Function at 0x4012b0
Capabilities:
Create process on windows
Create process suspended
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x113c
call fcn.00401c50
mov eax, dword [0x40b044]
xor eax, esp
mov dword [esp + 0x1138], eax
push ebx
push esi
push edi
push str.windir
push 0x200
lea eax, [esp + 0x948]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00401b68
push str._system32
lea edx, [esp + 0x954]
push 0x200
push edx
call fcn.00401709
push 0
lea eax, [esp + 0x960]
push eax
push str.system32
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, 0x73
mov word [esp + 0x98], cx
mov edx, 0x70
mov word [esp + 0x9a], dx
mov eax, 0x69
mov word [esp + 0x9c], ax
mov ecx, 0x65
mov word [esp + 0x9e], cx
mov edx, 0x63
mov word [esp + 0xa0], dx
mov eax, 0x74
mov ecx, 0x30
mov edx, 0x64
mov word [esp + 0xa2], ax
mov word [esp + 0xa4], cx
mov ecx, edx
mov word [esp + 0xa6], dx
mov eax, 0x2e
mov edx, 0x6c
mov word [esp + 0xa8], ax
mov eax, edx
mov word [esp + 0xac], dx
add esp, 0x28
mov word [esp + 0x82], cx
lea edx, [esp + 0x70]
xor ecx, ecx
push edx
mov word [esp + 0x8a], ax
mov word [esp + 0x8c], cx
call ebx
test eax, eax
jne 0x4013d2
push eax
call fcn.00401a35
push str.Tkey3g25
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
lea ecx, [esp + 0x110]
push ecx
push 0
push 0
push 8
call eax
cmp eax, 0xfffffff8
je 0x40140b
cmp eax, 0xfffffffe
je 0x40140b
push 0x30
push 0x409268
push 0x40924c
jmp 0x401679
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x100
lea edi, [esp + 0x140]
rep stosd dword es:[edi], eax
push 0x400
lea eax, [esp + 0x144]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x1ff
mov esi, 0x5c
cmp word [esp + eax*2 + 0x140], si
je 0x401453
dec eax
test eax, eax
jg 0x401444
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x544]
push 0x200
push edx
call fcn.0040169a
add esp, 0xc
mov eax, 0x1ff
cmp word [esp + eax*2 + 0x140], si
je 0x401484
dec eax
test eax, eax
jg 0x401475
mov eax, 0x1ff
lea esp, [esp]
cmp word [esp + eax*2 + 0x140], si
je 0x4014a1
dec eax
test eax, eax
jg 0x401490
jmp 0x4014ab
xor ecx, ecx
mov word [esp + eax*2 + 0x140], cx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0xd44]
push 0x200
push eax
call fcn.0040169a
push str.Tdxw.exe
lea ecx, [esp + 0x150]
push 0x200
push ecx
call fcn.00401709
push str.GNPluginsTE__Formula.dll
lea edx, [esp + 0xd5c]
push 0x200
push edx
call fcn.00401709
add esp, 0x24
lea eax, [esp + 0xd40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x44
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.00401c80
add esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x4000000
push 0
push 0
mov edx, 4
mov word [esp + 0x74], dx
push 0
lea edx, [esp + 0x160]
push edx
push 0
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0x1c]
mov edx, eax
mov ecx, eax
shr ecx, 0x18
shr edx, 0x10
push str.temp
mov byte [esp + 0xdc], cl
mov byte [esp + 0xdd], dl
mov ecx, eax
push 0x200
lea edx, [esp + 0x548]
mov byte [esp + 0xe3], al
push edx
lea eax, [esp + 0x1c]
shr ecx, 8
push eax
mov byte [esp + 0xea], cl
call fcn.00401b68
push 0x409160
lea ecx, [esp + 0x554]
push 0x200
push ecx
call fcn.00401709
push str.isky3g25
lea edx, [esp + 0x560]
push 0x200
push edx
call fcn.00401709
push str..dat
push 0x200
lea eax, [esp + 0x570]
push eax
call fcn.00401709
add esp, 0x34
push 0
push 0x8000080
push 2
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x28]
push edx
push 0x32
lea eax, [esp + 0xe4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tdxwjm0.dll
call ebx
test eax, eax
je 0x40166d
push str.ProtectExe
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x14]
push ecx
call eax
test eax, eax
jge 0x401681
push 0
push str.Jmi8.com
push str.LoadLibrary_tdxwjm0.dll_failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x1144]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401786
mov esp, ebp
pop ebp
ret 0x10