Function at 0x404820
Capabilities:
Create process on windows
Delete file
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462c64
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4776f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ebp - 0xbc]
call fcn.00403c40
lea esi, [ebp - 0xb4]
mov dword [ebp - 4], 0
call fcn.00403cc0
push 0xe
push str.deleteSelf.bat
mov ebx, esi
mov byte [ebp - 4], 1
call fcn.004131d0
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [ebp - 0xb8], eax
push str.:Repeat_t_ndel__
lea eax, [ebp - 0xb8]
push eax
mov ebx, 0xe
mov byte [ebp - 4], 2
call fcn.00413700
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ebx, [ebp - 0xb8]
call fcn.004131d0
push 0xd
push str.__r_nif_exist__
call fcn.004131d0
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call fcn.004131d0
push 0x21
push str.__goto_Repeat_r_ndel_deleteSelf.bat
call fcn.004131d0
xor ebx, ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0xb8]
push ebx
push esi
lea edx, [ebp - 0xb0]
lea ecx, [ebp - 0xac]
push edx
mov dword [ebp - 0xb0], ecx
call fcn.00407410
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0xb0]
mov eax, edi
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x404930
sub eax, ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.00407fe0
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
cmp eax, ecx
je 0x40495c
push eax
call fcn.0042ae5d
add esp, 4
mov edx, dword [ebp - 0xb4]
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40498e
cmp dword [ebp - 0x18], 0x10
jb 0x404a2b
mov eax, dword [ebp - 0x2c]
push eax
jmp 0x404a23
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc0], ebx
jae 0x4049a0
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
push ebx
lea ecx, [ebp - 0xc0]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x404a01
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], 0x10
jb 0x4049de
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0042ab24
add esp, 4
lea eax, [esi - 0x10]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x404a4c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xb4]
push ebx
push ebx
push ebx
push ecx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x18], 0x10
jb 0x404a2b
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0042ab24
add esp, 4
mov byte [ebp - 4], 1
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404a58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xb4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404a7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xbc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404aa6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ab2f
mov esp, ebp
pop ebp
ret