Function at 0x408340
Capabilities:
Accept command line arguments
Create process on windows
Execute command
Get common file path
Set current directory
Set environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, 0x6868
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00401ee0
sub esp, eax
mov eax, dword [ecx]
mov dword [ebp - 0x684c], eax
call fcn.00401870
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x20000
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll__setmode
call sub.KERNEL32.dll_GetCommandLineW
lea edx, [ebp - 0x683c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.SHELL32.DLL_CommandLineToArgvW
push ebx
push ebx
lea ebx, [ebp - 0x6838]
mov dword [esp + 4], 0x40a064
mov dword [esp], 0x40a068
mov dword [ebp - 0x6850], eax
call sub.KERNEL32.dll_SetEnvironmentVariableW
push esi
push esi
lea esi, [ebp - 0x6220]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call sub.KERNEL32.dll_GetWindowsDirectoryW
push edi
push edi
lea edi, [ebp - 0x2018]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sSystem32mshta.exe
mov dword [esp], ebx
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], ebx
mov dword [esp], str.mshtaPath:__s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleW
push edx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameW
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], str.GetModuleFileName_s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
push ecx
mov dword [esp + 4], esi
lea esi, [ebp - 0x6630]
mov dword [esp], esi
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], esi
mov dword [esp], str.curdir_s_n
call sub.msvcrt.dll_wprintf
lea ecx, [ebp - 0x2018]
mov dword [esp + 4], 0x40a120
mov dword [esp], ecx
call sub.msvcrt.dll_wcscpy
mov edx, 1
cmp dword [ebp - 0x684c], 1
jg 0x4084f7
lea eax, [ebp - 0x2018]
lea edi, [ebp - 0x6428]
mov dword [esp], eax
call sub.msvcrt.dll__putws
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_bin
call sub.USER32.dll_wsprintfW
mov dword [esp], edi
call sub.KERNEL32.dll_SetCurrentDirectoryW
push ecx
mov dword [esp + 4], edi
mov dword [esp], str.curdirBin:__s_n
call sub.msvcrt.dll_wprintf
lea eax, [ebp - 0x2018]
mov dword [esp + 8], edi
lea edi, [ebp - 0x6018]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.__sTools_run.hta__s
mov dword [esp], edi
call sub.USER32.dll_wsprintfW
cmp word [ebp - 0x6428], 0x5c
je 0x40855c
jmp 0x4085ba
mov dword [esp + 4], 0x40a178
mov dword [esp], edi
mov dword [ebp - 0x6854], edx
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x40a17c
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov edx, dword [ebp - 0x6854]
mov eax, dword [ebp - 0x6850]
mov eax, dword [eax + edx*4]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x40a17c
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov edx, dword [ebp - 0x6854]
inc edx
cmp edx, dword [ebp - 0x684c]
jne 0x4084f7
jmp 0x408483
cmp word [ebp - 0x6426], 0x5c
jne 0x4085ba
mov dword [esp], esi
call sub.KERNEL32.dll_SetCurrentDirectoryW
push eax
mov dword [esp], str.NET_USE__Z:___DELETE__YES
call sub.msvcrt.dll__wsystem
mov dword [esp + 8], esi
lea esi, [ebp - 0x4018]
mov dword [esp + 4], str.SETLOCAL_ENABLEEXTENSIONS_ENABLEDELAYEDEXPANSION__FOR__F__tokens2____D_IN__NET_USE____s___PERSISTENT:NOFINDSTR__I_unidad__DO_SET_DRIVELETTER__D
mov dword [esp], esi
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], esi
mov dword [esp], str.NetUse:__s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], esi
call sub.msvcrt.dll__wsystem
mov dword [esp], str.Z:_bin_
call sub.KERNEL32.dll_SetCurrentDirectoryW
push edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0x40a180
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteW
sub esp, 0x18
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], str.Executed:__s__s_n
call sub.msvcrt.dll_wprintf
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret