Function at 0x40a5f0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x47201c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call fcn.00454990
add esp, 0xc
lea ecx, [ebp - 0x31c]
push ecx
mov dword [ebp - 0x320], 0
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov edx, dword [ebp - 0x310]
mov eax, dword [ebp - 0x314]
movzx ecx, word [ebp - 0x316]
push edx
movzx edx, word [ebp - 0x318]
push eax
mov eax, dword [ebp - 0x31c]
push ecx
push edx
push eax
lea ecx, [ebp - 0x30c]
push str._08X__04X__04X__08X_08X.bat
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea edx, [ebp - 0x108]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.0044fcc7
lea edx, [ebp - 0x108]
push edx
call fcn.004026c0
add esp, 0x10
lea eax, [ebp - 0x320]
push eax
push fcn.0040a5f0
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov edx, dword [ebp - 0x320]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40a7eb
mov eax, str._echo_off_r_nSET_N1_r_n:Repeat_r_ndel___s__r_nif_not_exist___s__goto_quit_r_nif___N___GEQ_10_goto_quit_r_nSET__a_N__N__1_r_nSET__a_N__N___r_nping__n_2_127.0.0.1_r_ngoto_Repeat_r_n:quit_r_ndel___s__r_n
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a710
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x20c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a724
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x108]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a738
sub eax, edi
lea edx, [eax + ecx*2 + 0x1c]
lea eax, [eax + ecx*2 + 0x1c]
add edx, esi
add eax, esi
cmp edx, 0x400
ja 0x40a76b
call fcn.004589b0
mov esi, esp
test esi, esi
je 0x40a783
mov dword [esi], 0xcccc
add esi, 8
jmp 0x40a783
push eax
call fcn.0044fc33
add esp, 4
test eax, eax
je 0x40a781
mov dword [eax], 0xdddd
add eax, 8
mov esi, eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, edx
push eax
push str._echo_off_r_nSET_N1_r_n:Repeat_r_ndel___s__r_nif_not_exist___s__goto_quit_r_nif___N___GEQ_10_goto_quit_r_nSET__a_N__N__1_r_nSET__a_N__N___r_nping__n_2_127.0.0.1_r_ngoto_Repeat_r_n:quit_r_ndel___s__r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a7a8
push 0
lea ecx, [ebp - 0x324]
push ecx
sub eax, edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
lea esp, [ebp - 0x330]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ef0f
mov esp, ebp
pop ebp
ret