Function at 0x401b40
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ce36
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x49f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], ecx
mov esi, dword [ebp + 0x10]
xorps xmm0, xmm0
mov dword [ebp - 0x160], 0
xor edi, edi
movups xmmword [ebp - 0x54], xmm0
mov byte [ebp - 0x15c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x54], vtable.nbase::CmdLineArgs.0
mov dword [ebp - 0x44], edi
test esi, esi
jne 0x401bc1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x401c27
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401bc6
sub ecx, edx
sar ecx, 1
je 0x401c27
lea eax, [ecx + ecx]
mov dword [ebp - 0x160], eax
add eax, 2
push eax
call fcn.0046703d
mov edx, eax
add esp, 4
mov dword [ebp - 0x44], edx
test edx, edx
je 0x401c27
mov ecx, edx
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x401c00
mov eax, dword [ebp - 0x160]
xor ecx, ecx
mov word [eax + edx], cx
lea ecx, [ebp - 0x54]
call fcn.0040c390
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x50]
sub edi, eax
sar edi, 2
cmp edi, 1
jb 0x401c61
push str.mirror
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0x15c]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x15c], ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x180]
push 0x1c
xorps xmm0, xmm0
mov dword [ebp - 0x168], 0
push eax
push 0x411f40
movups xmmword [ebp - 0x180], xmm0
movq qword [ebp - 0x170], xmm0
call esi
mov edx, dword [ebp - 0x17c]
lea ecx, [ebp - 0x9c]
call fcn.0040c650
mov edi, 1
cmp byte [ebp - 0x15c], 0
mov byte [ebp - 4], 2
jne 0x40215b
push 0x1c
lea eax, [ebp - 0x19c]
mov dword [ebp - 0x184], 0
xorps xmm0, xmm0
push eax
push 0x411f40
movups xmmword [ebp - 0x19c], xmm0
movq qword [ebp - 0x18c], xmm0
call esi
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb4]
mov edx, dword [ebp - 0x198]
call fcn.0040c650
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 4
mov ecx, eax
call fcn.00411d90
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xa0]
mov byte [ebp - 0x155], al
cmp edx, 8
jb 0x401d6d
mov ecx, dword [ebp - 0xb4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401d5d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402392
push edx
push ecx
call fcn.00463043
mov al, byte [ebp - 0x155]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 7
mov word [ebp - 0xb4], cx
test al, al
je 0x401da5
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [ebp - 0x74], xmm0
jmp 0x401e07
xor eax, eax
mov dword [ebp - 0x74], ecx
push eax
push 0x489870
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x70], 7
mov word [ebp - 0x84], ax
call fcn.00404890
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x401e07
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401dfd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402397
push edx
push ecx
call fcn.00463043
add esp, 8
mov edi, 7
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 5
call fcn.0040c8d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x84]
cmp dword [ebp - 0x70], 8
lea eax, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x84]
cmp dword [ebp - 0x58], 8
push ecx
cmovae eax, dword [ebp - 0x6c]
push eax
lea eax, [ebp - 0x28]
push 0x48951c
push eax
call fcn.0040cd90
add esp, 0x10
mov byte [ebp - 4], 7
cmp dword [ebp - 0x8c], 0x104
jae 0x402076
cmp dword [ebp - 0x18], 0x104
jae 0x402076
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], 8
push ecx
cmovae eax, dword [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne al
test al, al
je 0x402076
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x154], 0x44
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
movlpd qword [ebp - 0x150], xmm0
push str._s_mirror
push eax
movlpd qword [ebp - 0x148], xmm0
movlpd qword [ebp - 0x140], xmm0
movlpd qword [ebp - 0x138], xmm0
movlpd qword [ebp - 0x130], xmm0
movlpd qword [ebp - 0x128], xmm0
movlpd qword [ebp - 0x120], xmm0
movlpd qword [ebp - 0x118], xmm0
call fcn.0040cd90
add esp, 0xc
lea ecx, [ebp - 0xac]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x154]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401f46
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x401f80
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40239c
push edx
push ecx
call fcn.00463043
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x401fce
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401fc4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023a1
push edx
push ecx
call fcn.00463043
add esp, 8
mov edx, dword [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x40201c
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402012
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023a6
push edx
push ecx
call fcn.00463043
add esp, 8
mov edx, dword [ebp - 0x70]
xor eax, eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
cmp edx, 8
jb 0x402314
mov ecx, dword [ebp - 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402067
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023ab
push edx
push ecx
call fcn.00463043
add esp, 8
jmp 0x402314
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x4020b4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4020aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b0
push edx
push ecx
call fcn.00463043
add esp, 8
xor eax, eax
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x402106
mov ecx, dword [ebp - 0x6c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4020fc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023b5
push edx
push ecx
call fcn.00463043
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], ax
cmp edx, 8
jb 0x40215b
mov ecx, dword [ebp - 0x84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402151
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023ba
push edx
push ecx
call fcn.00463043
add esp, 8
cmp dword [ebp - 0x88], 8
lea eax, [ebp - 0x9c]
push 4
cmovae eax, dword [ebp - 0x9c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, dword [ebp - 0x164]
push 0xf
push str.haoyongbianqian
lea ecx, [esi + 0x68]
call fcn.00404890
push 0xf
push str.haoyongbianqian
lea ecx, [esi + 0x80]
call fcn.00404890
push 4
push 0x48955c
lea ecx, [esi + 0x98]
call fcn.00404890
push 0xf
push str.HaoYongBianQian
lea ecx, [esi + 0xb0]
call fcn.00404890
push 5
push str.5.0.2
lea ecx, [esi + 0x110]
call fcn.00404890
push 0x13
push str.haoyongbianqian.exe
lea ecx, [esi + 0xc8]
call fcn.00404890
push 0x13
push str.haoyongbianqian.ico
lea ecx, [esi + 0xf8]
call fcn.00404890
push 0xd
push 0x4895e4
lea ecx, [esi + 0xe0]
call fcn.00404890
push 0x1a
push str.https:__www.haoyong333.com
lea ecx, [esi + 0x12c]
mov dword [esi + 0x128], 0x11520
call fcn.00404890
push 0xe
push 0x489638
lea ecx, [esi + 0x144]
call fcn.00404890
push 0
call fcn.00466f11
push eax
call fcn.00466e80
mov eax, dword [ebp + 8]
push 0x5c
mov dword [esi + 0x64], eax
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00465030
mov dword [ebp - 0x100], 0x48b218
mov dword [ebp - 0xc0], vtable.nbase::SupportWeakCallback.0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
add esp, 0x10
mov byte [ebp - 4], 8
or edi, 0x10
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x160], edi
push 0x489500
call fcn.0040b810
mov eax, dword [ebp - 0x100]
mov dword [ebp - method.uninstall::MainThread.1.virtual_0], vtable.uninstall::MainThread.1.0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.uninstall::MainThread.virtual_0], vtable.uninstall::MainThread.0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 4], 9
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x110]
mov byte [ebp - 0xfc], 1
mov dword [ebp - 0xe8], 0
call dword [eax + 4]
lea ecx, [ebp - 0x110]
call fcn.004015d0
mov edx, dword [ebp - 0x88]
cmp edx, 8
jb 0x402350
mov ecx, dword [ebp - 0x9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402346
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4023bf
push edx
push ecx
call fcn.00463043
add esp, 8
xor eax, eax
mov dword [ebp - 0x8c], 0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x88], 7
mov word [ebp - 0x9c], ax
call fcn.0040c320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462ae1
mov esp, ebp
pop ebp
ret 0x10
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
call fcn.00466e0f
int3