Function at 0x40b76b
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42decb
mov eax, dword fs:[0]
push eax
mov eax, 0x1740
call fcn.00428e60
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0040d812
mov dword [ebp - 0x16b0], eax
mov byte [eax + 0x2d], 1
mov eax, dword [ebp - 0x16b0]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x16b0]
mov dword [eax], eax
mov eax, dword [ebp - 0x16b0]
mov dword [eax + 8], eax
mov dword [ebp - 0x16ac], edi
lea eax, [ebp - 0x16b4]
push eax
lea eax, [ebp - 0x16a8]
push eax
mov byte [ebp - 4], 1
call fcn.0041d967
pop ecx
pop ecx
lea esi, [ebp - 0x16a4]
call fcn.0040b2a7
push dword [ebp - 0x16a8]
mov ebx, dword [sym.imp.MSVCR80.dll__snwprintf_s]
mov esi, 0x4313b8
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x15fc]
push 0x40
push eax
mov dword [ebp - 0x1610], 0x9c41
mov dword [ebp - 0x160c], 0x77fc980d
mov dword [ebp - 0x1608], 0x25
mov dword [ebp - 0x1604], 0x111719
mov dword [ebp - 0x1600], 1
call ebx
add esp, 0x14
push dword [ebp + 8]
lea eax, [ebp - 0x157c]
push esi
push 0xffffffffffffffff
push 0x40
push eax
call ebx
add esp, 0x14
lea ecx, [ebp - 0x16a4]
call fcn.00418252
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x16b8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x16a8], edi
call fcn.0040c978
cmp eax, edi
mov dword [ebp - 0x16bc], eax
jbe 0x40b9fc
push dword [ebp - 0x16a8]
lea esi, [ebp + 0xc]
call fcn.0040c98e
add eax, 0x3c
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0042382c
pop ecx
pop ecx
mov byte [ebp - 4], 2
push dword [ebp - 0x16a8]
call fcn.0040c98e
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.0042382c
pop ecx
pop ecx
push 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x234]
pop esi
cmp dword [ebp - 0x220], esi
jae 0x40b8e9
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40b966
push 0x206
lea eax, [ebp - 0x21a]
push edi
push eax
mov word [ebp - 0x21c], di
call sub.MSVCR80.dll_memset
mov eax, dword [ebp - 0x234]
add esp, 0xc
cmp dword [ebp - 0x220], esi
jae 0x40b924
lea eax, [ebp - 0x234]
push str..tmp
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push 0x104
push eax
call ebx
mov eax, dword [ebp - 0x234]
add esp, 0x18
cmp dword [ebp - 0x220], esi
jae 0x40b956
lea eax, [ebp - 0x234]
push 9
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x220], esi
mov ecx, dword [ebp - 0x234]
jae 0x40b97a
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x23c], esi
mov eax, dword [ebp - 0x250]
jae 0x40b98e
lea eax, [ebp - 0x250]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 0x16a8]
lea esi, [ebp + 0xc]
call fcn.0040c98e
push dword [ebp - 0x16a8]
lea edi, [eax + 0x1c]
call fcn.0040c98e
push eax
lea ecx, [ebp - 0x16b4]
call fcn.0040c9ae
mov ecx, dword [edi]
mov dword [eax], ecx
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
inc dword [ebp - 0x16a8]
mov eax, dword [ebp - 0x16a8]
xor edi, edi
cmp eax, dword [ebp - 0x16bc]
jb 0x40b890
push dword [ebp + 8]
lea ecx, [ebp - 0x16b4]
call fcn.0041df0b
lea ecx, [ebp - 0x238]
mov dword [esp], str.module_cfg.bin
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.configdynamicmodule_cfg.bin
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x16e8]
push eax
mov byte [ebp - 4], 5
call fcn.0042382c
mov esi, eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x1704]
push eax
mov byte [ebp - 4], 6
call fcn.0042382c
add esp, 0x10
cmp dword [esi + 0x18], 8
jb 0x40ba70
mov esi, dword [esi + 4]
jmp 0x40ba73
add esi, 4
cmp dword [eax + 0x18], 8
jb 0x40ba7e
mov eax, dword [eax + 4]
jmp 0x40ba81
add eax, 4
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x1704]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x16e8]
mov byte [ebp - 4], 5
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push str.configdynamicupdate_info.data
lea ecx, [ebp - 0x254]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x16e8]
push eax
mov byte [ebp - 4], 7
call fcn.0042382c
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x40bafb
mov eax, dword [eax + 4]
jmp 0x40bafe
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x16e8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x270]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.___restart
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 8
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::append_wchar_t_const__]
push 0x40
lea eax, [ebp - 0x1748]
push edi
push eax
mov dword [ebp - 0x174c], edi
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x16cc], edi
xor eax, eax
lea edi, [ebp - 0x16c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x258], 8
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x26c]
jae 0x40bb87
lea eax, [ebp - 0x26c]
lea ecx, [ebp - 0x16cc]
push ecx
xor esi, esi
lea ecx, [ebp - 0x174c]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x16b8]
push eax
push 0x4313b8
push 0xffffffffffffffff
lea eax, [ebp - 0x14fc]
push 0x40
push eax
call ebx
add esp, 0x14
lea ecx, [ebp - 0x16a4]
mov dword [ebp - 0x1600], 3
call fcn.00418252
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea eax, [ebp - 0x16b4]
mov byte [ebp - 4], 0
call fcn.0040cd2d
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 0xc]
call fcn.0040cb63
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424d84
leave
ret