Function at 0x40211b
Capabilities:
Create process on windows
Create thread
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1390
call fcn.00405c00
mov eax, dword [esp + 0x1390]
mov esi, edx
mov ebp, dword [esp + 0x13ac]
mov ecx, eax
movzx eax, byte [ecx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
je 0x402152
inc ecx
jmp 0x40213c
push ecx
lea ebx, [esp + 0x68]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
mov edx, 0xd
call fcn.0040134d
test eax, eax
je 0x40216e
mov byte [eax], 0
mov edx, 0xa
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x402181
mov byte [eax], 0
mov edx, 0x20
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x402194
mov byte [eax], 0
mov edx, 9
mov eax, ebx
call fcn.0040134d
test eax, eax
je 0x4021a7
mov byte [eax], 0
test ebp, 2
je 0x4021b8
mov eax, ebx
call fcn.00401cb0
jmp 0x4021c4
push 1
mov edx, esi
mov eax, ebx
call fcn.004019e8
pop edx
mov esi, eax
test esi, esi
mov eax, 0x4102b0
je 0x4023aa
lea ebx, [esp + 0x1284]
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
cmp dword [esp + 0x13a8], 0
lea edi, [esp + 0x1174]
je 0x402217
push dword [esp + 0x13a8]
push 0x41103e
push ebx
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
jmp 0x402225
push edi
push 0
push 0x411040
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x118c]
push eax
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x40224f
cmp eax, 0xffffffff
jne 0x402274
mov eax, esi
call fcn.00401f59
mov eax, 0x4102a3
jmp 0x4023aa
cmp edx, 0xffffffff
je 0x402291
push 0
lea eax, [esp + 4]
push eax
push edx
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
lea edi, [esp + 0x64]
mov eax, esi
mov edx, edi
push 0x1000
call fcn.00401e00
mov dword [esp + 4], eax
mov edx, eax
test edx, edx
pop eax
jne 0x402260
mov eax, esi
call fcn.00401f59
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp], 0
je 0x4022bb
lea eax, [esp + 0x1174]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x410297
jmp 0x4023aa
test ebp, 1
je 0x402336
lea ebx, [esp + 0x1064]
push ebx
push 0
push 0x411040
lea eax, [esp + 0x1290]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x402302
cmp eax, 0xffffffff
jne 0x402319
lea eax, [esp + 0x1174]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x410288
jmp 0x4023aa
push 0
lea eax, [esp + 4]
push eax
push 0x600
push 0x40fa40
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0x14]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 4]
push eax
xor eax, eax
test ebp, 1
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
je 0x402363
lea eax, [esp + 0x1194]
push eax
test ebp, 1
je 0x402375
lea eax, [esp + 0x1088]
jmp 0x40237c
lea eax, [esp + 0x1198]
push eax
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
lea edi, [esp + 0x1174]
jne 0x4023b3
push edi
call sub.KERNEL32.DLL_DeleteFileA
and ebp, 1
je 0x4023a5
lea eax, [esp + 0x1064]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x41027c
call fcn.00401fbb
xor eax, eax
jmp 0x40241c
push dword [esp + 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x20c
call fcn.00401000
mov ebx, eax
mov eax, dword [esp + 4]
mov dword [ebx], eax
lea eax, [ebx + 4]
push edi
push eax
call sub.KERNEL32.DLL_lstrcpyA
and ebp, 1
je 0x4023f3
lea eax, [esp + 0x1064]
push eax
lea eax, [ebx + 0x108]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x4023fa
mov byte [ebx + 0x108], 0
mov eax, esp
push eax
push 0
push ebx
push 0x4020e2
push pe_overlay
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
add esp, 0x1394
pop ebx
pop esi
pop edi
pop ebp
ret