Function at 0x4018d5
Capabilities:
Clear file content
Create process on windows
Create process suspended
Delete file
Get common file path
Resume thread
Set current directory
Terminate process
Write and execute a file

Disassembly:
push ebx
push esi
push edi
std
mov ecx, edx
mov al, 0x5c
lea edi, [edx + 0x405a83]
repne scasb al, byte es:[edi]
cld
jecxz 0x4018fb
mov byte [edi + 1], 0
push 0x405a84
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
mov byte [edi + 1], 0x5c
sub esp, 4
push esp
push 0x405a84
call dword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
mov eax, dword [esp]
add esp, 4
xor edi, edi
cmp eax, 0
je 0x401927
inc edi
cmp eax, 6
je 0x401927
mov ecx, 1
jmp 0x401c90
push str.decompiling
push 0x405a74
call dword [sym.imp.MSVCRT.DLL_strcpy]
add esp, 8
mov dword [0x405da4], 0x44
xor eax, eax
push 0x405d84
push 0x405da4
push eax
push eax
push 4
push eax
push eax
push eax
push 0x405a84
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ecx, 2
test eax, eax
je 0x401c90
push 0x405b84
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x405b84
push 0
push 0
push 0x405b84
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 0
push 0x405b84
call dword [sym.imp.KERNEL32.DLL__lcreat]
push eax
lea eax, [edi + 5]
sub esp, 4
push esp
push 3
push eax
call fcn.00402402
mov ecx, dword [esp]
add esp, 4
mov edx, dword [esp]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL__lwrite]
call dword [sym.imp.KERNEL32.DLL__lclose]
test edi, edi
jne 0x4019ea
push 0x405b84
push dword [0x405d8c]
call fcn.0040231e
test eax, eax
je 0x401c63
jmp 0x401b40
push 0x405c84
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x405c84
push 0
push 0
push 0x405c84
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
push 0
push 0x405c84
call dword [sym.imp.KERNEL32.DLL__lcreat]
push eax
sub esp, 4
push esp
push 3
push 7
call fcn.00402402
mov ecx, dword [esp]
add esp, 4
mov edx, dword [esp]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.DLL__lwrite]
call dword [sym.imp.KERNEL32.DLL__lclose]
push 0x405b84
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
std
lea esi, [eax + 0x405b83]
lea edi, [esi + 2]
push edi
xchg ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
cld
inc edi
mov word [0x405b84], 0x2220
mov word [edi], 0x2022
add edi, 2
push 0xa
push edi
push dword [0x405d8c]
call dword [sym.imp.MSVCRT.DLL__itoa]
add esp, 0xc
push 0x405b84
push 0x405c84
call dword [sym.imp.MSVCRT.DLL_strcat]
add esp, 8
mov dword [0x405de8], 0x44
xor eax, eax
push 0x405d94
push 0x405de8
push eax
push eax
push eax
push eax
push eax
push eax
push 0x405c84
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push 0xffffffffffffffff
push dword [0x405d94]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
sub esp, 4
push esp
push dword [0x405d94]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov ebx, dword [esp]
add esp, 4
mov edi, 0x405b86
mov al, 0x22
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov byte [edi - 1], 0
push 0x405b86
push 0x405b84
call dword [sym.imp.MSVCRT.DLL_strcpy]
add esp, 8
mov edi, 0x405c84
mov al, 0x22
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov byte [edi - 2], 0
push 0x405c84
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [0x405d94]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x405d98]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ebx, ebx
je 0x401c63
push dword [0x405d88]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
push 0xffffffffffffffff
push dword [0x405d84]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push 0x405b84
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [0x405d84]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x405d88]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x405a84
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
xchg edx, eax
std
or ecx, 0xffffffff
mov al, 0x5c
lea edi, [edx + 0x405a83]
mov esi, edi
repne scasb al, byte es:[edi]
neg ecx
mov al, 0x2e
sub ecx, 2
mov edi, esi
repne scasb al, byte es:[edi]
cld
lea eax, [edi + 1]
cmovne eax, esi
mov dword [eax], 0x75612e5f
mov word [eax + 4], 0x33
push 2
push 0x405a84
call dword [sym.imp.KERNEL32.DLL__lopen]
mov ecx, 4
test eax, eax
js 0x401c90
mov esi, eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.DLL__llseek]
lea ebx, [eax + 1]
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
dec ebx
mov byte [edi + ebx], 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL__llseek]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL__lread]
push dword [0x4053af]
push dword [0x4053ab]
push dword [0x4053a7]
push dword [0x4053a3]
push ebx
push edi
call fcn.004024b3
push ecx
cmp edx, ebx
je 0x401c4d
push eax
push edx
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.DLL__llseek]
push esi
call dword [sym.imp.KERNEL32.DLL__lwrite]
push esi
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
pop eax
xchg ebx, eax
push esi
call dword [sym.imp.KERNEL32.DLL__lclose]
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop eax
mov edx, ebx
xor ecx, ecx
jmp 0x401c90
push 0
push dword [0x405d84]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push dword [0x405d84]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [0x405d88]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, 3
xor edx, edx
xchg ecx, eax
push eax
push edx
push str.idle
push 0x405a74
call dword [sym.imp.MSVCRT.DLL_strcpy]
add esp, 8
pop edx
pop eax
pop edi
pop esi
pop ebx
ret