Function at 0x405cd0
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Encode data using xor
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c688
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4254ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x405d82
sub esp, 0xc
mov esi, esp
mov dword [ebp - 0xf8], esp
push 0x24
mov dword [ebp - 0xf0], esi
mov dword [esi + 4], ebx
call fcn.0040985b
add esp, 4
cmp eax, ebx
je 0x405d45
mov dword [esi], eax
mov dword [eax], eax
mov esi, dword [esi]
mov dword [esi + 4], esi
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xffffffff
call fcn.00407f40
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xec], ebx
call fcn.0040a382
mov dword [ebp - 4], ebx
mov dword [ebp - 0xe0], vtable.std::bad_alloc.0
mov dword [ebp - 4], 0xffffffff
push 0x421fc8
lea ecx, [ebp - 0xe0]
push ecx
call fcn.004097be
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 4], 3
push ebx
push 0xa
push eax
lea edx, [ebp - 0xe4]
push edx
call fcn.00405a90
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xe4]
add esp, 0x10
push eax
push ecx
push edx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
call fcn.00403f30
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040a5b6
mov eax, 7
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], cx
mov byte [ebp - 4], 5
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
mov byte [ebp - 4], 6
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 7
mov dword [ebp - 0xe8], ebx
call fcn.0040a5c8
and eax, 0x80000007
jns 0x405e37
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
je 0x405e61
mov esi, eax
mov edi, edi
call fcn.0040a5c8
cdq
mov ecx, 0x19
idiv ecx
lea ecx, [ebp - 0x80]
add edx, 0x41
movzx eax, dx
push eax
push 1
call fcn.00403800
dec esi
jne 0x405e40
mov eax, dword [ebp - 0x1c]
cmp eax, 0x104
jb 0x405ee1
or esi, 0xffffffff
cmp eax, 0x104
jb 0x405fc3
lea ecx, [eax - 0x104]
cmp ecx, 0xffffffff
jae 0x405e8a
mov esi, ecx
cmp esi, ebx
jbe 0x405ef2
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
mov edx, edi
cmp ecx, 8
jae 0x405edd
lea edx, [ebp - 0x2c]
mov ecx, edx
sub eax, esi
sub eax, 0x104
add eax, eax
push eax
lea edx, [edx + esi*2 + 0x208]
push edx
add ecx, 0x208
push ecx
call fcn.00409cc0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
sub eax, esi
mov edi, 8
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], edi
jae 0x405ed5
lea ecx, [ebp - 0x2c]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x405ef7
mov ecx, edi
jmp 0x405e9c
mov ecx, 0x104
sub ecx, eax
push ebx
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00403800
mov edi, 8
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x405f02
lea eax, [ebp - 0x2c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xe8], eax
cmp eax, ecx
ja 0x405f28
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402ba0
jmp 0x405f34
sub eax, ecx
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403800
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0x2c]
call fcn.004036f0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x405f4e
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 0xb7
je 0x405e26
push str._tmppack.exe
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.00404600
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 8
lea edx, [ebp - 0x48]
cmp edx, esi
je 0x405fef
cmp dword [ebp - 0x34], edi
jb 0x405f97
mov eax, dword [ebp - 0x48]
push eax
call fcn.00409679
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], cx
cmp dword [esi + 0x14], edi
jae 0x405fcd
mov eax, dword [esi + 0x10]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.00409cc0
add esp, 0xc
jmp 0x405fd4
push str.invalid_string_position
call fcn.0041701b
mov ecx, dword [esi]
mov dword [ebp - 0x48], ecx
mov dword [esi], ebx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x38], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
mov byte [ebp - 4], 7
cmp dword [ebp - 0x88], edi
jb 0x40600a
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00409679
add esp, 4
xor eax, eax
mov word [ebp - 0x9c], ax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x8c], ebx
cmp dword [ebp - 0x34], edi
jae 0x40602e
lea eax, [ebp - 0x48]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
jne 0x4060c5
mov byte [ebp - 4], 6
cmp dword [ebp - 0x34], edi
jb 0x40605b
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.00409679
add esp, 4
mov esi, 7
xor edx, edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], dx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], edi
jb 0x406081
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00409679
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x6c], edi
jb 0x4060a2
mov edx, dword [ebp - 0x80]
push edx
call fcn.00409679
add esp, 4
xor eax, eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], ax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0x10
jb 0x406521
mov ecx, dword [ebp - 0x64]
push ecx
jmp 0x406519
cmp dword [ebp - 0x50], 0x10
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xf4], ebx
jae 0x4060d7
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 0x54]
push ebx
lea edx, [ebp - 0xf4]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40616e
mov byte [ebp - 4], 6
cmp dword [ebp - 0x34], edi
jb 0x406104
mov edx, dword [ebp - 0x48]
push edx
call fcn.00409679
add esp, 4
mov esi, 7
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], edi
jb 0x40612a
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00409679
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x6c], edi
jb 0x40614b
mov eax, dword [ebp - 0x80]
push eax
call fcn.00409679
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0x10
jb 0x406521
mov edx, dword [ebp - 0x64]
push edx
jmp 0x406519
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x134], 0x3c
mov dword [ebp - 0x128], str.open
cmp dword [ebp - 0x34], edi
jb 0x406199
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x124], eax
jmp 0x4061a2
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], 0x41e42c
cmp dword [ebp - 0x18], edi
jb 0x4061bc
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x11c], edx
jmp 0x4061c5
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x134]
push ecx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x130], 0x140
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 0x20
jle 0x406266
mov byte [ebp - 4], 6
cmp dword [ebp - 0x34], edi
jb 0x4061fc
mov edx, dword [ebp - 0x48]
push edx
call fcn.00409679
add esp, 4
mov esi, 7
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], edi
jb 0x406222
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00409679
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x6c], edi
jb 0x406243
mov eax, dword [ebp - 0x80]
push eax
call fcn.00409679
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0x10
jb 0x406521
mov edx, dword [ebp - 0x64]
push edx
jmp 0x406519
mov eax, dword [ebp - 0xfc]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.ins
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00404600
mov byte [ebp - 4], 9
push 0x41e418
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004046e0
mov byte [ebp - 4], 0xa
push str.ler.pak
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.004046e0
add esp, 0x24
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x48]
call fcn.00404460
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x88], edi
jb 0x4062e4
mov edx, dword [ebp - 0x9c]
push edx
call fcn.00409679
add esp, 4
mov esi, 7
xor eax, eax
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov word [ebp - 0x9c], ax
mov byte [ebp - 4], 9
cmp dword [ebp - 0xc0], edi
jb 0x406319
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.00409679
add esp, 4
xor edx, edx
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], ebx
mov word [ebp - 0xd4], dx
mov byte [ebp - 4], 7
cmp dword [ebp - 0xa4], edi
jb 0x406349
mov eax, dword [ebp - 0xb8]
push eax
call fcn.00409679
add esp, 4
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], ebx
mov word [ebp - 0xb8], cx
cmp dword [ebp - 0x34], edi
jae 0x406369
lea eax, [ebp - 0x48]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406401
mov byte [ebp - 4], 6
cmp dword [ebp - 0x34], edi
jb 0x406397
mov edx, dword [ebp - 0x48]
push edx
call fcn.00409679
add esp, 4
mov esi, 7
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], edi
jb 0x4063bd
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00409679
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x6c], edi
jb 0x4063de
mov eax, dword [ebp - 0x80]
push eax
call fcn.00409679
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], cx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0x10
jb 0x406521
mov edx, dword [ebp - 0x64]
push edx
jmp 0x406519
mov eax, dword [ebp - 0x54]
lea eax, [eax + eax*4]
push eax
mov ecx, 0x426bb4
call fcn.004041b0
mov ecx, dword [0x426bb4]
mov byte [ecx], 0x4d
mov edx, dword [0x426bb4]
push ebx
lea eax, [ebp - 0xe8]
push eax
mov byte [edx + 1], 0x5a
mov eax, dword [0x426bb4]
mov ecx, dword [0x426bb8]
sub ecx, eax
sub ecx, 2
push ecx
add eax, 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x406454
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0xe8]
push edx
mov ecx, 0x426bb4
call fcn.004041b0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x406477
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 2
cmp dword [ebp - 0xe8], eax
jbe 0x4064a3
jmp 0x406490
mov ecx, dword [0x426bb4]
xor byte [eax + ecx], 0x37
inc eax
cmp eax, dword [ebp - 0xe8]
jb 0x406490
mov byte [ebp - 4], 6
cmp dword [ebp - 0x34], edi
jb 0x4064b8
mov eax, dword [ebp - 0x48]
push eax
call fcn.00409679
add esp, 4
mov esi, 7
xor ecx, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], cx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x18], edi
jb 0x4064de
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00409679
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x6c], edi
jb 0x4064ff
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00409679
add esp, 4
xor edx, edx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], dx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 0x10
jb 0x406521
mov eax, dword [ebp - 0x64]
push eax
call fcn.00409679
add esp, 4
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xe4]
cmp eax, ebx
je 0x406548
push eax
call fcn.00409679
add esp, 4
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040966a
mov esp, ebp
pop ebp
ret