Function at 0x401283
Capabilities:
Allocate or change rwx memory
Check os version
Copy file
Create process on windows
Create process suspended
Delete file
Execute shellcode via indirect call
Get hostname
Get number of processors
Get session user name
Move file
Read file on windows
Resume thread
Write and execute a file
Write file on windows

Disassembly:
xor ebp, ebp
mov esi, 0x402464
mov edi, 0x402064
push 0x404
push esp
push esi
call sub.kernel32.dll_GetComputerNameA
pop eax
mov al, byte [esi]
stosb byte es:[edi], al
push 0x404
push esp
push esi
call sub.advapi32.dll_GetUserNameA
pop eax
mov al, byte [esi]
stosb byte es:[edi], al
pushfd
mov ecx, dword [esp]
xor dword [esp], 0x200000
popfd
pushfd
pop edx
xor eax, eax
cmp ecx, edx
je 0x4012c6
inc eax
cpuid
and ax, 0xfff
stosw word es:[edi], ax
mov eax, dword [0x401080]
mov dword [0x402060], eax
test eax, eax
jne 0x401660
call sub.kernel32.dll_AllocConsole
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [0x402004], eax
push 1
push eax
call sub.kernel32.dll_SetConsoleMode
push ebp
push 1
push ebp
push 3
push 0xc0000000
call sub.kernel32.dll_CreateConsoleScreenBuffer
mov dword [section..data], eax
mov ebx, eax
push ebx
call sub.kernel32.dll_SetConsoleActiveScreenBuffer
mov ebx, 0x401085
call fcn.00401617
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov ebx, dword [ecx + 0xb0]
xor bl, 2
shl ebx, 0xe
or bx, word [ecx + 0xac]
shl ebx, 8
or bl, byte [ecx + 0xa8]
shl ebx, 8
or bl, byte [ecx + 0xa4]
call sub.kernel32.dll_GetVersion
cmp eax, ebx
jne 0x40160b
mov ebx, 0x401194
call fcn.00401617
call fcn.00401632
mov dword [0x40119f], ebp
mov dword [0x4011bc], ebp
push 0x4011b3
call sub.kernel32.dll_DeleteFileA
push 0x402008
push 0x402018
push ebp
push ebp
push 4
push ebp
push ebp
push ebp
push ebp
push 0x401198
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401604
mov ebx, dword [0x402008]
mov edi, entry0
sub edi, 0x401257
push 0x40
push 0x1000
push edi
push ebp
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
push 0x401a4a
call sub.kernel32.dll_GetModuleHandleA
push 0x401231
push eax
push 0x401244
push eax
call sub.kernel32.dll_GetProcAddress
push ebp
push edi
push 0x401257
push esi
push ebx
call eax
call sub.kernel32.dll_GetProcAddress
push ebp
push ebp
push ebp
push esi
push ebp
push ebp
push ebx
call eax
push 1
call sub.kernel32.dll_Sleep
push ebx
mov ebx, 0x401210
call fcn.00401617
pop ebx
push dword [0x40200c]
call sub.kernel32.dll_ResumeThread
push 0x64
call sub.kernel32.dll_Sleep
push eax
push esp
push ebx
call sub.kernel32.dll_GetExitCodeProcess
pop eax
cmp eax, 0x103
je 0x401417
push ebp
push pe_nt_image_headers32
push 3
push ebp
push 1
push 0x80000000
push 0x4011b3
call sub.kernel32.dll_CreateFileA
mov ebx, eax
test eax, eax
je 0x4015fd
inc eax
je 0x4015fd
mov esi, 0x402464
push eax
mov eax, esp
push ebp
push eax
push 0x404
push esi
push ebx
call sub.kernel32.dll_ReadFile
pop edi
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, dword [esi]
mov dword [0x401080], eax
mov eax, dword [esi + 0xb0]
cmp eax, 0x100
jae 0x4014a6
cmp eax, 0x80
jb 0x4014a6
cmp dword [0x401080], 0xf4d39b7
je 0x4014c2
mov byte [0x401084], 0
jmp 0x4014c2
mov eax, dword [esi + 0x128]
cmp eax, 0x100
jae 0x4015f6
cmp eax, 0x80
jb 0x4015f6
inc eax
shl eax, 2
mov eax, dword [eax + esi]
mov dword [0x40205c], eax
xor eax, dword [0x402064]
and eax, 0xfffffff
push 4
pop edx
mov ecx, dword [edx + esi]
and ecx, 0xfffffff
cmp ecx, eax
je 0x4014f9
add edx, 4
cmp edx, 0x404
jb 0x4014dc
jmp 0x4015f6
mov eax, dword [0x40205c]
xor eax, dword [edx + esi]
mov dword [0x40205c], eax
cmp byte [0x401084], 0
je 0x40152e
shr eax, 0x1c
mov ah, 1
cmp al, 4
je 0x401528
inc ah
cmp al, 8
je 0x401528
inc ah
cmp al, 9
jne 0x4015f6
mov byte [0x401084], ah
push 0x4011b3
call sub.kernel32.dll_DeleteFileA
movzx eax, byte [0x401084]
mov ebx, 0x402464
push eax
push dword [0x401080]
push 0x401140
push ebx
call sub.user32.dll_wsprintfA
add esp, 0x10
call fcn.00401617
call fcn.00401632
mov esi, 0x401173
mov edi, 0x401198
mov dword [esi + 7], 0x6b61622e
mov dword [esi + 0xb], ebp
push esi
call sub.kernel32.dll_DeleteFileA
push esi
push edi
call sub.kernel32.dll_MoveFileA
mov esi, 0x402464
push 0x404
push esi
push ebp
call sub.kernel32.dll_GetModuleFileNameA
push 0
push edi
push esi
call sub.kernel32.dll_CopyFileA
push ebp
push pe_nt_image_headers32
push 3
push ebp
push 1
push 0x40000000
push edi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
push ebp
push ebp
push 0x280
push ebx
call sub.kernel32.dll_SetFilePointer
push eax
mov eax, esp
push ebp
push eax
push 5
push 0x401080
push ebx
call sub.kernel32.dll_WriteFile
pop eax
push ebx
call sub.kernel32.dll_CloseHandle
mov ebx, 0x401114
call fcn.00401617
call fcn.00401632
call sub.kernel32.dll_FreeConsole
push ebp
call sub.kernel32.dll_ExitProcess
mov ebx, 0x4010f1
jmp 0x401610
mov ebx, 0x4010d6
jmp 0x401610
mov ebx, 0x4010bd
jmp 0x401610
mov ebx, 0x40109f
call fcn.00401617
jmp 0x4015e6
call sub.kernel32.dll_GetVersion
mov edx, eax
mov ebx, eax
xor eax, eax
shr ebx, 0x1e
mov bh, byte [0x401084]
xor bl, 2
mov ah, 0x70
je 0x4016cc
dec bl
je 0x4016b2
dec bl
jne 0x4016ca
sub dl, 3
jb 0x4016ca
mov ah, 0x50
je 0x4016cc
mov ah, 0x60
dec dl
je 0x4016cc
mov ah, 0x40
test bh, bh
je 0x4016cc
dec bh
je 0x4016a8
mov ah, 0x90
dec bh
jne 0x4016a4
mov ah, pe_nt_image_headers32
dec dl
jne 0x4016cc
mov ah, pe_nt_image_headers32
test dh, dh
jne 0x4016cc
mov ah, 0x40
jmp 0x4016cc
mov ah, 0x30
sub dl, 4
jb 0x4016ca
jne 0x4016cc
cmp dh, 0xa
jae 0x4016cc
mov ah, 0x10
test dh, dh
je 0x4016cc
mov ah, 0x20
jmp 0x4016cc
mov ah, 0xf0
or word [0x402066], ax
mov dword [0x4011bc], ebp
push ebp
push pe_nt_image_headers32
push 2
push ebp
push 1
push 0x40000000
push 0x4011b3
call sub.kernel32.dll_CreateFileA
mov ebx, eax
mov esi, 0x402060
lea edi, [esi + 8]
mov ecx, 0xff
xor eax, eax
rep stosd dword es:[edi], eax
push eax
mov eax, esp
push ebp
push eax
push 0x404
push esi
push ebx
call sub.kernel32.dll_WriteFile
pop eax
push ebx
call sub.kernel32.dll_CloseHandle
jmp 0x4015f0