Function at 0x405610
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
push 0xffffffffffffffff
push 0x419a72
mov eax, dword fs:[0]
push eax
sub esp, 0x878
mov eax, dword [0x422380]
xor eax, esp
mov dword [esp + 0x874], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x422380]
xor eax, esp
push eax
lea eax, [esp + 0x88c]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
call fcn.00406830
xor ebx, ebx
push eax
mov edi, str._lm_delself_.bat
lea esi, [esp + 0x74]
mov dword [esp + 0x89c], ebx
call fcn.004021e0
add esp, 8
mov ebp, 0x10
cmp dword [esp + 0x30], ebp
jb 0x405688
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0040bd0f
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
push 0x400
lea edx, [esp + 0x48c]
push ebx
push edx
mov byte [esp + 0x8a0], 3
call fcn.0040dc10
add esp, 0xc
push 0x400
lea eax, [esp + 0x48c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x400
lea ecx, [esp + 0x8c]
push ebx
push ecx
call fcn.0040dc10
add esp, 0xc
push 0x400
lea edx, [esp + 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [esp + eax + 0x87], 0x5c
je 0x405716
lea edi, [esp + 0x88]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x405705
mov ax, word [0x41f2bc]
mov word [edi], ax
lea ecx, [esp + 0x88]
push ecx
push str._sping.exe_127.0.0.1__n_2_r_n
lea esi, [esp + 0x20]
call fcn.004068d0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x8a0], 4
call fcn.004015d0
mov byte [esp + 0x894], 3
cmp dword [esp + 0x30], ebp
jb 0x40575f
mov edx, dword [esp + 0x1c]
push edx
call fcn.0040bd0f
add esp, 4
lea eax, [esp + 0x488]
push eax
push str.del___s__r_n
lea esi, [esp + 0x3c]
call fcn.004068d0
add esp, 8
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0x58]
mov byte [esp + 0x89c], 5
call fcn.004023a0
mov byte [esp + 0x894], 3
cmp dword [esp + 0x4c], ebp
jb 0x4057a9
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0040bd0f
add esp, 4
push 9
push str.del___0_r_n
lea eax, [esp + 0x58]
call fcn.00402290
push 0x14
call fcn.0040bdb2
add esp, 4
cmp eax, ebx
je 0x4057e8
mov dword [eax + 4], vtable.CPtrBase.0
mov dword [eax + 8], ebx
mov dword [eax], vtable.CDataObject.0
mov dword [eax + 4], vtable.CDataObject.1.0
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov esi, eax
jmp 0x4057ea
xor esi, esi
mov dword [esp + 0x14], esi
cmp esi, ebx
je 0x4057fa
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x894], 6
cmp dword [esp + 0x68], ebp
mov edi, dword [esp + 0x64]
mov ebp, dword [esp + 0x54]
jae 0x405814
lea ebp, [esp + 0x54]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x18]
push esi
call edx
cmp ebp, ebx
je 0x405844
cmp edi, ebx
je 0x405844
lea eax, [edi + 0xa]
push eax
call fcn.00406dad
push edi
push ebp
push eax
mov dword [esi + 0xc], eax
call fcn.0040dc90
mov ecx, dword [esi + 0xc]
mov byte [edi + ecx], bl
add esp, 0x10
mov dword [esi + 0x10], edi
mov eax, dword [esp + 0x70]
mov edi, 0x10
cmp dword [esp + 0x84], edi
jae 0x40585a
lea eax, [esp + 0x70]
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x20]
push esi
call eax
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x84], edi
jae 0x405874
lea eax, [esp + 0x70]
push ebx
push ebx
push 0x41f1e5
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [esp + 0x894], 3
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
cmp dword [esp + 0x68], edi
jb 0x4058b1
mov eax, dword [esp + 0x54]
push eax
call fcn.0040bd0f
add esp, 4
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x84], edi
jb 0x4058d7
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0040bd0f
add esp, 4
mov ecx, dword [esp + 0x88c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x874]
xor ecx, esp
call fcn.0040bd00
add esp, 0x884
ret