Function at 0x4019a0
Capabilities:
Check if file exists
Copy file
Delete file
Persist via lnk shortcut

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4062e3
push eax
mov dword fs:[0], esp
sub esp, 0x32c
push ebx
push ebp
push esi
push edi
push 0x40a24c
mov ebp, ecx
push 0x3ff
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, ebp
call fcn.00401930
test eax, eax
je 0x401efb
lea edi, [ebp + 0x1b5]
lea ebx, [ebp + 0xb0]
push edi
push ebx
mov ecx, ebp
call fcn.00401f20
test eax, eax
je 0x401efb
push 0x40a23c
push 0x3ff
mov ecx, ebp
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, ebp
call fcn.00401930
test eax, eax
je 0x401efb
mov ecx, ebp
call fcn.00402700
test eax, eax
je 0x401efb
push edi
push ebx
mov ecx, ebp
call fcn.00403110
test al, al
jne 0x401a4d
xor eax, eax
jmp 0x401efb
push edi
push ebx
mov ecx, ebp
call fcn.00403470
test al, al
jne 0x401a61
xor eax, eax
jmp 0x401efb
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x234]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x234]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.PbLiveUpdate.xml
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x12c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x12c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, str.PbLiveUpdate.xml
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x130]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401b3a
push eax
push 0x10
push 0x40a208
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x401efb
push 0x40a1f8
push 0x3ff
mov ecx, ebp
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, ebp
call fcn.00401930
test eax, eax
je 0x401efb
push ebx
mov ecx, ebp
call fcn.00402c20
test eax, eax
jne 0x401b81
push eax
push 0x10
push 0x40a1c8
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x401efb
mov ecx, ebp
call fcn.00401930
test eax, eax
je 0x401efb
push 0x40a888
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [ebp + 0x2c0]
mov dword [esp + 0x344], 0
test eax, eax
push 0x40a1c4
jne 0x401ccb
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_2
push 0x40a058
lea edx, [esp + 0x20]
push eax
push edx
mov byte [esp + 0x350], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x348], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x344], 1
call fcn.00405c42
lea ecx, [esp + 0x18]
mov byte [esp + 0x344], 0
call fcn.00405c42
push str..lnk
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.CMBPBWA.ocx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x344], 3
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x401cb8
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.00402ee0
lea ecx, [esp + 0x20]
mov byte [esp + 0x344], 0
call fcn.00405c42
jmp 0x401d46
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
push 0x40a068
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x34c], 4
push eax
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x348], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x344], 4
call fcn.00405c42
lea ecx, [esp + 0x1c]
mov byte [esp + 0x344], 0
call fcn.00405c42
push str..lnk
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, ebp
call fcn.00402ee0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x40a1a0
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.00402ee0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x40a184
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.00402ee0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x40a168
call sub.MFC42.DLL_CString::CString_2
mov ecx, ebp
call fcn.00402ee0
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x40a154
push 0x3ff
mov ecx, ebp
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, ebp
call fcn.00401930
test eax, eax
jne 0x401ddd
lea ecx, [esp + 0x10]
mov dword [esp + 0x344], 0xffffffff
call fcn.00405c42
xor eax, eax
jmp 0x401efb
mov eax, dword [esp + 0x34c]
mov ecx, ebp
push eax
push ebx
call fcn.00402860
test eax, eax
jne 0x401e19
push eax
push 0x10
push 0x40a140
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 0x10]
mov dword [esp + 0x344], 0xffffffff
call fcn.00405c42
xor eax, eax
jmp 0x401efb
push 0x40a1c4
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_2
push eax
lea ecx, [esp + 0x24]
push ebx
push ecx
mov byte [esp + 0x350], 6
call sub.MFC42.DLL_operator_1
push str.5.1.3.2
lea edx, [esp + 0x20]
mov bl, 7
push eax
push edx
mov byte [esp + 0x350], bl
call sub.MFC42.DLL_operator_2
push str._success.txt
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x34c], 8
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x18]
call fcn.00405c42
lea ecx, [esp + 0x1c]
mov byte [esp + 0x344], bl
call fcn.00405c42
lea ecx, [esp + 0x20]
mov byte [esp + 0x344], 6
call fcn.00405c42
lea ecx, [esp + 0x14]
mov byte [esp + 0x344], 0
call fcn.00405c42
push 0x40a124
push 0x3ff
mov ecx, ebp
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0x10
push ecx
mov dword [ebp + 0xa8], 1
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x344], 0xffffffff
call fcn.00405c42
mov eax, 1
mov ecx, dword [esp + 0x33c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x338
ret 4