Function at 0x439a70
Capabilities:
Check if file exists
Copy file
Get file attributes
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ddca
mov eax, dword fs:[0]
push eax
sub esp, 0xea8
mov eax, dword [0x46972c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xeb4], ecx
xor eax, eax
mov word [ebp - 0x424], ax
push 0x206
push 0
lea ecx, [ebp - 0x422]
push ecx
call fcn.00422660
add esp, 0xc
xor edx, edx
mov word [ebp - 0xa3c], dx
push 0x206
push 0
lea eax, [ebp - 0xa3a]
push eax
call fcn.00422660
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.00422660
add esp, 0xc
xor eax, eax
mov word [ebp - 0x834], ax
push 0x206
push 0
lea ecx, [ebp - 0x832]
push ecx
call fcn.00422660
add esp, 0xc
xor edx, edx
mov word [ebp - 0x62c], dx
push 0x206
push 0
lea eax, [ebp - 0x62a]
push eax
call fcn.00422660
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0xeac]
call fcn.00449a20
mov dword [ebp - 4], 0
push 0x457350
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x457358
lea ecx, [ebp - 0x62c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x424]
push edx
push 0x457364
push 0x457388
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xeac]
call fcn.00449690
push str.HPHP_SoftPaq_Download_ManagerSWDownload
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0xa3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x439c52
lea eax, [ebp - 0x424]
push eax
push str.ERROR____Softpaq_executable_file_not_found:_from_____s
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x456716
lea edx, [ebp - 0x834]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xeac]
call fcn.0044a040
mov byte [ebp - 0xead], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.00449a00
mov al, byte [ebp - 0xead]
jmp 0x439ec0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0xeb4]
call fcn.00439310
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439d07
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x424]
push eax
push str.ERROR____Copy_softpaq.exe_fails:_from_____s_to__s
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x456717
lea edx, [ebp - 0x834]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xeac]
call fcn.0044a040
mov byte [ebp - 0xeae], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.00449a00
mov al, byte [ebp - 0xeae]
jmp 0x439ec0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x424]
push edx
push str.Copy_softpaq.exe_passes:_from_____s_to__s
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x45671e
lea ecx, [ebp - 0x834]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xeac]
call fcn.0044a040
push 0x45759c
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x62c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x45753c
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0xa3c]
push edx
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x439e21
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x424]
push eax
push str.WARNING____Copy_CVA_file_fails:_from_____s_to__s
lea ecx, [ebp - 0x834]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x45671f
lea edx, [ebp - 0x834]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xeac]
call fcn.0044a040
jmp 0x439e5f
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x424]
push edx
push str.Copy_CVA_file_passes:_from_____s_to__s
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x456726
lea ecx, [ebp - 0x834]
push ecx
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xeac]
call fcn.0044a040
push 0x104
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.00422660
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.00422660
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x834]
push edx
call fcn.00422660
add esp, 0xc
mov byte [ebp - 0xeaf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeac]
call fcn.00449a00
mov al, byte [ebp - 0xeaf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00422647
mov esp, ebp
pop ebp
ret 0xc