Function at 0x40b5af
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad294
mov eax, dword fs:[0]
push eax
mov eax, 0xd99c
call fcn.00492330
mov eax, dword [0x505ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [0x507340]
push 0x12
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
mov ebx, dword [ebp + 8]
push 0xd
pop eax
mov dword [ebp - 0xd94c], ebx
cmp edx, eax
jne 0x40b611
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0xd96c]
call fcn.0042f326
and dword [ebp - 4], 0
push str.success
lea ecx, [ebp - 0xd95c]
call fcn.0042f2f7
lea eax, [ebp - 0xd95c]
push eax
push 0x4c0c00
lea ecx, [ebp - 0xd96c]
mov byte [ebp - 4], 1
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0xd95c]
mov byte [ebp - 4], 0
call fcn.0042f451
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x505ab0
push edi
lea ecx, [ebp - 0xd948]
call fcn.00408fd9
mov ecx, dword [0x507340]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 0x13
cdq
pop esi
idiv esi
mov byte [ebp - 4], 2
cmp edx, 4
jne 0x40b70e
movsd xmm3, qword [0x4c0b60]
movd xmm4, ecx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x40b6f4
subsd xmm2, xmm3
divsd xmm3, qword [0x4c0b68]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x4c0b58]
ja 0x40b6d6
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xd948]
push str.__s_
push eax
call fcn.00405092
add esp, 0xc
lea ecx, [ebp - 0xd934]
push edi
call fcn.00408fd9
mov ecx, dword [0x507340]
push 7
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 3
cmp edx, 3
jne 0x40b7b6
xor esi, esi
call fcn.0048f9e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0xd80c], xmm0
cmp esi, 0xcb
jb 0x40b752
xor ecx, ecx
mov edx, 0xca
mov eax, edx
cmp ecx, edx
jge 0x40b7ad
movsd xmm0, qword [ebp + eax*8 - 0xd804]
movsd xmm1, qword [ebp + eax*8 - 0xd80c]
comisd xmm0, xmm1
jbe 0x40b7a8
movsd qword [ebp + eax*8 - 0xd804], xmm1
movsd qword [ebp + eax*8 - 0xd80c], xmm0
dec eax
cmp eax, ecx
jg 0x40b77e
inc ecx
cmp ecx, 0xcb
jl 0x40b778
push str._echo_off_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str._GOTO_END_r_n
lea ecx, [ebp - 0xd93c]
call fcn.00401b1e
mov esi, eax
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xd930]
mov byte [ebp - 4], 4
call fcn.00401b1e
lea ecx, [ebp - 0xd948]
push ecx
push eax
lea eax, [ebp - 0xd944]
push eax
mov byte [ebp - 4], 5
call fcn.004091d4
push esi
push eax
lea eax, [ebp - 0xd938]
push eax
mov byte [ebp - 4], 6
call fcn.004091d4
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xd934]
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.00409334
mov ecx, dword [ebp - 0xd938]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd944]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd930]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd93c]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00407864
push str.SET__a_i0_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str.:REPEAT_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
call fcn.004112f5
test al, al
jne 0x40b908
xor eax, eax
push 0xcf90
push eax
mov word [ebp - 0xd1ac], ax
lea eax, [ebp - 0xd1aa]
push eax
call fcn.004913e0
add esp, 0xc
xor edi, edi
xor esi, esi
xor edx, edx
test edi, edi
je 0x40b8df
test edx, edx
je 0x40b8df
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0xd2f2]
inc ax
add ax, word [ebp + ecx*2 - 0xd1ae]
mov word [ebp + ecx*2 - 0xd1ac], ax
inc edx
cmp edx, 0xa3
jl 0x40b8b7
add esi, 0xa3
inc edi
cmp esi, 0x67c9
jl 0x40b8b5
movsx eax, word [ebp - 0x21c]
mov dword [0x507340], eax
mov edi, 0x505ab0
push str.IF__i_100_GOTO_END_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push 0x4c247c
lea ecx, [ebp - 0xd930]
call fcn.00401b1e
mov esi, eax
push 8
pop eax
push str.DEL
lea ecx, [ebp - 0xd944]
mov byte [ebp - 4], al
call fcn.00401b1e
lea ecx, [ebp - 0xd948]
push ecx
push eax
lea eax, [ebp - 0xd938]
push eax
mov byte [ebp - 4], 9
call fcn.004091d4
push esi
push eax
lea eax, [ebp - 0xd93c]
push eax
mov byte [ebp - 4], 0xa
call fcn.004091d4
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0xd934]
push dword [eax - 0xc]
mov byte [ebp - 4], 0xb
push eax
call fcn.00409334
mov ecx, dword [ebp - 0xd93c]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd938]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd944]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd930]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00407864
push str._GOTO_END_r_n
lea ecx, [ebp - 0xd930]
call fcn.00401b1e
mov esi, eax
push str.IF_NOT_EXIST
lea ecx, [ebp - 0xd944]
mov byte [ebp - 4], 0xc
call fcn.00401b1e
lea ecx, [ebp - 0xd948]
push ecx
push eax
lea eax, [ebp - 0xd938]
push eax
mov byte [ebp - 4], 0xd
call fcn.004091d4
push esi
push eax
lea eax, [ebp - 0xd93c]
push eax
mov byte [ebp - 4], 0xe
call fcn.004091d4
add esp, 0x18
mov eax, dword [eax]
mov byte [ebp - 4], 0xf
push dword [eax - 0xc]
lea ecx, [ebp - 0xd934]
push eax
call fcn.00409334
mov ecx, dword [ebp - 0xd93c]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd938]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd944]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd930]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [0x507340]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 0xd
cdq
pop ecx
idiv ecx
cmp edx, 6
jne 0x40ba94
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push str.ping_1.1.1.1__n_1__w_1000___nul_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str.SET__a_i_i_1_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str.GOTO_REPEAT_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str.:END_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push str.DEL__0_r_n
lea ecx, [ebp - 0xd934]
call fcn.0040930b
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004913e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40bbc8
push edi
lea ecx, [ebp - 0xd930]
call fcn.00408fd9
push str.createDeleteSelfBatchFile_error_GetTempPath
lea ecx, [ebp - 0xd930]
mov byte [ebp - 4], 0x10
call fcn.00407c3d
lea eax, [ebp - 0xd930]
push eax
lea eax, [ebp - 0xd90c]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xd95c]
mov byte [ebp - 4], 0x11
call fcn.0042f275
lea eax, [ebp - 0xd95c]
push eax
push 0x4c0c00
lea ecx, [ebp - 0xd96c]
mov byte [ebp - 4], 0x12
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0xd95c]
mov byte [ebp - 4], 0x11
call fcn.0042f451
lea ecx, [ebp - 0xd90c]
call fcn.00401056
mov ecx, dword [ebp - 0xd930]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd934]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd948]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x40bf4b
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xd940]
call fcn.00401b1e
mov eax, dword [ebp - 0xd940]
push 0x13
mov eax, dword [eax - 0xc]
pop ebx
dec eax
push eax
lea ecx, [ebp - 0xd940]
mov byte [ebp - 4], bl
call fcn.00409650
cmp ax, 0x5c
je 0x40bc0c
push 0x4c0b70
lea ecx, [ebp - 0xd940]
call fcn.0040930b
lea eax, [ebp - 0xd938]
push eax
call fcn.004380f4
mov dword [esp], str..bat
push eax
lea eax, [ebp - 0xd93c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00409229
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0xd940]
push dword [eax - 0xc]
mov byte [ebp - 4], 0x15
push eax
call fcn.00409334
mov ecx, dword [ebp - 0xd93c]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd938]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00407864
call fcn.004111af
test al, al
jne 0x40bc76
dec dword [0x507340]
lea eax, [ebp - 0xd934]
push eax
lea eax, [ebp - 0xd90c]
push eax
call fcn.00438012
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x16
jb 0x40bc97
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xd930]
call fcn.00409063
lea eax, [ebp - 0xd930]
push eax
lea eax, [ebp - 0xd940]
push eax
mov byte [ebp - 4], 0x17
call fcn.00424d38
pop ecx
mov bl, al
pop ecx
mov ecx, dword [ebp - 0xd930]
neg bl
sbb bl, bl
add ecx, 0xfffffff0
call fcn.00407864
push 0x13
pop eax
lea ecx, [ebp - 0xd90c]
mov byte [ebp - 4], al
call fcn.00401056
inc bl
je 0x40bdb4
push edi
lea ecx, [ebp - 0xd930]
call fcn.00408fd9
mov byte [ebp - 4], 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xd930]
push str.createDeleteSelfBatchFile_error_WriteToFile__d
push eax
call fcn.00405092
lea eax, [ebp - 0xd930]
push eax
lea eax, [ebp - 0xd90c]
push eax
call fcn.00438012
add esp, 0x14
push eax
lea ecx, [ebp - 0xd95c]
mov byte [ebp - 4], 0x19
call fcn.0042f275
lea eax, [ebp - 0xd95c]
push eax
push 0x4c0c00
lea ecx, [ebp - 0xd96c]
mov byte [ebp - 4], 0x1a
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0xd95c]
mov byte [ebp - 4], 0x19
call fcn.0042f451
lea ecx, [ebp - 0xd90c]
call fcn.00401056
mov ecx, dword [ebp - 0xd930]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd940]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd934]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd948]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x40bf45
push 0x3c
pop edi
push edi
lea eax, [ebp - 0xd9a8]
push 0
push eax
call fcn.004913e0
add esp, 0xc
call fcn.00411296
test al, al
jne 0x40bdec
xor edx, edx
inc edx
push 0x15
mov eax, edx
pop ecx
dec ecx
lea esi, [eax + edx]
lea edx, [eax]
mov eax, esi
jns 0x40bdda
mov dword [0x507340], esi
jmp 0x40bdf2
mov esi, dword [0x507340]
mov dword [ebp - 0xd9a8], edi
call fcn.004113ad
test al, al
jne 0x40be6a
xor esi, esi
mov edi, 0xe9
call fcn.0048f9e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0xd8fc], xmm0
cmp esi, edi
jb 0x40be08
xor ecx, ecx
mov edx, 0xe8
mov eax, edx
cmp ecx, edx
jge 0x40be5f
movsd xmm0, qword [ebp + eax*8 - 0xd8f4]
movsd xmm1, qword [ebp + eax*8 - 0xd8fc]
comisd xmm0, xmm1
jbe 0x40be5a
movsd qword [ebp + eax*8 - 0xd8f4], xmm1
movsd qword [ebp + eax*8 - 0xd8fc], xmm0
dec eax
cmp eax, ecx
jg 0x40be30
inc ecx
cmp ecx, edi
jl 0x40be2a
mov esi, dword [0x507340]
mov eax, dword [ebp - 0xd940]
and dword [ebp - 0xd98c], 0
mov dword [ebp - 0xd99c], str.open
mov dword [ebp - 0xd998], eax
call fcn.00416882
test al, al
jne 0x40befb
mov eax, esi
cdq
sub eax, edx
mov edi, eax
mov dword [ebp - 0xd930], 0xa6
mov eax, dword [ebp - 0xd930]
xor ecx, ecx
sar edi, 1
test edi, edi
jle 0x40bef6
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ebx, ebx
mov edx, edi
mov dword [ebp - 0xd938], edi
test eax, eax
jle 0x40bee5
mov edx, ebx
mov dword [ebp - 0xd944], eax
add dword [ebp - 0xd930], edx
dec edx
dec dword [ebp - 0xd944]
jne 0x40bed0
mov edx, dword [ebp - 0xd938]
add ebx, ecx
dec edx
mov dword [ebp - 0xd938], edx
jne 0x40bec4
mov eax, dword [ebp - 0xd930]
inc ecx
cmp ecx, eax
jl 0x40beab
lea eax, [ebp - 0xd9a8]
push eax
mov dword [ebp - 0xd9a4], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 0xd940]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd934]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0xd948]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00407864
mov edi, 0x505ab0
mov ebx, dword [ebp - 0xd94c]
lea ecx, [ebp - 0xd92c]
call fcn.00430a82
push edi
lea ecx, [ebp - 0xd94c]
mov byte [ebp - 4], 0x1b
call fcn.00408fd9
lea eax, [ebp - 0xd96c]
push eax
lea eax, [ebp - 0xd90c]
push eax
lea ecx, [ebp - 0xd92c]
mov byte [ebp - 4], 0x1c
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x1d
jb 0x40bf8f
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0xd93c]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0xd94c]
mov byte [ebp - 4], 0x1e
call fcn.00402394
mov ecx, dword [ebp - 0xd93c]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0xd90c]
mov byte [ebp - 4], 0x1c
call fcn.00401056
mov edx, dword [0x507340]
push 0x13
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
cmp edx, 0xb
jne 0x40c013
push 0x2b
mov eax, 0xbb
pop esi
test esi, esi
je 0x40c00c
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x40bffb
add eax, esi
mov dword [0x507340], eax
mov esi, dword [ebp - 0xd94c]
push 8
pop eax
mov word [ebx], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40c032
call fcn.00409bd9
lea ecx, [esi - 0x10]
mov dword [ebx + 8], eax
call fcn.00407864
lea ecx, [ebp - 0xd92c]
mov byte [ebp - 4], 0
call fcn.004090f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd96c]
call fcn.0042f451
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f354
leave
ret