Function at 0x43a270
Capabilities:
Check if file exists
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48a083
mov eax, dword fs:[0]
push eax
sub esp, 0xbf0
push ebx
push esi
push edi
mov eax, dword [0x4b47a8]
xor eax, esp
push eax
lea eax, [esp + 0xc00]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0044d630
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43a2be
push 0x80004005
call fcn.00401db0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0xc0c], 0
call fcn.00439e10
test eax, eax
je 0x43a478
call fcn.0044d630
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43a305
push 0x80004005
call fcn.00401db0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc0c], 1
call fcn.00406820
cmp dword [esp + 0x10], 0
je 0x43a3fb
push 1
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040a000
mov eax, dword [eax]
push 0x494a8c
push eax
call fcn.00469941
add esp, 8
test eax, eax
mov eax, dword [esp + 0x10]
setne bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a377
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43a389
push 0x494a8c
lea ecx, [esp + 0x1c]
call fcn.00409fc0
mov esi, dword [esp + 0x18]
push esi
lea ecx, [esp + 0x18]
push 0x4980e8
push ecx
call fcn.004067e0
mov edi, dword [esp + 0x20]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x43a3f2
push 0x4980f4
lea edx, [esp + 0x14]
push 0x4b90c8
push edx
call fcn.00406070
mov eax, dword [eax]
add esp, 0xc
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a3f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 5
push 0
push 0
push edi
jmp 0x43a406
mov esi, dword [esp + 0x18]
push 5
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add edi, 0xfffffff0
mov byte [esp + 0xc08], 0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a434
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea eax, [esi - 0x10]
mov dword [esp + 0xc08], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a45b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0xc00]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0040a000
mov eax, dword [eax]
push str..hjm
push eax
call fcn.00469941
add esp, 8
test eax, eax
mov eax, dword [esp + 0x10]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a4bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43a5fa
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x7c], 0
je 0x43a5e4
call fcn.0044d630
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x43a4ea
push 0x80004005
call fcn.00401db0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov bl, 2
mov byte [esp + 0xc08], bl
mov ecx, dword [esi]
mov eax, dword [ecx - 0xc]
add eax, 0xfffffffc
push eax
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.0040a080
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc0c], 3
call fcn.00406820
mov byte [esp + 0xc08], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a551
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
add eax, 0x80
lea ebx, [esp + 0x20]
call fcn.0040ac20
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.0042ef00
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc08], 4
call fcn.00451b98
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc08], 2
call fcn.0042f130
mov byte [esp + 0xc08], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a5cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xc08], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
jmp 0x43a442
push 0
push 0
push 0x49cd00
call fcn.0044f968
lea eax, [edi - 0x10]
jmp 0x43a437
lea ecx, [esp + 0x10]
push ecx
call fcn.0043a740
test eax, eax
je 0x43a6f2
push 0x494704
lea ecx, [esp + 0x18]
call fcn.00406500
cmp dword [esp + 0x10], 0
je 0x43a685
push 0x62
push esi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xc18], 5
call fcn.0042ef00
mov byte [esp + 0xc08], 7
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a663
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x1c]
call fcn.00451b98
lea ecx, [esp + 0x1c]
mov byte [esp + 0xc08], 0
call fcn.0042f130
lea eax, [edi - 0x10]
jmp 0x43a437
push 0x58
push esi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x618]
push edx
mov byte [esp + 0xc18], 8
call fcn.0042ef00
mov byte [esp + 0xc08], 0xa
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a6ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x60c]
call fcn.00451b98
lea ecx, [esp + 0x60c]
mov byte [esp + 0xc08], 0
call fcn.0042f130
lea eax, [edi - 0x10]
jmp 0x43a437
lea eax, [edi - 0x10]
mov dword [esp + 0xc08], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a719
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xc00]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4