Function at 0x40dee1
Capabilities:
Create process on windows
Delete file
Move file
Resume thread
Self delete

Disassembly:
mov eax, 0x4211fb
call fcn.00411868
sub esp, 0xa4
push ebx
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00407213
lea eax, [ebp - 0x3c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 4], ebx
call fcn.0040de5d
add esp, 0xc
cmp byte [0x42b848], bl
mov byte [ebp - 4], 1
je 0x40dfa9
cmp byte [0x42b84a], bl
je 0x40df53
push str.Launcher:_Writing_to_wininit.ini_to_cleanup
lea ecx, [ebp - 0x2c]
call fcn.0040e496
lea eax, [ebp - 0x2c]
push 1
push eax
mov byte [ebp - 4], 2
call fcn.0040a0b9
pop ecx
mov byte [ebp - 4], 1
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0040e4dc
lea ecx, [ebp - 0x94]
call fcn.0040bec0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0040ed7f
push eax
lea ecx, [ebp - 0x94]
call fcn.0040bfec
lea ecx, [ebp - 0x4c]
call fcn.0040ed7f
push eax
lea ecx, [ebp - 0x94]
call fcn.0040bfec
lea ecx, [ebp - 0x94]
call fcn.0040c065
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.0040bf16
jmp 0x40e2a6
cmp byte [0x42b849], bl
je 0x40e016
cmp byte [0x42b84a], bl
je 0x40dfef
push str.Launcher:_Reboot_in_progress__using_MoveFileEx_to_cleanup_file:
lea ecx, [ebp - 0x2c]
call fcn.0040e496
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.0040e510
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0040a0b9
pop ecx
mov byte [ebp - 4], 1
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0040e4dc
push 4
push ebx
lea ecx, [ebp - 0x3c]
call fcn.0040ed7f
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push eax
call esi
push 4
push ebx
lea ecx, [ebp - 0x4c]
call fcn.0040ed7f
push eax
call esi
jmp 0x40e2a6
lea eax, [ebp - 0x1c]
push eax
call fcn.0040cba5
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 5
push eax
call fcn.0040cc51
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.0040e3f3
cmp byte [0x42b84a], bl
mov byte [ebp - 4], 6
je 0x40e068
push str.Launcher:_Cleanup_batch_file_called:
lea ecx, [ebp - 0x2c]
call fcn.0040e4f6
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040e510
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0040a0b9
pop ecx
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040ed7f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 0x2e
lea ecx, [ebp - 0x1c]
call fcn.0040ef04
mov esi, eax
cmp esi, dword [0x422380]
je 0x40e0a0
lea ecx, [ebp - 0x1c]
call fcn.0040ed91
sub eax, esi
lea ecx, [ebp - 0x1c]
push eax
push esi
call fcn.0040e9da
push str..bat
lea ecx, [ebp - 0x1c]
call fcn.0040e51c
push 0x429c44
lea ecx, [ebp - 0x1c]
call fcn.0040ed7f
push eax
call fcn.00412116
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x40e28e
push str.:Repeat_n
push esi
call fcn.004128b1
cmp byte [0x42b84a], bl
pop ecx
pop ecx
je 0x40e103
mov ecx, 0x42b838
call fcn.0040ed7f
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040ed7f
push eax
push str._echo_Deleting__s_from_within_batch_file._____s_n
push esi
call fcn.004128b1
add esp, 0x10
push edi
lea ecx, [ebp - 0x3c]
call fcn.0040ed7f
mov edi, str.del___s__n
push eax
push edi
push esi
call fcn.004128b1
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.0040ed7f
push eax
push str.if_exist___s__goto_Repeat_n
push esi
call fcn.004128b1
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.0040ed91
test eax, eax
jbe 0x40e16b
cmp byte [0x42b848], bl
lea ecx, [ebp - 0x4c]
je 0x40e157
call fcn.0040ed7f
push eax
push str.rmdir___s__n
jmp 0x40e162
call fcn.0040ed7f
push eax
push str.rmdir__q___s__n
push esi
call fcn.004128b1
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0040ed7f
push eax
push edi
push esi
call fcn.004128b1
add esp, 0xc
cmp byte [0x42b84a], bl
pop edi
je 0x40e1a9
mov ecx, 0x42b838
call fcn.0040ed7f
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040ed7f
push eax
push str._echo_Deleted_batch_file__s_from_within_batch_file._____s_n
push esi
call fcn.004128b1
add esp, 0x10
push esi
call fcn.004119f1
push 0x44
lea eax, [ebp - 0xb0]
pop esi
push esi
push ebx
push eax
call fcn.00411400
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0x84], 1
mov word [ebp - 0x80], bx
call fcn.0040e3f3
cmp byte [0x42b848], bl
mov byte [ebp - 4], 7
mov esi, 0x428d90
je 0x40e1f7
push str.COMMAND__C__
jmp 0x40e1f8
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040e4f6
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x5c]
push eax
call fcn.0040e510
push esi
lea ecx, [ebp - 0x5c]
call fcn.0040e51c
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0x428d94
push ebx
push 0x54
push ebx
push ebx
push ebx
call fcn.0040ed7f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e282
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x68]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x68]
call esi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 6
call fcn.0040e4dc
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0040e4dc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0040e4dc
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.0040e4dc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0040e4dc
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret