Function at 0x403d50
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eb38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x840
push ebx
push esi
push edi
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_DEL___s_
lea ecx, [ebp - 0x20]
call fcn.00401120
mov eax, dword [0x427f18]
mov ecx, 0x81
mov dword [ebp - 0x84c], eax
xor eax, eax
lea edi, [ebp - 0x848]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x84c]
push 0x104
push ecx
push 0
mov dword [ebp - 4], 0
stosw word es:[edi], ax
call esi
lea ecx, [ebp - 0x14]
call fcn.004010c0
push 0x8ae
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401ab0
lea edx, [ebp - 0x84c]
push eax
push edx
call fcn.00403c90
add esp, 8
lea ecx, [ebp - 0x14]
push 0xffffffffffffffff
call fcn.00401b40
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
call fcn.004010d0
push str._selfdestruct.bat
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00401320
mov edx, dword [0x427f18]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x63c]
mov dword [ebp - 0x640], edx
mov dword [ebp - 0x230], edx
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [ebp - 0x434]
mov dword [ebp - 0x438], edx
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x230]
push ecx
push 0x104
call edi
lea edx, [ebp - 0x438]
push edx
push 0x104
call edi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x230]
push eax
push ecx
call sub.MSVCRT.dll_wcscat
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x438]
push edx
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea ecx, [ebp - 0x640]
push 0x104
push ecx
push 0
call esi
lea edx, [ebp - 0x640]
lea ecx, [ebp - 0x1c]
push edx
call fcn.00401120
push 0
push 0x80
push 2
push 0
push 0
lea eax, [ebp - 0x230]
push 0x40000000
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403fa2
lea ecx, [ebp - 0x10]
call fcn.004010c0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
push ecx
push 0x427708
push eax
push eax
lea eax, [ebp - 0x10]
push edx
push eax
call fcn.004015b0
add esp, 0x18
lea ecx, [ebp - 0x10]
push 0x417da4
push 0x417eb4
call fcn.00401360
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 0x24], eax
jne 0x403f27
xor esi, esi
jmp 0x403f59
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0040e810
mov ecx, dword [ebp - 0x24]
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x28]
push 0
push edx
lea ecx, [ebp - 0x10]
call fcn.004011e0
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x438]
push 0
push eax
lea ecx, [ebp - 0x230]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00401b80
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00401b80
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00401b80
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00401b80
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
call fcn.00401b80
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x858]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret