Function at 0x408740
Capabilities:
Check if file exists
Copy file
Create process on windows
Create process suspended
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46fb76
mov eax, dword fs:[0]
push eax
sub esp, 0xa8c
mov eax, dword [0x496534]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004350f7
push 0x208
xor edi, edi
push edi
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0xa44], ebx
call fcn.0044f210
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0044f210
add esp, 0x14
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
push 0x486100
call fcn.00410620
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4089b1
push 0x486438
lea ecx, [ebp - 0xa3c]
call fcn.00401ff0
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0xa40]
call fcn.00401ff0
push 7
push str.Cn_02d_
lea ecx, [ebp - 0xa40]
mov byte [ebp - 4], 1
call fcn.00401780
push 0xc
push 0x486100
lea ecx, [ebp - 0xa40]
call fcn.00401780
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 1
nop word [eax + eax]
push esi
push dword [ebp - 0xa40]
lea eax, [ebp - 0xa3c]
push eax
call fcn.00405ae0
add esp, 0xc
push dword [ebp - 0xa3c]
call ebx
test eax, eax
je 0x40885d
inc esi
cmp esi, 0x64
jb 0x408830
jmp 0x40896b
push 1
push dword [ebp - 0xa3c]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40896b
push 4
push 0
push dword [ebp - 0xa3c]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0044f210
push 0x410
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.0044f210
mov esi, dword [ebp - 0xa44]
lea eax, [ebp - 0x628]
add esp, 0x14
mov ecx, esi
push eax
push 0x486438
call fcn.00410620
push 0x44
lea eax, [ebp - 0xa98]
push 0
push eax
call fcn.0044f210
push dword [esi + 0x48]
mov eax, 5
mov dword [ebp - 0xa98], 0x44
push dword [ebp - 0xa3c]
mov word [ebp - 0xa68], ax
lea eax, [ebp - 0xa38]
push str.__s___s
push 0x208
push eax
mov dword [ebp - 0xa6c], 1
call fcn.00409370
add esp, 0x20
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40896b
push dword [ebp - 0xa54]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
call esi
push dword [ebp - 0xa50]
call esi
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0xa40]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40898f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xa3c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x4089b1
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae75
mov esp, ebp
pop ebp
ret