Function at 0x406270
Capabilities:
Create process on windows
Delete file
Get common file path
Move file
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22a8
call fcn.004449d0
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
mov dword [ebp - 0x2248], 0
call fcn.0043dc80
add esp, 4
push edx
push eax
push 0x4748d2
push str._s_t_d
lea edx, [ebp - 0xc28]
call fcn.00409730
add esp, 0x10
push 0x468fdc
lea eax, [ebp - 0xc28]
push eax
lea ecx, [ebp - 0x2248]
mov edx, edi
call fcn.00404a00
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, eax
test esi, esi
jne 0x406360
mov ecx, dword [edi + 4]
push 0x40
push 0x468bd4
push 0x468fe8
push ecx
call ebx
lea edx, [ebp - 0x620]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x620]
push eax
push 0x469010
lea edx, [ebp - 0xe30]
call fcn.004096f0
lea ecx, [ebp - 0xe30]
push ecx
lea ecx, [ebp - 0x2248]
call fcn.00404f20
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x406360
push str.._list.txt
lea edx, [ebp - 0x828]
call fcn.004096f0
lea edx, [ebp - 0x828]
add esp, 4
push edx
lea ecx, [ebp - 0x2248]
call fcn.00404f20
add esp, 4
mov esi, eax
push 0x800
lea eax, [ebp - 0x2240]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x2240]
push 0x4743b2
push ecx
call fcn.0043e342
add esp, 8
test eax, eax
jne 0x4063bb
push 0x40
push 0x468bd4
push str.veQhV
mov edx, dword [edi + 4]
push edx
call ebx
push 0
push 0
push 0x12
mov ecx, edi
call fcn.0040d569
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x40640d
mov ecx, dword [edi + 0x504]
push 0x64
call fcn.004124f9
mov ecx, dword [edi + 0x50c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
push 0x469060
call edx
push 0x40
push 0x468bd4
push 0x469078
mov eax, dword [edi + 4]
push eax
call ebx
push 0
push 0
push 0x12
mov ecx, edi
call fcn.0040d569
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x418]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.0043dc80
add esp, 4
push edx
push eax
lea edx, [ebp - 0x418]
push edx
push 0x46909c
lea edx, [ebp - 0x210]
call fcn.004096f0
lea eax, [ebp - 0x418]
push eax
push 0x469010
lea edx, [ebp - 0x1240]
call fcn.004096f0
push 0x468f10
lea ecx, [ebp - 0x1240]
push ecx
lea edx, [ebp - 0x224c]
push edx
call fcn.0043ee1f
add esp, 0x24
test eax, eax
jne 0x4064ac
mov eax, dword [ebp - 0x224c]
mov ecx, dword [ebp - 0x2248]
push eax
push ecx
push 1
push esi
call fcn.0043efbd
mov edx, dword [ebp - 0x224c]
push edx
call fcn.0043f1c1
mov eax, dword [ebp - 0x224c]
add esp, 0x14
push eax
call fcn.0043f28a
add esp, 4
push 0x468f10
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x224c]
push edx
call fcn.0043ee1f
add esp, 0xc
test eax, eax
jne 0x406508
mov eax, dword [ebp - 0x224c]
mov ecx, dword [ebp - 0x2248]
push eax
push ecx
push 1
push esi
call fcn.0043efbd
mov edx, dword [ebp - 0x224c]
push edx
call fcn.0043f1c1
mov eax, dword [ebp - 0x224c]
add esp, 0x14
push eax
call fcn.0043f28a
add esp, 4
mov byte [ebp - 0x2241], 1
jmp 0x40650f
mov byte [ebp - 0x2241], 0
push esi
call fcn.0043dc24
add esp, 4
cmp byte [ebp - 0x2241], 0
jne 0x406550
mov ecx, dword [edi + 4]
push 0x40
push 0x468bd4
push 0x4690b8
push ecx
call ebx
push 0
push 0
push 0x12
mov ecx, edi
call fcn.0040d569
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043db8a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
mov esi, edi
call fcn.00406870
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
xor esi, esi
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x4744b2
call fcn.0043e876
add esp, 4
cmp eax, dword [edi + 0x518]
jge 0x406745
push esi
mov dword [ebp - 0x2248], esi
call fcn.0043dc80
add esp, 4
push edx
push eax
lea ecx, [edi + 0x520]
push ecx
push str._s_t_d
lea edx, [ebp - 0xc28]
call fcn.00409730
add esp, 0x10
push 0x4690d4
lea edx, [ebp - 0xc28]
push edx
lea ecx, [ebp - 0x2248]
mov edx, edi
call fcn.00404a00
mov esi, eax
mov dword [ebp - 0x224c], esi
test esi, esi
jne 0x406615
mov ecx, dword [edi + 0x504]
push 0x64
call fcn.004124f9
mov ecx, dword [edi + 0x50c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
push 0x4690e4
call edx
push 0x40
push 0x468bd4
push 0x4690fc
jmp 0x4063ea
push 0x468f10
lea ecx, [ebp - 0x2250]
push str.._Launcher.new
push ecx
call fcn.0043ee1f
add esp, 0xc
test eax, eax
jne 0x406657
mov ecx, dword [ebp - 0x2248]
mov edx, dword [ebp - 0x224c]
lea esi, [ebp - 0x2250]
call fcn.00404e90
mov esi, dword [ebp - 0x224c]
mov byte [ebp - 0x2241], al
jmp 0x40665e
mov byte [ebp - 0x2241], 0
push esi
call fcn.0043dc24
add esp, 4
cmp byte [ebp - 0x2241], 0
jne 0x406681
push 0x40
push 0x468bd4
push 0x469120
jmp 0x406398
mov ecx, dword [edi + 0x50c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
push 0x469138
call edx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44
lea eax, [ebp - 0x22a8]
push 0
push eax
call fcn.004426d0
add esp, 0xc
lea ecx, [ebp - 0x620]
push ecx
push 0x104
mov dword [ebp - 0x22a8], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x104
lea edx, [ebp - 0x828]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x620]
push ecx
push str._sLauncher.new__update___s_
lea edx, [ebp - 0x1038]
call fcn.00409750
add esp, 0xc
lea edx, [ebp - 0x2260]
push edx
lea eax, [ebp - 0x22a8]
push eax
lea ecx, [ebp - 0x620]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1038]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0x12
mov ecx, edi
call fcn.0040d569
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x200
lea eax, [ebp - 0xc28]
push esi
push eax
call fcn.004426d0
add esp, 0xc
push esi
mov dword [ebp - 0x2248], esi
call fcn.0043dc80
add esp, 4
push edx
push eax
push 0x475782
push str._s_t_d
lea edx, [ebp - 0xc28]
call fcn.00409730
add esp, 0x10
push str.kernel_script_files
lea ecx, [ebp - 0xc28]
push ecx
lea ecx, [ebp - 0x2248]
mov edx, edi
call fcn.00404a00
mov ebx, eax
cmp ebx, esi
je 0x406828
push esi
call fcn.0043dc80
add esp, 4
lea edx, [ebp - 0x418]
push edx
push 0x104
mov dword [0x477048], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x477048]
push eax
lea ecx, [ebp - 0x418]
push ecx
push str._sverify_d.txt
lea edx, [ebp - 0x210]
call fcn.004096f0
add esp, 0xc
push 0x468f10
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x2250]
push eax
call fcn.0043ee1f
add esp, 0xc
test eax, eax
jne 0x40681f
mov ecx, dword [ebp - 0x2248]
lea esi, [ebp - 0x2250]
mov edx, ebx
call fcn.00404e90
push ebx
call fcn.0043dc24
add esp, 4
push edi
call fcn.004069b0
mov ecx, dword [edi + 0x50c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x4691e4
call eax
mov ecx, dword [edi + 0x4c8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
push 1
call eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db8a
mov esp, ebp
pop ebp
ret