Function at 0x409c57
Capabilities:
Copy file
Create process on windows
Get comspec environment variable
Query environment variable
Self delete
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, 0x401148
push edi
push 0x20
push 0x401124
push 0x210
push esi
call fcn.00408b05
push 0x20
call fcn.00402779
pop ecx
push edi
push eax
push 0x200
push esi
mov dword [0x40ca8c], eax
call fcn.004088f4
mov ebx, 0x1000
push ebx
push dword [0x40caa8]
call fcn.0040278d
mov esi, 0x9b4
mov dword [0x40caa8], eax
push esi
push dword [0x40caa4]
call fcn.0040278d
push esi
push edi
push eax
mov dword [0x40caa4], eax
call fcn.00402647
add esp, 0x1c
mov ebp, 0x800
push ebp
push dword [0x40caa8]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x20
push dword [0x40ca8c]
mov esi, 0x4017b8
push 0x30
push esi
call fcn.00408b05
push edi
push 0x20
push dword [0x40ca8c]
push 0x30
push 0x4017e8
call fcn.00408b05
push edi
push esi
call fcn.004093f4
push 0x290
push dword [0x40ca8c]
mov dword [0x40ca98], eax
push 0x40ca9c
push 0x401528
call fcn.00409aab
push 0x110
push dword [0x40ca8c]
mov dword [0x40caa0], eax
push 0x40c638
push 0x401818
call fcn.00409aab
push ebx
mov dword [0x40cab4], eax
call fcn.00402779
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
pop ecx
push ebp
push esi
push 0x4020f0
call ebx
test eax, eax
jne 0x409d7e
push ebp
push esi
push 0x40210c
call ebx
test eax, eax
jne 0x409d7e
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
call ebp
push dword [0x40caa8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push dword [0x40caa8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
test eax, eax
je 0x409dc9
call fcn.00409333
test eax, eax
jne 0x409dc8
push edi
push esi
push dword [0x40caa8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x409dce
push esi
call fcn.00409610
push 0x1000
call fcn.00402779
pop ecx
mov esi, 0x800
mov edi, eax
push esi
push edi
push 0x40211c
call ebx
test eax, eax
jne 0x409e00
push esi
push edi
push 0x40212c
call ebx
test eax, eax
jne 0x409e00
push eax
jmp 0x409d78
push 0x98
push dword [0x40cab0]
call fcn.0040278d
push 0x40
push dword [0x40caac]
mov dword [0x40cab0], eax
call fcn.0040278d
add esp, 0x10
mov dword [0x40caac], eax
push 0
push 0x20
push dword [0x40ca8c]
call fcn.00402828
push eax
call fcn.004093f4
push 0
push 0x4017e8
mov dword [0x40caac], eax
call fcn.004093f4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
push dword [0x40cab0]
call esi
push 0x1000
call fcn.00402779
pop ecx
mov ebx, eax
push edi
push ebx
call esi
push ebx
call ebp
push dword [0x40caac]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0xa
pop esi
push ebx
call fcn.00409b37
mov edi, eax
test edi, edi
je 0x409e9b
push 0x3e8
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jle 0x409ea3
test edi, edi
jne 0x409e83
cmp esi, 1
jge 0x409eaf
push 1
jmp 0x409d78
push dword [0x401928]
push dword [0x40ca94]
call fcn.0040278d
push dword [0x401928]
mov dword [0x40ca94], eax
push dword [0x401144]
push eax
call fcn.00402625
push dword [0x401930]
push dword [0x40ca90]
call fcn.0040278d
push dword [0x401930]
mov dword [0x40ca90], eax
push dword [0x40192c]
push eax
call fcn.00402625
add esp, 0x28
push 0x40c640
push dword [0x40caa4]
call fcn.0040998f
call fcn.00409435
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.004094f5