Function at 0x4010f7
Capabilities:
Accept command line arguments
Check if file exists
Create directory
Create process on windows
Delete directory
Get common file path
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
xor ecx, ecx
test al, al
je 0x401141
cmp al, 0x22
jne 0x401125
xor edx, edx
cmp ecx, ebx
sete dl
mov ecx, edx
cmp al, 0x20
jne 0x40112d
cmp ecx, ebx
je 0x40113b
inc esi
mov al, byte [esi]
test al, al
jne 0x401118
jmp 0x40113b
cmp al, 0x20
jne 0x401141
inc esi
mov al, byte [esi]
test al, al
jne 0x401136
push 0x402078
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40116a
push ebx
push section..text
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
test eax, eax
jne 0x4012f7
jmp 0x4011c7
lea eax, [ebp - 0x364]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4011c7
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and eax, 0xffff
push eax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x15c]
push str._sRSPE_04X.TMP
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4011c2
inc edi
cmp edi, 0xa
jb 0x401182
cmp edi, 0xa
jne 0x4011d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4012f7
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4011f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4012c8
push ebx
push section..text
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
test eax, eax
jne 0x401215
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4012bb
mov ebx, str.RASPPPOE.EXE
push ebx
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0
je 0x40123c
dec esi
push esi
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
xor esi, esi
push esi
push esi
push 0x20
push 1
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push ebx
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40127c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4012aa
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4012a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x4010c3
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
xor ebx, ebx
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
xor esi, esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4012f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4012f7
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jb 0x4012ca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]