Function at 0x401060
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Create thread
Delete file
Get common file path
Read file on windows
Resolve function by parsing pe exports
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc28
push ebx
push ebp
push esi
push edi
push str.AttachConsole
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
cmp eax, esi
je 0x401094
push 0xffffffffffffffff
call eax
add esp, 4
push esi
push esi
push esi
push section..text
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x105
lea eax, [esp + 0xa2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x401101
cmp eax, 0x105
je 0x401101
lea ecx, [esp + 0x818]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x401101
cmp eax, 0x105
je 0x401101
lea edx, [esp + 0xe0]
push edx
push esi
push 0x40ca34
lea eax, [esp + 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x401109
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0xe0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea edx, [esp + 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401132
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov cx, word [esp + 0xe0]
xor ebx, ebx
cmp cx, si
mov dword [esp + 0x40], ebx
je 0x401161
jmp 0x401150
add ebx, 1
cmp word [esp + ebx*2 + 0xe0], si
jne 0x401150
mov dword [esp + 0x40], ebx
xor eax, eax
cmp cx, si
je 0x401193
lea edx, [esp + 0xe0]
xor ecx, ecx
mov dx, word [edx]
add eax, 1
mov word [esp + ecx + 0x2f0], dx
lea ecx, [eax + eax]
cmp word [esp + ecx + 0xe0], si
lea edx, [esp + ecx + 0xe0]
jne 0x401171
push esi
push esi
push 3
push esi
push 1
lea ebp, [esp + eax*2 + 0x306]
mov word [esp + eax*2 + 0x304], 0x5c
push 0x80000000
lea eax, [esp + 0xa40]
push eax
mov dword [esp + 0x64], ebp
mov word [esp + ebx*2 + 0xfe], si
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x44], edi
jne 0x4011dd
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x24]
push edx
push edi
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401201
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x14], 4
je 0x401210
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 0xfffffffe
lea eax, [esi - 2]
and eax, 3
cmp byte [esp + eax + 0x18], 0x50
lea eax, [esp + eax + 0x18]
jne 0x40124c
lea ecx, [esi - 1]
and ecx, 3
cmp byte [esp + ecx + 0x18], 0x4b
jne 0x40124c
mov edx, esi
and edx, 3
cmp byte [esp + edx + 0x18], 3
jne 0x40124c
lea ecx, [esi + 1]
and ecx, 3
cmp byte [esp + ecx + 0x18], 4
je 0x401271
push 0
lea edx, [esp + 0x18]
push edx
push 1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401101
cmp dword [esp + 0x14], 0
je 0x401271
add esi, 1
jmp 0x401215
push 1
push 0
push 0xfffffffffffffffc
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40128b
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 0x1e
lea ecx, [esp + 0x2c]
push ecx
push edi
call esi
test eax, eax
je 0x4015b3
cmp dword [esp + 0x14], 0x1e
jne 0x401101
cmp byte [esp + 0x20], 0x50
je 0x4012d5
cmp byte [esp + 0x21], 0x4b
je 0x4012d5
cmp byte [esp + 0x22], 3
je 0x4012d5
cmp byte [esp + 0x23], 4
jne 0x4015bb
cmp dword [esp + 0x36], 0
movzx eax, word [esp + 0x3a]
jne 0x401302
movzx edx, word [esp + 0x3c]
push 1
push 0
add edx, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x401101
jmp 0x40159a
lea ecx, [eax + ebx + 1]
cmp ecx, 0x104
jae 0x401101
push 0
lea edx, [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x71c]
push eax
push edi
call esi
test eax, eax
je 0x401101
movzx eax, word [esp + 0x3a]
cmp dword [esp + 0x14], eax
jne 0x401101
push 0x104
lea ecx, [esp + 0x504]
push ecx
push eax
lea edx, [esp + 0x71c]
push edx
push 0
push GetCommandLineW
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x401101
movzx eax, word [esp + 0x3a]
xor esi, esi
test eax, eax
mov word [esp + eax*2 + 0x500], 0
jbe 0x4013f5
cmp esi, eax
jae 0x4013ab
mov edx, ebp
lea ecx, [esp + 0x500]
sub edx, ecx
movzx ecx, word [esp + esi*2 + 0x500]
cmp cx, 0x2f
je 0x4013ab
lea ebx, [edx + esi*2]
add esi, 1
cmp esi, eax
mov word [esp + ebx + 0x500], cx
jb 0x40138b
cmp word [esp + esi*2 + 0x500], 0x2f
mov word [ebp + esi*2], 0
jne 0x4013e9
push 0
lea edx, [esp + 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4013e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401101
mov word [ebp + esi*2], 0x2f
movzx eax, word [esp + 0x3a]
add esi, 1
cmp esi, eax
jb 0x401380
movzx eax, word [esp + 0x3c]
push 1
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x401101
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea ecx, [esp + 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401101
mov edx, dword [esp + 0x36]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp word [esp + 0x28], 0
mov ebp, eax
je 0x40151d
mov eax, dword [esp + 0x32]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x32]
push 0
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
mov eax, dword [esp + 0x4c]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401101
mov eax, dword [esp + 0x32]
cmp dword [esp + 0x14], eax
jne 0x401101
mov ecx, dword [esp + 0x36]
mov dword [esp + 0xac], eax
xor eax, eax
lea esi, [esp + 0xa8]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
call fcn.004017a0
test eax, eax
jne 0x401101
mov edx, esi
push edx
call fcn.004018f0
add esp, 4
cmp eax, 1
jne 0x401101
call fcn.00402ef0
test eax, eax
jne 0x401101
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x401547
mov ecx, dword [esp + 0x36]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401101
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x36]
jne 0x401101
mov ecx, dword [esp + 0x36]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401101
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x36]
jne 0x401101
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x18]
push eax
push 0x1e
lea ecx, [esp + 0x2c]
push ecx
push edi
call esi
test eax, eax
jne 0x4012aa
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor esi, esi
xor edx, edx
xor eax, eax
mov ecx, 0x41
add edx, 1
mov word [eax + ebp], cx
lea eax, [edx + edx]
movzx ecx, word [eax + 0x40ca3c]
cmp cx, si
jne 0x4015c6
mov word [ebp + edx*2], si
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx ecx, word [eax]
cmp cx, 0x2d
je 0x401616
cmp cx, 0x22
sete dl
lea edx, [edx + edx + 0x20]
movsx cx, dl
movzx edx, cx
movzx ecx, word [eax + 2]
add eax, 2
cmp cx, si
je 0x401616
cmp cx, dx
jne 0x401602
add eax, 2
mov dword [esp + 0x60], eax
lea eax, [esp + 0x4c]
lea edx, [esp + 0x2f0]
push eax
mov dword [esp + 0x50], 0x3c
mov dword [esp + 0x54], 0x40
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], str.open
mov dword [esp + 0x60], edx
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 0xa
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x401689
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x84]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x4016a6
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x1c]
push edx
mov esi, 5
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4016ca
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x84]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push edi
call esi
xor eax, eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x9a], eax
mov dword [esp + 0x9e], eax
mov dword [esp + 0xa2], eax
lea eax, [esp + 0x88]
lea edx, [esp + 0xe0]
push eax
mov dword [esp + 0x90], 3
mov dword [esp + 0x94], edx
mov word [esp + 0x9c], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]