Function at 0x4018cb
Capabilities:
Create process on windows
Get common file path
Resume thread
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push esi
push edi
lea edi, [ebp - 0x360]
mov ecx, 0xd8
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.00402b65
test eax, eax
je 0x401b34
mov esi, esp
push 0x104
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp esi, esp
call fcn.00402b65
test eax, eax
je 0x401b34
mov esi, esp
push 0x104
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, esp
call fcn.00402b65
push str.cmd.exe
lea ecx, [ebp - 0x30c]
push ecx
call fcn.00402e90
add esp, 8
mov esi, esp
push str.__c__del
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00402b65
mov esi, esp
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00402b65
mov esi, esp
push str.___nul
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00402b65
mov esi, esp
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x30c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, esp
call fcn.00402b65
mov dword [ebp - 0x360], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x35c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x31c], 0
xor edx, edx
mov dword [ebp - 0x318], edx
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x310], edx
mov dword [ebp - 0x360], 0x44
mov dword [ebp - 0x334], 1
mov word [ebp - 0x330], 0
mov esi, esp
push 0x100
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00402b65
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00402b65
mov esi, esp
push 0xf
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, esp
call fcn.00402b65
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00402b65
mov esi, esp
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x360]
push ecx
push 0
push 0
push 0xc
push 0
push 0
push 0
lea edx, [ebp - 0x30c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp esi, esp
call fcn.00402b65
test eax, eax
je 0x401af2
mov esi, esp
push 0x40
mov eax, dword [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00402b65
mov esi, esp
push 0xfffffffffffffff1
mov ecx, dword [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00402b65
mov esi, esp
mov edx, dword [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.00402b65
mov eax, 1
jmp 0x401b3b
mov esi, esp
push 0x20
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.00402b65
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp esi, esp
call fcn.00402b65
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, esp
call fcn.00402b65
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp esi, esp
call fcn.00402b65
push 0
call fcn.00402baa
pop edi
pop esi
add esp, 0x360
cmp ebp, esp
call fcn.00402b65
mov esp, ebp
pop ebp
ret