Function at 0x409ac0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x546560]
mov ecx, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
push ebx
push esi
test ecx, ecx
push edi
mov dword [ebp - 0x10], eax
je 0x409b2b
mov edx, ecx
shr edx, 0x10
jne 0x409af4
xor eax, eax
mov ax, cx
lea ecx, [ebp - 0x10]
push eax
call fcn.00413c90
jmp 0x409b2b
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x409b2b
push esi
lea ecx, [ebp - 0x10]
call fcn.00405530
test eax, eax
je 0x409b2b
mov edi, dword [ebp - 0x10]
lea ecx, [esi + esi]
mov edx, ecx
mov esi, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x546560]
mov ecx, str._selfdestruct.bat
test ecx, ecx
mov dword [ebp - 8], eax
jne 0x409b46
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
jmp 0x409b53
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str._selfdestruct.bat
call ebx
push str._selfdestruct.bat
push eax
mov eax, dword [0x55d048]
lea ecx, [ebp - 8]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.004059f0
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00405440
lea ecx, [ebp - 8]
call fcn.00405700
mov edx, dword [0x553d9c]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x440], edx
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0x81
lea edi, [ebp - 0x644]
mov dword [ebp - 0x648], edx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x440]
push ecx
push 0x104
call esi
lea edx, [ebp - 0x648]
push edx
push 0x104
call esi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
push eax
push ecx
call fcn.005323da
add esp, 8
lea edx, [ebp - 0x238]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x546560]
push ecx
mov edi, esp
lea ecx, [ebp - 0x238]
test ecx, ecx
mov dword [edi], eax
je 0x409c71
lea edx, [ebp - 0x238]
shr edx, 0x10
jne 0x409c3d
xor eax, eax
lea ecx, [ebp - 0x238]
mov ax, cx
mov ecx, edi
push eax
call fcn.00413c90
jmp 0x409c71
lea edx, [ebp - 0x238]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x409c71
push esi
mov ecx, edi
call fcn.00405530
test eax, eax
je 0x409c71
mov edi, dword [edi]
lea ecx, [esi + esi]
mov eax, ecx
lea esi, [ebp - 0x238]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c]
push ecx
call fcn.005084e0
add esp, 8
lea edx, [ebp - 0x440]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x409ee4
mov eax, dword [0x546560]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
push ecx
push eax
push eax
lea eax, [ebp - 4]
push edx
push eax
call fcn.00405cb0
mov ecx, 0x546ce4
add esp, 0x14
test ecx, ecx
je 0x409e70
push ecx
call ebx
mov ebx, eax
test ebx, ebx
je 0x409e70
mov edx, 0x546cdc
test edx, edx
jne 0x409cf1
mov dword [ebp - 8], edx
jmp 0x409cff
push 0x546cdc
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 4]
xor edi, edi
mov eax, dword [esi - 8]
lea eax, [esi + eax*2]
cmp esi, eax
mov dword [ebp - 0xc], eax
jae 0x409e73
push 0x546ce4
push esi
call fcn.0053176f
add esp, 8
test eax, eax
je 0x409d3d
lea esi, [eax + ebx*2]
push 0x546ce4
push esi
inc edi
call fcn.0053176f
add esp, 8
test eax, eax
jne 0x409d27
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x409d15
test edi, edi
jle 0x409e70
lea ecx, [ebp - 4]
call fcn.004055c0
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
sub eax, ebx
imul eax, edi
mov ecx, dword [esi - 8]
mov dword [ebp - 0x14], ecx
add eax, ecx
mov ecx, dword [esi - 4]
mov dword [ebp - 0x20], eax
cmp ecx, eax
jl 0x409d82
cmp dword [esi - 0xc], 1
jle 0x409dbe
lea edi, [esi - 0xc]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.00405530
test eax, eax
je 0x409e70
mov ecx, dword [edi + 4]
mov edi, dword [ebp - 4]
shl ecx, 1
mov edx, ecx
mov eax, dword [ebp - 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00405590
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi - 8]
lea ecx, [esi + ecx*2]
cmp esi, ecx
mov dword [ebp - 0xc], ecx
jae 0x409e6d
push 0x546ce4
push esi
call fcn.0053176f
mov edi, eax
add esp, 8
test edi, edi
je 0x409e51
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, edi
sub edx, eax
mov eax, dword [ebp - 0x14]
sar edx, 1
sub eax, edx
lea esi, [ecx + ecx]
sub eax, ebx
lea edx, [edi + ebx*2]
add eax, eax
lea ecx, [esi + edi]
push eax
push edx
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
call fcn.00531870
mov ecx, esi
mov esi, 0x546cdc
mov eax, ecx
mov edx, dword [ebp - 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x14]
and ecx, 3
sub edx, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, edx
push 0x546ce4
push esi
mov word [ecx + esi], 0
mov dword [ebp - 0x14], eax
call fcn.0053176f
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x409de3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x409dcf
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [esi - 8], eax
mov esi, dword [ebp - 4]
test esi, esi
jne 0x409e7b
xor eax, eax
jmp 0x409ea1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00531740
mov eax, esp
push 0
push edi
push esi
push eax
call fcn.00409f10
mov esi, dword [ebp - 4]
mov edx, dword [esi - 8]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x648]
push 0
push eax
lea ecx, [ebp - 0x440]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00405700
lea ecx, [ebp - 0x1c]
call fcn.00405700
lea ecx, [ebp - 0x18]
call fcn.00405700
lea ecx, [ebp - 0x10]
call fcn.00405700
lea esp, [ebp - 0x654]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret