Function at 0x401010
Capabilities:
Delete file
Encode data using xor
Execute command
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x80c
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x808], eax
cmp dword [esp + 0x810], 1
mov eax, dword [esp + 0x814]
push ebx
push ebp
mov ebx, dword [eax]
mov dword [esp + 0xc], ebx
jle 0x401073
mov eax, dword [eax + 4]
mov ecx, str.__debug
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401065
test dl, dl
je 0x401061
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401065
add eax, 2
add ecx, 2
test dl, dl
jne 0x401045
xor eax, eax
jmp 0x40106a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401073
lea ebp, [eax + 1]
jmp 0x401075
xor ebp, ebp
push 0x402138
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4010a4
pop ebp
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004012f1
add esp, 0x80c
ret
push edi
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push 2
push 0xfffffffffffffffd
push ebx
call edi
push ebx
push 3
lea eax, [esp + 0x20]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
test ebp, ebp
je 0x4010e8
movzx eax, byte [esp + 0xe]
push eax
movzx eax, byte [esp + 0x11]
push eax
movzx eax, byte [esp + 0x14]
push eax
push str._d__d__d_n
call fcn.00401290
add esp, 0x10
movzx eax, byte [esp + 0xd]
push esi
movzx esi, byte [esp + 0x12]
shl esi, 8
add esi, eax
movzx eax, byte [esp + 0x10]
shl esi, 8
add esi, eax
jne 0x40110c
lea eax, [esi + 2]
jmp 0x401274
mov eax, 0xfffffffd
push 2
sub eax, esi
push eax
push ebx
call edi
lea eax, [esi + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x401134
lea eax, [edi + 3]
jmp 0x401274
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
xor eax, eax
cmp esi, 0x40
jb 0x40119c
movaps xmm2, xmmword [str._________________0_]
lea ecx, [edi + 0x20]
mov edx, esi
and edx, 0xffffffc0
nop
movups xmm0, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x40]
add eax, 0x40
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [ecx - 0x60], xmm0
movups xmm0, xmmword [ecx - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
xorps xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
cmp eax, edx
jl 0x401160
cmp eax, esi
jge 0x4011a9
xor byte [eax + edi], 0x25
inc eax
cmp eax, esi
jl 0x4011a0
mov byte [edi + esi], 0
test ebp, ebp
je 0x4011bf
push edi
push 0x402148
call fcn.00401290
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpnam]
add esp, 4
test eax, eax
jne 0x4011d8
mov eax, 4
jmp 0x401274
push eax
lea eax, [esp + 0x1c]
push str._s.cmd
push eax
call fcn.004012c0
lea eax, [esp + 0x24]
push 0x402154
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x401206
lea eax, [ebx + 5]
jmp 0x401274
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [esp + 0x2c]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x438]
push str.___s____s__
push eax
call fcn.004012c0
add esp, 0x28
test ebp, ebp
je 0x401256
lea eax, [esp + 0x418]
push eax
push 0x402148
call fcn.00401290
add esp, 8
lea eax, [esp + 0x418]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x818]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004012f1
add esp, 0x80c
ret