Function at 0x401150
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Encode data using xor
Get common file path
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff7a4
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x408]
push edx
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push 0x400
lea ecx, [ebp - 0x808]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x400
lea eax, [ebp - 0x1808]
push eax
push str.comspec
call sub.KERNEL32.DLL_GetEnvironmentVariableA
push 0x4020b4
lea edx, [ebp - 0x808]
push edx
call sub.CRTDLL.DLL_fopen
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4011db
push 0
push 0x4020d6
push str.0001:Cant_access_batfile_data.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
push 2
push 0xfffffffffffffffc
push ebx
call sub.CRTDLL.DLL_fseek
add esp, 0xc
or esi, eax
push ebx
push 1
push 4
lea edx, [ebp - 4]
push edx
call sub.CRTDLL.DLL_fread
add esp, 0x10
test eax, eax
setbe cl
and ecx, 1
or esi, ecx
push 2
mov eax, dword [ebp - 4]
add eax, 4
neg eax
push eax
push ebx
call sub.CRTDLL.DLL_fseek
add esp, 0xc
or esi, eax
test esi, esi
jne 0x401225
cmp dword [ebp - 4], 0
jg 0x401242
push 0
push 0x4020fc
push str.0002:Cant_read_batfile_header.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
call sub.KERNEL32.DLL_GetTickCount
push eax
push str._d.bat
lea edx, [ebp - 0x408]
push edx
lea ecx, [ebp - 0xc08]
push ecx
call sub.CRTDLL.DLL_strcpy
add esp, 8
mov esi, eax
lea eax, [ebp - 0x408]
push eax
call sub.CRTDLL.DLL_strlen
pop ecx
add esi, eax
push esi
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
push 0x402109
lea edx, [ebp - 0xc08]
push edx
call sub.CRTDLL.DLL_fopen
add esp, 8
mov edi, eax
test ebx, ebx
jne 0x4012b4
push 0
push 0x402128
push str.0003:Cant_create_temp_file.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
xor esi, esi
cmp esi, dword [ebp - 4]
jge 0x4012d7
push edi
push ebx
call sub.CRTDLL.DLL_fgetc
pop ecx
xor eax, 0xff
push eax
call sub.CRTDLL.DLL_fputc
add esp, 8
inc esi
cmp esi, dword [ebp - 4]
jl 0x4012bb
push ebx
call sub.CRTDLL.DLL_ferror
pop ecx
test eax, eax
je 0x4012ff
push 0
push 0x40214c
push str.0004:Cant_read_batfile_data.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
push edi
call sub.CRTDLL.DLL_ferror
pop ecx
test eax, eax
je 0x401327
push 0
push 0x40216e
push str.0005:Cant_write_temp_file.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
push ebx
call sub.CRTDLL.DLL_fclose
pop ecx
push edi
call sub.CRTDLL.DLL_fclose
pop ecx
call sub.KERNEL32.DLL_GetCommandLineA
cmp byte [eax], 0x22
sete dl
and edx, 1
jmp 0x401346
inc eax
cmp byte [eax], 0x20
je 0x401345
cmp byte [eax], 0x22
je 0x401345
test edx, edx
je 0x401362
push 0x22
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
jmp 0x40136d
push 0x20
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
test eax, eax
jne 0x401379
mov eax, 0x402174
jmp 0x401379
inc eax
cmp byte [eax], 0x22
je 0x401378
jmp 0x401381
inc eax
cmp byte [eax], 0x20
je 0x401380
push eax
lea edx, [ebp - 0xc08]
push edx
push str._c____s___s_
lea ecx, [ebp - 0x1408]
push ecx
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x185c]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x185c], 0x44
lea edx, [ebp - 0x1818]
push edx
lea ecx, [ebp - 0x185c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1408]
push eax
lea edx, [ebp - 0x1808]
push edx
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x40140a
push 0
push str.error
push str.0006:Cant_create_bat_process.
push 0
call sub.USER32.DLL_MessageBoxA
mov eax, 1
jmp 0x401450
push 0xffffffffffffffff
push dword [ebp - 0x1818]
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
jne 0x40142a
lea edx, [ebp - 8]
push edx
push dword [ebp - 0x1818]
call sub.KERNEL32.DLL_GetExitCodeProcess
push dword [ebp - 0x1814]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x1818]
call sub.KERNEL32.DLL_CloseHandle
lea ecx, [ebp - 0xc08]
push ecx
call sub.CRTDLL.DLL_remove
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret