Function at 0x40b7f3
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x44e4f8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x208
xor ebx, ebx
push esi
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov word [ebp - 0x21c], bx
call fcn.00432520
push esi
lea eax, [ebp - 0x42a]
push ebx
push eax
mov word [ebp - 0x42c], bx
call fcn.00432520
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40bc21
push esi
lea eax, [ebp - 0x42c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40bc21
lea eax, [ebp - 0x4bc]
call fcn.0040e9eb
push 7
pop esi
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x4bc]
push eax
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x46c], ebx
mov word [ebp - 0x47c], bx
call fcn.0040ea55
test al, al
jne 0x40b8bd
push ebx
push 1
jmp 0x40bc0b
lea eax, [ebp - 0x448]
push str..bat
push eax
lea eax, [ebp - 0x480]
call fcn.00401fb4
pop ecx
pop ecx
lea eax, [ebp - 0x448]
lea ecx, [ebp - 0x480]
call fcn.0040d5d7
test al, al
jne 0x40b8fb
push ebx
push 1
lea esi, [ebp - 0x448]
call fcn.00401452
jmp 0x40b8b5
lea eax, [ebp - 0x4bc]
call fcn.0040ea14
push str.if_not_exist__
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x450], ebx
mov word [ebp - 0x460], bx
call fcn.0040201d
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.0040201d
push str.___del__0___else__ping_127.0.0.1__n_2del__
lea eax, [ebp - 0x464]
push eax
call fcn.0040201d
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.0040201d
push str.__0_
lea eax, [ebp - 0x464]
push eax
call fcn.0040201d
lea esi, [ebp - 0x4c0]
call fcn.0040d878
lea eax, [ebp - 0x448]
call fcn.0040ecd3
test al, al
jne 0x40b9a6
mov eax, esi
call fcn.0040ecae
push ebx
push 1
lea esi, [ebp - 0x464]
call fcn.00401452
jmp 0x40b8eb
lea ecx, [ebp - 0x464]
lea eax, [ebp - 0x49c]
call fcn.0040f421
mov edi, dword [ebp - 0x488]
cmp edi, ebx
je 0x40bbd4
cmp dword [ebp - 0x484], 0x10
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4c4], ebx
jae 0x40b9e0
lea eax, [ebp - 0x498]
push eax
lea esi, [ebp - 0x4c4]
lea eax, [ebp - 0x4c0]
call fcn.0040ed0b
test al, al
je 0x40bbd4
mov eax, edi
cmp dword [ebp - 0x4c4], eax
jne 0x40bbd4
lea esi, [ebp - 0x4c0]
call fcn.0040ed3d
test al, al
je 0x40bbd4
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x508]
push ebx
push eax
call fcn.00432520
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x524]
push eax
mov eax, str._c__
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x4fc], str.Open
call fcn.0040511c
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x448]
push ecx
xor ebx, ebx
call fcn.004016e9
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x524]
call fcn.00401452
push 0x442ef0
lea eax, [ebp - 0x448]
push eax
call fcn.0040201d
cmp dword [ebp - 0x430], 8
mov eax, dword [ebp - 0x444]
jae 0x40ba9d
lea eax, [ebp - 0x444]
mov ebx, dword [ebp - 0x4cc]
mov dword [ebp - 0x4f4], eax
lea eax, [ebp - 0x42c]
add ebx, 0x344
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4ec], edi
mov dword [ebp - 0x504], 0x8040
call fcn.00406719
mov eax, ebx
call fcn.00406715
mov esi, eax
xor ebx, ebx
call fcn.004011c7
test eax, eax
jbe 0x40bafd
push ebx
call fcn.00408f1c
push eax
call fcn.0040dc3f
pop ecx
mov eax, esi
inc ebx
call fcn.004011c7
cmp ebx, eax
jb 0x40bae4
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40bb4a
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x49c]
call fcn.004012ed
lea eax, [ebp - 0x4c0]
call fcn.0040ecae
push edi
push ebx
lea esi, [ebp - 0x464]
call fcn.00401452
push edi
push ebx
lea esi, [ebp - 0x448]
call fcn.00401452
push edi
push ebx
jmp 0x40bc0b
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x4d0]
call esi
test eax, eax
je 0x40bb0e
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40bb0e
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ebx, ebx
inc ebx
test eax, eax
push edi
lea ecx, [ebp - 0x49c]
push ebx
je 0x40bb19
call fcn.004012ed
lea eax, [ebp - 0x4c0]
call fcn.0040ecae
push edi
push ebx
lea esi, [ebp - 0x464]
call fcn.00401452
push edi
push ebx
lea esi, [ebp - 0x448]
call fcn.00401452
push edi
push ebx
lea esi, [ebp - 0x480]
call fcn.00401452
lea eax, [ebp - 0x4bc]
call fcn.0040e9fe
mov al, bl
jmp 0x40bc23
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x49c]
call fcn.004012ed
lea eax, [ebp - 0x4c0]
call fcn.0040ecae
push ebx
push edi
lea esi, [ebp - 0x464]
call fcn.00401452
push ebx
push edi
lea esi, [ebp - 0x448]
call fcn.00401452
push ebx
push edi
lea esi, [ebp - 0x480]
call fcn.00401452
lea eax, [ebp - 0x4bc]
call fcn.0040e9fe
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004322fb
leave
ret 4