Function at 0x4039c9
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22d8
call fcn.00405e70
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov esi, ecx
push 0xa
call ebx
lea eax, [ebp - 0x2d8]
lea edi, [esi + 0x970]
push eax
push edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0xa
call ebx
xor ebx, ebx
cmp dword [0x40ad78], ebx
jne 0x403a1d
fld qword [0x407258]
push ecx
push ecx
fstp qword [esp]
fld qword [0x407250]
jmp 0x403a2e
fld qword [0x407248]
push ecx
push ecx
fstp qword [esp]
fld qword [str._np]
push ecx
push ecx
fstp qword [esp]
call fcn.00401410
add esp, 0x10
cmp dword [0x40ad74], ebx
mov dword [ebp - 0xc], ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
je 0x403ba1
xor edi, edi
push edi
push edi
push 0x1004
push dword [esi + 0x1970]
call ebx
cmp eax, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
jle 0x403bbf
mov edx, dword [0x40ad88]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1ad4]
mov dword [ebp - 0x1ad8], edx
mov dword [ebp - 0x12d8], edx
rep stosd dword es:[edi], eax
mov ecx, 0x1ff
lea edi, [ebp - 0x12d4]
rep stosd dword es:[edi], eax
mov ecx, 0x1ff
lea edi, [ebp - 0x22d4]
mov dword [ebp - 0x22d8], edx
push 1
rep stosd dword es:[edi], eax
pop eax
mov edi, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x1ad8]
push eax
push 0
push 0x104b
mov dword [ebp - 0x24], ecx
push dword [esi + 0x1970]
mov dword [ebp - 0x20], 0x3fc
mov dword [ebp - 0x34], edi
call ebx
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1ad8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
je 0x403b04
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x12d8]
mov dword [ebp - 0x20], 0x3fc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0x104b
mov dword [ebp - 0x30], 2
push dword [esi + 0x1970]
mov dword [ebp - 0x34], edi
call ebx
lea eax, [ebp - 0x22d8]
mov dword [ebp - 0x20], 0x3fc
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0x104b
mov dword [ebp - 0x30], 3
push dword [esi + 0x1970]
mov dword [ebp - 0x34], edi
call ebx
push dword [ebp - 8]
lea eax, [ebp - 0x22d8]
push eax
call sub.MSVCRT.dll__wtoi
pop ecx
push eax
lea eax, [ebp - 0x12d8]
push eax
call sub.MSVCRT.dll__wtoi
pop ecx
push eax
lea eax, [ebp - 0x1ad8]
push dword [ebp - 0x2b8]
push eax
call fcn.004013b0
add esp, 0x14
inc edi
cmp edi, dword [ebp - 0x10]
mov dword [ebp - 4], edi
jl 0x403a72
jmp 0x403bbf
push dword [ebp - 8]
push dword [esi + 0x96c]
push dword [esi + 0x968]
push dword [ebp - 0x2b8]
push edi
call fcn.004013b0
add esp, 0x14
push dword [ebp - 8]
call fcn.00401b00
mov edi, eax
push edi
call sub.MSVCRT.dll_malloc
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], eax
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
call fcn.00401d10
add esp, 0x14
xor eax, eax
lea edi, [ebp - 0x84]
push 0x12
pop ecx
rep stosd dword es:[edi], eax
push 0x13
lea edi, [ebp - 0x88]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [0x40ad88]
mov ecx, 0x1ff
mov dword [ebp - 0xad8], eax
xor eax, eax
lea edi, [ebp - 0xad4]
mov dword [ebp - 0x88], 0x4c
rep stosd dword es:[edi], eax
xor edi, edi
push edi
mov dword [ebp - 0x54], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x80], eax
mov eax, 0x104
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xad8]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x7c], str..pdf
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x403d0e
lea eax, [ebp - 0xad8]
push 0x2e
push eax
call sub.MSVCRT.dll_wcsrchr
pop ecx
cmp eax, edi
pop ecx
je 0x403c8e
push 0x4084ac
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x403ca0
lea eax, [ebp - 0xad8]
push 0x4084ac
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push 0x80
push 2
push edi
push edi
lea eax, [ebp - 0xad8]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x403cdb
push edi
push edi
push 0x39
call fcn.0040532d
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403dae
lea ecx, [ebp - 0x10]
push edi
push ecx
mov dword [ebp - 0x10], edi
push dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp - 0xc]
push 0x408
push dword [esi + 0x217c]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push dword [ebp - 4]
call sub.MSVCRT.dll_free
pop ecx
lea eax, [ebp - 0xad8]
push 5
push edi
push edi
push eax
push 0x408304
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x40ad74], edi
je 0x403d9d
push edi
push edi
push 0x1004
push dword [esi + 0x1970]
call ebx
cmp eax, edi
jle 0x403dae
mov dword [ebp - 4], eax
mov eax, dword [0x40ad88]
mov ecx, 0x1ff
mov dword [ebp - 0x12d8], eax
xor eax, eax
lea edi, [ebp - 0x12d4]
push 1
rep stosd dword es:[edi], eax
pop eax
and dword [ebp - 0x34], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x12d8]
push eax
push 0
push 0x104b
mov dword [ebp - 0x24], ecx
push dword [esi + 0x1970]
mov dword [ebp - 0x20], 0x3fc
call ebx
dec dword [ebp - 4]
jne 0x403d4c
jmp 0x403dae
cmp dword [0x40ad7c], edi
je 0x403dae
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret