Function at 0x401000
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Get common file path

Disassembly:
mov ebp, esp
push 0x409002
call sub.KERNEL32.dll_GetStartupInfoA
mov eax, dword [0x409032]
mov dword [0x409046], eax
call sub.KERNEL32.dll_GetCommandLineA
inc eax
cmp byte [eax], 0
je 0x40102b
cmp byte [eax], 0x2f
jne 0x40101b
jmp 0x401115
push 0x104
push 0x409154
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x409258
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push 0x409258
push 0
push 0x40935c
push 0x409258
call sub.KERNEL32.dll_GetTempFileNameA
push 0
push 0x409258
push 0x409154
call sub.KERNEL32.dll_CopyFileA
call fcn.004017f1
push 0
push 0
push 3
push 0
push 1
push 0
push 0x409258
call sub.KERNEL32.dll_CreateFileA
mov dword [0x409150], eax
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 1
push 0x100000
call sub.KERNEL32.dll_OpenProcess
mov dword [0x409360], eax
mov esi, 0x40a8a0
call fcn.004031e0
mov esi, 0x40936c
mov edi, 0x409395
call fcn.004036b7
mov ecx, 0x44
mov al, 0
cld
mov edi, 0x4095c5
rep stosb byte es:[edi], al
mov dword [0x4095c5], 0x44
push 0x409609
push 0x4095c5
push 0
push 0
push 0
push 1
push 0
push 0
push 0x409395
push 0
call sub.KERNEL32.dll_CreateProcessA
push dword [0x409360]
call sub.KERNEL32.dll_CloseHandle
push dword [0x409150]
call sub.KERNEL32.dll_CloseHandle
jmp 0x401184
inc eax
mov dword [0x409368], eax
mov esi, 0x409368
call fcn.00403f6c
mov dword [0x409364], eax
push dword [0x409789]
push dword [0x409364]
call sub.KERNEL32.dll_WaitForSingleObject
push dword [0x409364]
call sub.KERNEL32.dll_CloseHandle
push dword [0x409368]
call sub.KERNEL32.dll_DeleteFileA
call 0x40118b
jb 0x401184
push 0
push 0
push 0
push 0x409052
call sub.USER32.dll_GetMessageA
cmp ax, 0
je 0x401184
push 0x409052
call sub.USER32.dll_TranslateMessage
push 0x409052
call sub.USER32.dll_DispatchMessageA
jmp 0x401158
push 0
call sub.KERNEL32.dll_ExitProcess
push str.Garamond
push 0x10
push 2
push 0
push 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x28
call sub.GDI32.dll_CreateFontA
mov dword [0x40912a], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40904a], eax
mov eax, 3
mov dword [0x40906e], eax
mov dword [0x409072], 0x40132d
xor eax, eax
mov dword [0x409076], eax
mov dword [0x40907a], eax
push str.STDICON
push dword [0x40904a]
call sub.USER32.dll_LoadIconA
mov dword [0x409082], eax
mov eax, dword [0x40904a]
mov dword [0x40907e], eax
mov dword [0x409086], 0x7f00
push 4
call sub.GDI32.dll_GetStockObject
mov dword [0x40908a], eax
mov dword [0x40908e], 0
mov dword [0x409092], 0x4090d6
push 0x40906e
call sub.USER32.dll_RegisterClassA
cmp eax, 0
je 0x4012c9
mov esi, dword [0x40904e]
mov edi, 0x40a8a0
call fcn.004031a8
call fcn.004024dc
call fcn.00403370
call fcn.00401c7c
mov esi, 3
call fcn.004031f8
push 0
push dword [0x40904a]
push 0
push 0
push 0x190
push 0x1f4
push 0x1e
push 0x1e
push 0x1cf0000
push esi
push str.EVUNINSTALL
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x40904e], eax
mov ecx, dword [0x40904e]
call fcn.00402556
push dword [0x409046]
push dword [0x40904e]
call sub.USER32.dll_ShowWindow
push dword [0x40904e]
call sub.USER32.dll_UpdateWindow
mov eax, 1
call fcn.00401305
clc
ret
stc
ret