Function at 0x401000
Capabilities:
Accept command line arguments
Check os version
Copy file
Delete directory
Delete file
Delete registry key
Delete registry value
Get common file path
Get file size
Get installed programs
Move file
Set current directory

Disassembly:
jmp 0x40114b
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
push 0x400
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [section..data], eax
add eax, 0x200
mov dword [0x403004], eax
push 0x104
push dword [0x403004]
push 0
call sub.kernel32.dll_GetModuleFileNameA
call sub.kernel32.dll_GetCommandLineA
push eax
push eax
call sub.kernel32.dll_lstrlenA
pop edx
cmp byte [edx + eax - 1], 0x55
je 0x40125a
push dword [section..data]
push 0x104
call sub.kernel32.dll_GetTempPathA
push 0x40111e
push dword [section..data]
call sub.kernel32.dll_lstrcatA
push 0
push dword [section..data]
push dword [0x403004]
call 0x401596
push 0x401143
push dword [section..data]
call sub.kernel32.dll_lstrcatA
push 5
push dword [section..data]
call sub.kernel32.dll_WinExec
mov dword [0x40301c], 0x94
push 0x40301c
call sub.kernel32.dll_GetVersionExA
cmp dword [0x40302c], 2
jne 0x40121a
push 4
push 0
push dword [section..data]
call sub.kernel32.dll_MoveFileExA
jmp 0x401255
push 0x104
push dword [0x403004]
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x40112b
push dword [0x403004]
call sub.kernel32.dll_lstrcatA
push dword [0x403004]
push dword [section..data]
push 0x40113f
push 0x401138
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x40158f
push 0
push dword [0x403004]
call sub.kernel32.dll__lopen
mov dword [0x40300c], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
sub eax, 0x1c00
cmp eax, 0
jg 0x401296
push 0x10
push 0x401005
push 0x40102b
push 0
call sub.user32.dll_MessageBoxA
jmp 0x40158f
mov dword [0x403008], eax
push 0
push pe_overlay
push dword [0x40300c]
call sub.kernel32.dll__llseek
push 0
push 0
push 0
call sub.kernel32.dll_HeapCreate
mov dword [0x403010], eax
push dword [0x403008]
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov dword [0x403014], eax
push dword [0x403008]
push eax
push dword [0x40300c]
call sub.kernel32.dll__hread
push dword [0x40300c]
call sub.kernel32.dll__lclose
push dword [0x403014]
push 0x40100b
push dword [section..data]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403014]
push 0x401043
push dword [0x403004]
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0x34
push dword [section..data]
push dword [0x403004]
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x40158f
push dword [0x403014]
call sub.kernel32.dll_lstrlenA
inc eax
add eax, dword [0x403014]
mov dword [0x403018], eax
mov dword [0x40300c], eax
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x40300c]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40300c], eax
mov esi, dword [0x40300c]
lodsb al, byte [esi]
cmp al, 0
je 0x401400
push dword [0x40300c]
call sub.kernel32.dll_DeleteFileA
push dword [0x40300c]
call fcn.00401660
push dword [0x40300c]
call sub.kernel32.dll_lstrlenA
push eax
add eax, dword [0x40300c]
sub eax, 4
push eax
push 0x401146
push eax
call sub.kernel32.dll_lstrcmpA
pop ecx
or eax, eax
jne 0x4013ce
mov dword [ecx + 1], 0x646967
push dword [0x40300c]
call sub.kernel32.dll_DeleteFileA
pop eax
dec eax
je 0x40135f
mov ecx, dword [0x40300c]
cmp byte [ecx + eax - 1], 0x5c
jne 0x4013cf
pushal
push eax
push dword [0x40300c]
push dword [section..data]
call sub.kernel32.dll_lstrcpynA
push dword [section..data]
call sub.kernel32.dll_RemoveDirectoryA
popal
jmp 0x4013cf
push 0x401110
call sub.kernel32.dll_DeleteFileA
push dword [section..data]
push 0x104
call sub.kernel32.dll_GetTempPathA
push dword [section..data]
call sub.kernel32.dll_SetCurrentDirectoryA
push dword [0x403018]
call sub.kernel32.dll_RemoveDirectoryA
inc dword [0x40300c]
push dword [0x40300c]
pop dword [0x403018]
push dword [0x40300c]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40300c], eax
mov eax, dword [0x40300c]
cmp byte [eax], 0
je 0x40146b
push dword [0x40300c]
call sub.kernel32.dll_DeleteFileA
jmp 0x401442
push dword [0x403018]
call sub.kernel32.dll_RemoveDirectoryA
inc dword [0x40300c]
mov eax, dword [0x40300c]
cmp byte [eax], 0
je 0x401526
push eax
add dword [0x40300c], 5
push dword [0x40300c]
push 0x403018
push 0xf003f
push 0
push dword [0x40300c]
push dword [eax + 1]
call sub.advapi32.dll_RegOpenKeyExA
push dword [0x40300c]
call sub.kernel32.dll_lstrlenA
inc eax
add dword [0x40300c], eax
mov esi, dword [0x40300c]
lodsb al, byte [esi]
cmp al, 1
jne 0x4014e4
push 0
push dword [0x403018]
call sub.advapi32.dll_RegDeleteValueA
inc dword [0x40300c]
jmp 0x401506
push dword [0x40300c]
push dword [0x403018]
call sub.advapi32.dll_RegDeleteValueA
push dword [0x40300c]
call sub.kernel32.dll_lstrlenA
add dword [0x40300c], eax
pop edx
pop eax
cmp byte [eax], 0x43
jne 0x401516
push edx
push dword [eax + 1]
call sub.advapi32.dll_RegDeleteKeyA
push dword [0x403018]
call sub.advapi32.dll_RegCloseKey
jmp 0x401476
push 0x4010db
push dword [section..data]
call sub.kernel32.dll_lstrcpyA
push dword [0x403014]
push 0x4010a6
push dword [0x403004]
call sub.user32.dll_wsprintfA
add esp, 0xc
push dword [0x403014]
push dword [section..data]
call sub.kernel32.dll_lstrcatA
push dword [section..data]
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push dword [0x403010]
call sub.kernel32.dll_HeapDestroy
push 0x40
push 0x401018
push dword [0x403004]
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.kernel32.dll_ExitProcess
jmp dword [sym.imp.kernel32.dll_CopyFileA]