Function at 0x40aede
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x44b4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.0042f640
push esi
lea eax, [ebp - 0x426]
push edi
push eax
mov word [ebp - 0x428], di
call fcn.0042f640
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b27a
push esi
lea eax, [ebp - 0x428]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40b27a
lea eax, [ebp - 0x4b8]
call fcn.0040e48d
push 7
pop esi
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x4b8]
push eax
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x468], edi
mov word [ebp - 0x478], di
call fcn.0040e4f3
test al, al
jne 0x40af9f
push edi
push 1
jmp 0x40b264
lea eax, [ebp - 0x444]
push str..bat
push eax
lea eax, [ebp - 0x47c]
call fcn.00404e91
pop ecx
pop ecx
lea eax, [ebp - 0x444]
lea ecx, [ebp - 0x47c]
call fcn.0040d167
test al, al
jne 0x40afd5
xor ebx, ebx
inc ebx
jmp 0x40b255
lea eax, [ebp - 0x4b8]
call fcn.0040ddac
push str.if_not_exist__
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x44c], edi
mov word [ebp - 0x45c], di
call fcn.00404938
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.00404938
push str.___del__0___else__ping_127.0.0.1__n_2del__
lea eax, [ebp - 0x460]
push eax
call fcn.00404938
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.00404938
push str.__0_
lea eax, [ebp - 0x460]
push eax
call fcn.00404938
lea esi, [ebp - 0x4bc]
call fcn.0040e74c
lea eax, [ebp - 0x444]
call fcn.0040e789
test al, al
jne 0x40b075
mov eax, esi
call fcn.0040e764
xor ebx, ebx
inc ebx
jmp 0x40b248
lea ecx, [ebp - 0x460]
lea eax, [ebp - 0x498]
call fcn.0040e470
mov ebx, dword [ebp - 0x484]
cmp ebx, edi
je 0x40b22d
cmp dword [ebp - 0x480], 0x10
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x4c0], edi
jae 0x40b0af
lea eax, [ebp - 0x494]
push eax
lea esi, [ebp - 0x4c0]
mov edi, ebx
lea eax, [ebp - 0x4bc]
call fcn.0040e7c1
test al, al
je 0x40b22b
cmp dword [ebp - 0x4c0], ebx
jne 0x40b22b
lea esi, [ebp - 0x4bc]
call fcn.0040e7f3
test al, al
je 0x40b22b
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x4fc]
push 0
push eax
call fcn.0042f640
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x518]
push eax
mov eax, str._c__
mov dword [ebp - 0x4fc], esi
mov dword [ebp - 0x4f0], str.Open
call fcn.00404e5a
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x444]
push ecx
xor ebx, ebx
call fcn.004010b8
xor edi, edi
push edi
inc ebx
push ebx
lea esi, [ebp - 0x518]
call fcn.00401140
push 0x43fed8
lea eax, [ebp - 0x444]
push eax
call fcn.00404938
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
jae 0x40b16d
lea eax, [ebp - 0x440]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4fc]
push eax
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4f8], 0x8040
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40b230
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x4c4]
call esi
test eax, eax
je 0x40b230
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40b230
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
push edi
lea ecx, [ebp - 0x498]
push ebx
je 0x40b238
call fcn.00402de5
lea eax, [ebp - 0x4bc]
call fcn.0040e764
push edi
push ebx
lea esi, [ebp - 0x460]
call fcn.00401140
push edi
push ebx
lea esi, [ebp - 0x444]
call fcn.00401140
push edi
push ebx
lea esi, [ebp - 0x47c]
call fcn.00401140
lea eax, [ebp - 0x4b8]
call fcn.0040e4a0
mov al, bl
jmp 0x40b27c
xor edi, edi
xor ebx, ebx
inc ebx
push edi
push ebx
lea ecx, [ebp - 0x498]
call fcn.00402de5
lea eax, [ebp - 0x4bc]
call fcn.0040e764
push edi
push ebx
lea esi, [ebp - 0x460]
call fcn.00401140
push edi
push ebx
lea esi, [ebp - 0x444]
call fcn.00401140
push edi
push ebx
lea esi, [ebp - 0x47c]
call fcn.00401140
lea eax, [ebp - 0x4b8]
call fcn.0040e4a0
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f583
leave
ret