx
call fcn.00422290
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6e8]
call fcn.0041d310
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 7
jmp 0x41c9fe
mov esi, 0xffffffdc
push ecx
mov eax, esi
lea ecx, [ebp - 0x800]
cdq
push edx
push eax
call fcn.0041ff10
mov ecx, eax
call fcn.00424db0
add esi, 1
js 0x41c903
mov eax, dword [ebp - 0x800]
lea ecx, [ebp - 0x800]
mov edx, 4
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
cmove eax, edx
push eax
call fcn.00403730
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffdd
lea ecx, [ebp - 0x800]
call fcn.0041ff10
push 0x66
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00429a90
add esp, 0xc
call fcn.0041cdd0
lea edx, [ebp - 0xa0]
sub edx, eax
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x41c980
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [ebp - 0x6f4], esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [ebp - 0xa0], ax
jne 0x41c9bb
xor ecx, ecx
jmp 0x41c9d3
lea ecx, [ebp - 0xa0]
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c9c4
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [ebp - 0xa0]
mov ecx, edx
push eax
call fcn.00422290
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6e8]
call fcn.0041d310
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 5
mov edx, 0x4502ec
lea ecx, [ebp - 0x800]
call fcn.00425000
mov edx, esi
mov ecx, eax
call fcn.004248a0
mov edx, 0x4502ec
mov ecx, eax
call fcn.00425000
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x6d4]
cmp eax, 8
jb 0x41ca45
inc eax
lea ecx, [ebp - 0x6e8]
push eax
push dword [ebp - 0x6e8]
call fcn.00423890
xor eax, eax
mov dword [ebp - 0x6d4], 7
lea esi, [ebp - 0x7fc]
mov word [ebp - 0x6e8], ax
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x7b0], eax
jne 0x41ca70
xor esi, esi
jmp 0x41ca97
lea ecx, [ebp - 0x7fc]
call fcn.00422b70
push dword [ebp - 0x7b0]
xor ecx, ecx
test al, al
cmove esi, ecx
call fcn.0042ff68
xor ecx, ecx
add esp, 4
test eax, eax
cmovne esi, ecx
push 2
push 0
lea ecx, [ebp - 0x7fc]
call fcn.00422d00
test esi, esi
jne 0x41cad1
mov eax, dword [ebp - 0x800]
lea ecx, [ebp - 0x800]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], esi
jne 0x41cac9
or eax, 4
push 0
push eax
call fcn.00403730
push 0x40
lea eax, [ebp - 0x74c]
mov dword [ebp - 0x750], 0x44
push 0
push eax
call fcn.00429a90
xor eax, eax
mov dword [ebp - 0x724], 1
add esp, 0xc
mov word [ebp - 0x720], ax
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0x750]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
call fcn.0042f391
push eax
call esi
cmp eax, 0xffffffff
je 0x41cb55
push 0
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6b8]
cmp eax, 0x10
jb 0x41cb7a
inc eax
lea ecx, [ebp - 0x6cc]
push eax
push dword [ebp - 0x6cc]
call fcn.00423900
mov dword [ebp - 0x6b8], 0xf
mov dword [ebp - 0x6bc], 0
mov byte [ebp - 0x6cc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret