Function at 0x4023c0
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x560
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x402491
lea eax, [esp + 0x64]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x26c]
lea edx, [esp + 0x64]
push ecx
push 0
push 0x40b5ac
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [esp + 0x168]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x26c]
push 0
lea edx, [esp + 0x16c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4025fe
lea eax, [esp + 0x168]
lea ecx, [esp + 0x26c]
push eax
push ecx
lea edx, [esp + 0x378]
push str.__s___init__s
push edx
call fcn.00403097
add esp, 0x10
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x3c], 0x44
push 0
lea edx, [esp + 0x390]
jmp 0x4025f1
mov al, byte [str.PublisherAlpine_Snow_nWrapTypeLite_nAppVersion0_nTitleAnti_Secure_Ultimate_Password_Recovery_nBuyURLhttp:__www.regnow.com_softsell_nph_softsell.cgi_item8643_13affiliate16763_nAffiliateIDrn_a16763_nDownloadURLhttp:__wgt.digitalriver.com_wgt_9f3a1646c2829ec59a8eb14e75c5ff39_251f026945db8d4a7488ee4889d129f5_rn_v8643_Anti_Secure.exe]
test al, al
je 0x40260b
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [esp + 0x574]
push 0x40a4c4
push eax
call fcn.0040369e
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4024df
push 0xfa
call edi
inc esi
cmp esi, 0x14
jl 0x4024a6
test ebx, ebx
jne 0x4024df
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x560
ret
push 2
push 0
push ebx
call fcn.00403506
push ebx
call fcn.004033ae
mov ebp, eax
push ebp
call fcn.004036fa
push 0
push 0
push ebx
mov esi, eax
call fcn.00403506
push ebx
push ebp
push 1
push esi
call fcn.004031bc
lea ecx, [esi + ebp]
add esp, 0x30
cmp esi, ecx
mov edi, esi
jae 0x40254d
cmp byte [edi], 0x58
jne 0x402537
cmp edi, ecx
mov eax, edi
jae 0x40252e
cmp byte [eax], 0x58
jne 0x40252e
inc eax
cmp eax, ecx
jb 0x402524
sub eax, edi
cmp eax, 0x1000
jge 0x402549
inc edi
cmp edi, ecx
jb 0x402519
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x560
ret
test edi, edi
jne 0x40255a
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x560
ret
mov ecx, edi
xor eax, eax
sub ecx, esi
push eax
mov dword [esi + 0x22], ecx
mov ecx, 0x400
push eax
push ebx
rep stosd dword es:[edi], eax
call fcn.00403506
push ebx
push ebp
push 1
push esi
call fcn.004032a4
push esi
call fcn.004036ef
push ebx
call fcn.00403592
add esp, 0x24
lea edx, [esp + 0x64]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x574]
lea eax, [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0x378]
push str.__s___init__s
push edx
call fcn.00403097
add esp, 0x10
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x3c], 0x44
push 0
lea edx, [esp + 0x390]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402641
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x560
ret
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov eax, dword [esp + 0x574]
push eax
call ebx
test eax, eax
jne 0x402641
call ebp
cmp eax, 2
je 0x402641
push 0xfa
call edi
inc esi
cmp esi, 0x14
jl 0x40261f
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x560
ret