Function at 0x40233a
Capabilities:
Create process on windows
Create thread
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1390
call fcn.00405ba0
mov eax, dword [esp + 0x1390]
mov esi, edx
mov ebp, dword [esp + 0x13ac]
mov ecx, eax
movzx eax, byte [ecx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
je 0x402371
inc ecx
jmp 0x40235b
push ecx
lea ebx, [esp + 0x68]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
mov edx, 0xd
call fcn.0040134d
test eax, eax
je 0x40238d
mov byte [eax], 0
mov edx, 0xa
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x4023a0
mov byte [eax], 0
mov edx, 0x20
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x4023b3
mov byte [eax], 0
mov edx, 9
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x4023c6
mov byte [eax], 0
test ebp, 2
je 0x4023d7
mov eax, ebx
call fcn.00401f06
jmp 0x4023e3
push 1
mov edx, esi
mov eax, ebx
call fcn.00401c3e
pop edx
mov esi, eax
test esi, esi
mov eax, 0x40a4f0
je 0x4025c9
lea ebx, [esp + 0x1284]
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
cmp dword [esp + 0x13a8], 0
lea edi, [esp + 0x1174]
je 0x402436
push dword [esp + 0x13a8]
push 0x40b041
push ebx
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
jmp 0x402444
push edi
push 0
push 0x40b043
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x118c]
push eax
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x40246e
cmp eax, 0xffffffff
jne 0x402493
mov eax, esi
call fcn.004021af
mov eax, 0x40a4e3
jmp 0x4025c9
cmp edx, 0xffffffff
je 0x4024b0
push 0
lea eax, [esp + 4]
push eax
push edx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
lea edi, [esp + 0x64]
mov eax, esi
mov edx, edi
push 0x1000
call fcn.00402056
mov dword [esp + 4], eax
mov edx, eax
test edx, edx
pop eax
jne 0x40247f
mov eax, esi
call fcn.004021af
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp], 0
je 0x4024da
lea eax, [esp + 0x1174]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x40a4d7
jmp 0x4025c9
test ebp, 1
je 0x402555
lea ebx, [esp + 0x1064]
push ebx
push 0
push 0x40b043
lea eax, [esp + 0x1290]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x402521
cmp eax, 0xffffffff
jne 0x402538
lea eax, [esp + 0x1174]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x40a4c8
jmp 0x4025c9
push 0
lea eax, [esp + 4]
push eax
push 0x600
push 0x409c60
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0x14]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 4]
push eax
xor eax, eax
test ebp, 1
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
je 0x402582
lea eax, [esp + 0x1194]
push eax
test ebp, 1
je 0x402594
lea eax, [esp + 0x1088]
jmp 0x40259b
lea eax, [esp + 0x1198]
push eax
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
lea edi, [esp + 0x1174]
jne 0x4025d2
push edi
call sub.KERNEL32.DLL_DeleteFileA
and ebp, 1
je 0x4025c4
lea eax, [esp + 0x1064]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x40a4bc
call fcn.004021da
xor eax, eax
jmp 0x40263b
push dword [esp + 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x20c
call fcn.00401000
mov ebx, eax
mov eax, dword [esp + 4]
mov dword [ebx], eax
lea eax, [ebx + 4]
push edi
push eax
call sub.KERNEL32.DLL_lstrcpyA
and ebp, 1
je 0x402612
lea eax, [esp + 0x1064]
push eax
lea eax, [ebx + 0x108]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x402619
mov byte [ebx + 0x108], 0
mov eax, esp
push eax
push 0
push ebx
push 0x402301
push 0x10000
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
add esp, 0x1394
pop ebx
pop esi
pop edi
pop ebp
ret