Function at 0x401000
Capabilities:
Create process on windows
Self delete
Set current directory

Disassembly:
push 0x58
push 0
push 0x405504
call sub.CRTDLL.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x405508], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x405504], eax
call fcn.00403640
call fcn.004035d8
call fcn.00402d7b
call fcn.00402b80
call fcn.00402350
push 8
push 0x40504c
push 4
mov eax, 0x405554
call fcn.00406010
push dword [0x40555c]
push 0
call fcn.00402479
sub esp, 4
lea ecx, [0x40551c]
pop edx
call fcn.00402000
push dword [0x40555c]
call fcn.00402c30
sub esp, 4
lea ecx, [0x405550]
pop edx
call fcn.00402000
push dword [0x40555c]
call fcn.004024f0
sub esp, 4
lea ecx, [0x405548]
pop edx
call fcn.00402000
push dword [0x405548]
push 0
call fcn.00402ecc
push 0
call fcn.00402f00
mov ebx, eax
mov edi, edx
add ebx, 0xfffffffc
adc edi, 0xffffffff
push edi
push ebx
push 0
call fcn.00402f90
push 0
call fcn.00402fe0
mov dword [0x40554c], eax
push dword [0x40554c]
pop dword [0x405544]
push dword [0x40554c]
call fcn.00402bc1
mov dword [0x405538], eax
push 0
call fcn.00402f00
mov ebx, eax
mov edi, edx
add ebx, 0xfffffffc
adc edi, 0xffffffff
mov eax, dword [0x40554c]
cdq
sub ebx, eax
sbb edi, edx
push edi
push ebx
push 0
call fcn.00402f90
push dword [0x40554c]
push dword [0x405538]
push 0
call fcn.00403030
push 0
call fcn.00402cf7
push dword [0x40555c]
mov edx, dword [0x405550]
push dword [0x40555c]
call fcn.00403690
mov edx, 0x40500c
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, str..tmp
call fcn.00403690
inc dword [0x40555c]
push 0
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.00402ecc
pop dword [0x40555c]
and eax, eax
je 0x4011df
push 0
call fcn.00402cf7
inc dword [0x405510]
jmp 0x401227
mov edx, dword [0x405550]
push dword [0x40555c]
call fcn.00403690
mov edx, str.tmpfile
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, str..tmp
call fcn.00403690
lea ecx, [0x405520]
pop edx
call fcn.00402000
jmp 0x40122c
jmp 0x401169
mov dword [0x405510], 0
mov eax, dword [0x405538]
call fcn.00406000
mov dword [0x40554c], eax
push dword [0x40555c]
push 0x64
mov ebx, dword [0x405538]
add ebx, 4
push ebx
call fcn.00402be0
sub esp, 4
lea ecx, [0x405540]
pop edx
call fcn.00402000
push dword [0x40555c]
push dword [0x405540]
call fcn.00402130
sub esp, 4
lea ecx, [0x405518]
pop edx
call fcn.00402000
push dword [0x405518]
mov edx, str.batchfile.bat
pop ecx
call fcn.00406240
je 0x4012ab
mov dword [0x40553c], 1
push dword [0x40555c]
mov edx, dword [0x405550]
push dword [0x40555c]
call fcn.00403690
mov edx, str.tmpfile
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, str..bat
call fcn.00403690
inc dword [0x40555c]
push 0
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.00402ecc
pop dword [0x40555c]
and eax, eax
je 0x401321
push 0
call fcn.00402cf7
inc dword [0x405510]
jmp 0x40139d
mov edx, dword [0x405550]
push dword [0x40555c]
call fcn.00403690
mov edx, str.tmpfile
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, str..bat
call fcn.00403690
lea ecx, [0x405518]
pop edx
call fcn.00402000
push dword [0x405518]
push 1
call fcn.00402e9e
push dword [0x40554c]
mov ebx, dword [0x405538]
add ebx, 0x68
push ebx
push 1
call fcn.00403090
push 1
call fcn.00402cf7
jmp 0x4013a2
jmp 0x4012ab
mov ebx, dword [0x40554c]
add ebx, 0x68
mov dword [0x405514], ebx
push dword [0x40551c]
call sub.KERNEL32.dll_SetCurrentDirectoryA
mov ebx, dword [0x405514]
cmp ebx, dword [0x405544]
jge 0x40167b
mov dword [0x405510], 1
mov ebx, dword [0x405538]
add ebx, dword [0x405514]
mov eax, ebx
call fcn.00406000
mov dword [0x40554c], eax
push dword [0x40555c]
push 0x64
mov ebx, dword [0x405538]
add ebx, dword [0x405514]
add ebx, 4
push ebx
call fcn.00402be0
sub esp, 4
lea ecx, [0x405540]
pop edx
call fcn.00402000
push dword [0x40555c]
push dword [0x405540]
call fcn.00402130
sub esp, 4
lea ecx, [0x405534]
pop edx
call fcn.00402000
push dword [0x405534]
push 0
call fcn.00402ecc
and eax, eax
je 0x4015f0
push 0
call fcn.00402cf7
push dword [0x40555c]
push dword [0x405534]
call fcn.00402a90
sub esp, 4
lea ecx, [0x40552c]
pop edx
call fcn.00402000
push dword [0x40555c]
push dword [0x405534]
call fcn.00402b00
sub esp, 4
lea ecx, [0x405524]
pop edx
call fcn.00402000
push dword [0x40555c]
push dword [0x40555c]
mov edx, 0x405030
call fcn.00403690
mov edx, dword [0x405524]
call fcn.00403690
inc dword [0x40555c]
push dword [0x40552c]
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.00402330
sub esp, 4
lea ecx, [0x405528]
pop edx
call fcn.00402000
push dword [0x40555c]
mov edx, dword [0x405528]
push dword [0x40555c]
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, 0x405030
call fcn.00403690
mov edx, dword [0x405524]
call fcn.00403690
inc dword [0x40555c]
push 0
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.00402ecc
pop dword [0x40555c]
and eax, eax
je 0x401566
push 0
call fcn.00402cf7
inc dword [0x405510]
jmp 0x4015e9
mov edx, dword [0x405528]
push dword [0x40555c]
call fcn.00403690
push dword [0x40555c]
push dword [0x405510]
call fcn.00402040
sub esp, 4
pop eax
mov edx, 0x405030
call fcn.00403690
mov edx, dword [0x405524]
call fcn.00403690
lea ecx, [0x405534]
pop edx
call fcn.00402000
push dword [0x405534]
push 1
call fcn.00402e9e
push dword [0x40554c]
mov ebx, dword [0x405538]
add ebx, dword [0x405514]
add ebx, 0x68
push ebx
push 1
call fcn.00403090
push 1
call fcn.00402cf7
jmp 0x4015ee
jmp 0x4014ec
jmp 0x40162a
push dword [0x405534]
push 1
call fcn.00402e9e
push dword [0x40554c]
mov ebx, dword [0x405538]
add ebx, dword [0x405514]
add ebx, 0x68
push ebx
push 1
call fcn.00403090
push 1
call fcn.00402cf7
mov eax, 0x405554
call fcn.00406050
mov edx, dword [0x405534]
push dword [0x40555c]
call fcn.00403690
mov ebp, dword [0x405558]
lea ecx, [ebp + 8]
pop edx
call fcn.00402000
mov ebx, dword [0x405514]
add ebx, dword [0x40554c]
add ebx, 0x68
mov dword [0x405514], ebx
mov ebx, dword [0x405514]
cmp ebx, dword [0x405544]
jl 0x4013ce
mov ebx, dword [0x40553c]
cmp ebx, 1
jne 0x401815
push 1
push dword [0x40551c]
push 0x405032
push dword [0x405518]
call fcn.00402a3d
push dword [0x405518]
call fcn.00402cb0
push dword [0x405518]
push 1
call fcn.00402e9e
mov eax, 0x405554
call fcn.004060c0
mov ebx, eax
and ebx, ebx
jle 0x40174a
mov eax, 0x405554
call fcn.004060d0
mov eax, 0x405554
call fcn.004060f0
or eax, eax
je 0x40174a
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x40551c]
call fcn.00403690
mov edx, 0x405039
call fcn.00403690
mov edx, dword [0x405534]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
jmp 0x4016da
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x405548]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x405518]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
push 1
call fcn.00402cf7
push 0
push dword [0x405550]
push 0x405032
push dword [0x405518]
push str.open
push dword [0x405530]
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x401a67
push dword [0x405518]
push 1
call fcn.00402eb5
push 1
call fcn.00402f00
push edx
push eax
push 1
call fcn.00402f90
push 0x405032
push 1
call fcn.004030f0
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.echo____
call fcn.00403690
mov edx, dword [0x405520]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
push 1
call fcn.00402cf7
push 0
push dword [0x40551c]
push 0x405032
push dword [0x405518]
push str.open
push dword [0x405530]
call sub.SHELL32.DLL_ShellExecuteA
push 0xf
call sub.KERNEL32.dll_Sleep
push dword [0x405520]
push 1
call fcn.00402ecc
and eax, eax
je 0x4018ef
push 1
call fcn.00402cf7
jmp 0x4018f1
jmp 0x4018c5
push dword [0x405518]
call fcn.00402cb0
push dword [0x405520]
call fcn.00402cb0
push dword [0x405518]
push 1
call fcn.00402e9e
mov eax, 0x405554
call fcn.004060c0
mov ebx, eax
and ebx, ebx
jle 0x4019a1
mov eax, 0x405554
call fcn.004060d0
mov eax, 0x405554
call fcn.004060f0
or eax, eax
je 0x4019a1
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x40551c]
call fcn.00403690
mov edx, 0x405039
call fcn.00403690
mov edx, dword [0x405534]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
jmp 0x401931
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x405548]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
push dword [0x40555c]
push dword [0x40555c]
mov edx, str.del__
call fcn.00403690
mov edx, dword [0x405518]
call fcn.00403690
mov edx, 0x40503b
call fcn.00403690
inc dword [0x40555c]
push 1
mov edx, dword [0x405054]
add dword [esp + 4], edx
call fcn.004030f0
pop dword [0x40555c]
push 1
call fcn.00402cf7
push 0
push dword [0x405550]
push 0x405032
push dword [0x405518]
push str.open
push dword [0x405530]
call sub.SHELL32.DLL_ShellExecuteA
push 0
call 0x401a81
push dword [0x405504]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00402b94
call fcn.00402d4d
call fcn.004035ec
ret