Function at 0x40701a
Capabilities:
Create process on windows
Get common file path
Get system information on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe10
mov eax, dword [0x40900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x5f
pop ecx
mov esi, 0x407320
lea edi, [ebp - 0x654]
rep movsd dword es:[edi], dword [esi]
push 0x118
mov dword [ebp - 0xd90], eax
xor ebx, ebx
lea eax, [ebp - 0xd84]
push ebx
push eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd88], 0x11c
call sub.MSVCR80.dll_memset
push 0x40
lea eax, [ebp - 0xe0c]
push ebx
push eax
mov dword [ebp - 0xe10], 0x44
call sub.MSVCR80.dll_memset
push 0x206
lea eax, [ebp - 0x2ca]
push ebx
push eax
mov word [ebp - 0x2cc], bx
call sub.MSVCR80.dll_memset
add esp, 0x24
lea eax, [ebp - 0x2cc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x2cc]
push eax
push ebx
push 0x4074a0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4070ea
call fcn.004077b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4070e3
and eax, 0xffff
or eax, 0x80070000
mov edx, eax
jmp 0x407303
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0xd94], edi
je 0x4070ca
cmp edi, 0xffffffff
je 0x4070ca
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0xd8c]
push eax
push 0x17c
lea eax, [ebp - 0x654]
push eax
push edi
call esi
test eax, eax
je 0x4070ca
lea eax, [ebp - 0xd88]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4071d6
lea eax, [ebp - 0xdcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xdcc], 9
mov eax, 0x4074a8
je 0x40716a
mov eax, 0x405758
push eax
movzx eax, word [ebp - 0xc72]
push eax
movzx eax, word [ebp - 0xc74]
push eax
push dword [ebp - 0xd7c]
lea edi, [ebp - 0xc4]
push dword [ebp - 0xd80]
push dword [ebp - 0xd84]
push 0x4074b8
push 0x60
pop ecx
call fcn.00407572
mov eax, edi
add esp, 0x1c
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4071a8
sub eax, edx
push ebx
sar eax, 1
lea ecx, [ebp - 0xd8c]
push ecx
add eax, eax
push eax
lea eax, [ebp - 0xc4]
push eax
push dword [ebp - 0xd94]
call esi
mov edi, dword [ebp - 0xd94]
cmp dword [ebp - 0xd90], ebx
je 0x40722d
push ebx
lea eax, [ebp - 0xd8c]
push eax
push 6
push 0x4074e4
push edi
call esi
mov eax, dword [ebp - 0xd90]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x4071f9
sub eax, ecx
push ebx
sar eax, 1
lea ecx, [ebp - 0xd8c]
push ecx
add eax, eax
push eax
push dword [ebp - 0xd90]
push edi
call esi
push ebx
lea eax, [ebp - 0xd8c]
push eax
push 4
push 0x4074ec
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x104
push esi
lea eax, [ebp - 0x4d4]
push eax
push 0x4074f4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, esi
push 0x40751c
sub edx, eax
lea ecx, [ebp + eax*2 - 0x4d4]
call fcn.0040660e
mov edx, eax
cmp edx, ebx
jl 0x407293
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x4d4]
push eax
push 0x407558
mov ecx, 0x30c
lea edi, [ebp - 0xc6c]
call fcn.00407572
mov edx, eax
add esp, 0xc
cmp edx, ebx
jge 0x40729a
call fcn.004077b4
jmp 0x407303
lea eax, [ebp - 0xda8]
push eax
lea eax, [ebp - 0xe10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc6c]
push eax
lea eax, [ebp - 0x4d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4070ca
push 0xffffffffffffffff
push dword [ebp - 0xda8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xd98]
push eax
push dword [ebp - 0xda8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4070ca
mov edx, dword [ebp - 0xd98]
neg edx
sbb edx, edx
and edx, 0x80004005
pop edi
pop esi
cmp edx, ebx
pop ebx
jge 0x407312
push 0x2a
push edx
call fcn.00407740
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402824
leave
ret 4