Function at 0x427100
Capabilities:
Create process on windows
Delete file
Set environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x158
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x148], 0
mov rax, qword [0x0042beb8]
mov byte [rax], 1
nop
lea rcx, [0x00424040]
call fcn.0040cc70
nop
lea rcx, [0x00435350]
lea rdx, [0x00423a90]
call fcn.0040c480
mov rax, qword [0x0042bc10]
mov dword [rax], 0
mov rcx, qword [0x00423ad0]
mov dl, 1
call fcn.00423bc0
mov qword [0x00435358], rax
mov rcx, qword [0x00435358]
lea rdx, [0x004275ac]
call fcn.00423dd0
test al, al
je 0x4274de
mov rax, qword [0x00435358]
mov rcx, qword [rax + 0x60]
lea rdx, [0x00435314]
mov rax, qword [0x00435358]
movsxd r8, dword [rax + 0x68]
call fcn.00405150
mov rcx, qword [0x00435358]
call fcn.00423cb0
mov rcx, qword [0x00435358]
lea rdx, [0x004275c4]
call fcn.00423dd0
test al, al
je 0x4274aa
lea rcx, [rbp + 0x90]
call fcn.0040e490
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x90]
call fcn.0040e3b0
lea rcx, [0x00435338]
mov rdx, qword [rbp + 0x98]
call fcn.00408c30
lea rcx, [rbp + 0x80]
lea rdx, [0x00435314]
call fcn.00409570
lea rcx, [rbp + 0x88]
mov rdx, qword [0x00435338]
mov r8, qword [rbp + 0x80]
call fcn.0040e040
lea rcx, [0x00435340]
mov rdx, qword [rbp + 0x88]
call fcn.00408c30
mov rcx, qword [0x00435358]
mov rdx, qword [0x00435340]
call fcn.00423cd0
lea rcx, [rbp + 0x78]
lea rdx, [0x00423a80]
call fcn.0040c480
mov rcx, qword [rbp + 0x78]
call fcn.00409410
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.0040e630
mov rcx, qword [rbp + 0x70]
call fcn.00409410
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_SetEnvironmentVariableW
lea rcx, [rbp + 0x68]
mov rax, qword [0x0042be30]
mov rdx, qword [rax]
call fcn.00409490
lea rcx, [0x00435350]
mov edx, 5
lea r8, [0x004275e0]
mov r9, qword [0x00435340]
lea rax, [0x00427608]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [0x0042761c]
mov qword [rsp + 0x30], rax
call fcn.00409870
lea rcx, [rbp + 0x148]
mov rdx, qword [0x00435350]
call fcn.00408cb0
lea rcx, [rbp + 0x128]
mov edx, 0x18
xor r8, r8
call fcn.00405a60
lea rcx, [rbp + 0xc0]
mov edx, 0x68
xor r8, r8
call fcn.00405a60
mov dword [rbp + 0x128], 0x18
mov qword [rbp + 0x130], 0
mov dword [rbp + 0xc0], 0x68
mov dword [rbp + 0xfc], 1
mov word [rbp + 0x100], 0
mov dword [rbp + 0x138], 0
xor rbx, rbx
mov rcx, qword [rbp + 0x148]
call fcn.00409410
xor rcx, rcx
mov rdx, rax
lea r8, [rbp + 0x128]
lea r9, [rbp + 0x128]
test bl, bl
setne al
movzx rax, al
neg eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
cmp byte [rax], al
add byte [rax], al
add byte [rax - 0x73], cl
test eax, eax
add byte [rax], al
add byte [rax - 0x77], cl
and al, 0x40
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x42744b
lea rcx, [rbp + 0x60]
lea rdx, [0x00423ab0]
call fcn.0040c480
mov rcx, qword [0x0042bd00]
mov rdx, qword [rbp + 0x60]
call fcn.004063b0
mov rcx, rax
call fcn.00406510
call fcn.004050c0
jmp 0x427485
mov rcx, qword [rbp + 0xa8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0x144]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0xa8]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0xb0]
call sub.kernel32.dll_CloseHandle_1
mov rax, qword [0x0042bc10]
mov ecx, dword [rbp + 0x144]
mov dword [rax], ecx
mov rcx, qword [0x00435340]
call fcn.00409410
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x42750b
lea rcx, [rbp + 0x58]
lea rdx, [0x00423aa0]
call fcn.0040c480
mov rcx, qword [rbp + 0x58]
call fcn.00409410
xor rcx, rcx
mov rdx, rax
lea r8, [0x00427620]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x42750b
lea rcx, [rbp + 0x50]
lea rdx, [0x00423ac0]
call fcn.0040c480
mov rcx, qword [0x0042bd00]
mov rdx, qword [rbp + 0x50]
call fcn.004063b0
mov rcx, rax
call fcn.00406510
call fcn.004050c0
mov rcx, qword [0x00435358]
call fcn.00406830
nop
lea rcx, [rbp + 0x50]
mov edx, 0xa
call fcn.00408800
lea rcx, [rbp + 0x148]
call fcn.00408720
call fcn.004083d0
jmp 0x427542
lea rsp, [rbp + 0x158]
pop rbx
pop rbp
ret