Function at 0x409a60
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x547570]
mov ecx, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
push ebx
push esi
test ecx, ecx
push edi
mov dword [ebp - 0x10], eax
je 0x409acb
mov edx, ecx
shr edx, 0x10
jne 0x409a94
xor eax, eax
mov ax, cx
lea ecx, [ebp - 0x10]
push eax
call fcn.00413ae0
jmp 0x409acb
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x409acb
push esi
lea ecx, [ebp - 0x10]
call fcn.00405530
test eax, eax
je 0x409acb
mov edi, dword [ebp - 0x10]
lea ecx, [esi + esi]
mov edx, ecx
mov esi, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x547570]
mov ecx, str._selfdestruct.bat
test ecx, ecx
mov dword [ebp - 8], eax
jne 0x409ae6
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
jmp 0x409af3
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str._selfdestruct.bat
call ebx
push str._selfdestruct.bat
push eax
mov eax, dword [0x55e100]
lea ecx, [ebp - 8]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.004059f0
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00405440
lea ecx, [ebp - 8]
call fcn.00405700
mov edx, dword [0x554e0c]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x440], edx
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0x81
lea edi, [ebp - 0x644]
mov dword [ebp - 0x648], edx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x440]
push ecx
push 0x104
call esi
lea edx, [ebp - 0x648]
push edx
push 0x104
call esi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
push eax
push ecx
call fcn.00532eca
add esp, 8
lea edx, [ebp - 0x238]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x547570]
push ecx
mov edi, esp
lea ecx, [ebp - 0x238]
test ecx, ecx
mov dword [edi], eax
je 0x409c11
lea edx, [ebp - 0x238]
shr edx, 0x10
jne 0x409bdd
xor eax, eax
lea ecx, [ebp - 0x238]
mov ax, cx
mov ecx, edi
push eax
call fcn.00413ae0
jmp 0x409c11
lea edx, [ebp - 0x238]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x409c11
push esi
mov ecx, edi
call fcn.00405530
test eax, eax
je 0x409c11
mov edi, dword [edi]
lea ecx, [esi + esi]
mov eax, ecx
lea esi, [ebp - 0x238]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00509050
add esp, 8
lea edx, [ebp - 0x440]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x409e84
mov eax, dword [0x547570]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
push ecx
push eax
push eax
lea eax, [ebp - 4]
push edx
push eax
call fcn.00405cb0
mov ecx, 0x547cf4
add esp, 0x14
test ecx, ecx
je 0x409e10
push ecx
call ebx
mov ebx, eax
test ebx, ebx
je 0x409e10
mov edx, 0x547cec
test edx, edx
jne 0x409c91
mov dword [ebp - 8], edx
jmp 0x409c9f
push 0x547cec
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 4]
xor edi, edi
mov eax, dword [esi - 8]
lea eax, [esi + eax*2]
cmp esi, eax
mov dword [ebp - 0xc], eax
jae 0x409e13
push 0x547cf4
push esi
call fcn.0053225f
add esp, 8
test eax, eax
je 0x409cdd
lea esi, [eax + ebx*2]
push 0x547cf4
push esi
inc edi
call fcn.0053225f
add esp, 8
test eax, eax
jne 0x409cc7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x409cb5
test edi, edi
jle 0x409e10
lea ecx, [ebp - 4]
call fcn.004055c0
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
sub eax, ebx
imul eax, edi
mov ecx, dword [esi - 8]
mov dword [ebp - 0x14], ecx
add eax, ecx
mov ecx, dword [esi - 4]
mov dword [ebp - 0x20], eax
cmp ecx, eax
jl 0x409d22
cmp dword [esi - 0xc], 1
jle 0x409d5e
lea edi, [esi - 0xc]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.00405530
test eax, eax
je 0x409e10
mov ecx, dword [edi + 4]
mov edi, dword [ebp - 4]
shl ecx, 1
mov edx, ecx
mov eax, dword [ebp - 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00405590
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi - 8]
lea ecx, [esi + ecx*2]
cmp esi, ecx
mov dword [ebp - 0xc], ecx
jae 0x409e0d
push 0x547cf4
push esi
call fcn.0053225f
mov edi, eax
add esp, 8
test edi, edi
je 0x409df1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, edi
sub edx, eax
mov eax, dword [ebp - 0x14]
sar edx, 1
sub eax, edx
lea esi, [ecx + ecx]
sub eax, ebx
lea edx, [edi + ebx*2]
add eax, eax
lea ecx, [esi + edi]
push eax
push edx
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
call fcn.00532360
mov ecx, esi
mov esi, 0x547cec
mov eax, ecx
mov edx, dword [ebp - 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x14]
and ecx, 3
sub edx, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, edx
push 0x547cf4
push esi
mov word [ecx + esi], 0
mov dword [ebp - 0x14], eax
call fcn.0053225f
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x409d83
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x409d6f
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [esi - 8], eax
mov esi, dword [ebp - 4]
test esi, esi
jne 0x409e1b
xor eax, eax
jmp 0x409e41
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00532230
mov eax, esp
push 0
push edi
push esi
push eax
call fcn.00409eb0
mov esi, dword [ebp - 4]
mov edx, dword [esi - 8]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x648]
push 0
push eax
lea ecx, [ebp - 0x440]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.00405700
lea ecx, [ebp - 0x1c]
call fcn.00405700
lea ecx, [ebp - 0x18]
call fcn.00405700
lea ecx, [ebp - 0x10]
call fcn.00405700
lea esp, [ebp - 0x654]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret