Function at 0x4049e9
Capabilities:
Create process on windows
Get common file path
Get system information on windows
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push 0xdf4
mov eax, 0x4111c0
call fcn.00410c01
mov ebx, ecx
push 0x56
pop ecx
mov esi, 0x4029a8
mov dword [ebp - 0xd70], 0x11c
lea edi, [ebp - 0x63c]
rep movsd dword es:[edi], dword [esi]
push 0x118
lea eax, [ebp - 0xd6c]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
mov dword [ebp - 0xd78], esi
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0xdfc]
mov dword [ebp - 0xe00], 0x44
push esi
push eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0xd84], 0x825
mov dword [ebp - 0xd88], esi
mov dword [ebp - 0xd80], esi
push 0x208
lea eax, [ebp - 0x2d8]
mov dword [ebp - 4], esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0x2d8]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x2d8]
push eax
push esi
push 0x402b04
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x404d2e
push esi
push esi
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x404d2e
cmp esi, 0xffffffff
je 0x404d2e
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
push eax
push 0x158
lea eax, [ebp - 0x63c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404d2e
lea ecx, [ebp - 0xd88]
call fcn.0040e62d
test eax, eax
js 0x404b50
push dword [ebp - 0xd88]
lea eax, [ebp - 0x74]
push 0x402b0c
push 0x32
push eax
call fcn.00404da3
lea ecx, [ebp - 0x74]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd78]
jne 0x404b24
xor eax, eax
sub ecx, edx
push eax
sar ecx, 1
lea eax, [ebp - 0xd74]
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xd70]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404bf7
lea eax, [ebp - 0xdbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xdbc], 9
mov eax, 0x402b1c
je 0x404b86
mov eax, 0x402be8
push eax
movzx eax, word [ebp - 0xc5a]
push eax
movzx eax, word [ebp - 0xc5c]
push eax
push dword [ebp - 0xd64]
lea eax, [ebp - 0xd0]
push dword [ebp - 0xd68]
push dword [ebp - 0xd6c]
push 0x402b2c
push 0x60
push eax
call fcn.00404da3
lea ecx, [ebp - 0xd0]
add esp, 0x24
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd78]
jne 0x404bc8
xor eax, eax
sub ecx, edx
push eax
sar ecx, 1
lea eax, [ebp - 0xd74]
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xd0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test ebx, ebx
je 0x404c5b
xor eax, eax
push eax
lea eax, [ebp - 0xd74]
push eax
push 6
push 0x402b58
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xd78]
jne 0x404c18
xor eax, eax
sub ecx, edx
push eax
sar ecx, 1
lea eax, [ebp - 0xd74]
push eax
lea eax, [ecx + ecx]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ebx, ebx
lea eax, [ebp - 0xd74]
push ebx
push eax
push 4
push 0x402b60
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x404c5d
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x4e0]
push eax
push 0x402b68
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub edi, eax
lea ecx, [ebp - 0x4e0]
push 0x402b90
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.00404d6e
mov esi, eax
test esi, esi
jns 0x404c9e
call fcn.0040d0d5
jmp 0x404d5d
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x4e0]
push eax
push 0x402bcc
lea eax, [ebp - 0xc54]
push 0x30c
push eax
call fcn.00404da3
mov esi, eax
add esp, 0x14
test esi, esi
js 0x404c94
lea eax, [ebp - 0xd98]
push eax
lea eax, [ebp - 0xe00]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404d2e
push 0xffffffffffffffff
push dword [ebp - 0xd98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xd7c]
push eax
push dword [ebp - 0xd98]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x404d2e
mov esi, dword [ebp - 0xd7c]
neg esi
sbb esi, esi
and esi, 0x80004005
jmp 0x404d48
call fcn.0040d0d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x404d4a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x404d5d
lea ecx, [ebp - 0xd88]
call fcn.0040c662
call fcn.00410b9e
ret
push 0x2a
pop edx
mov ecx, esi
call fcn.0040d066
int3