Function at 0x40a487
Capabilities:
Copy file
Create process on windows
Get comspec environment variable
Query environment variable
Self delete
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, 0x401158
push edi
push 0x20
push 0x401134
push 0x210
push esi
call fcn.00409392
push 0x20
call fcn.00402839
pop ecx
push edi
push eax
push 0x200
push esi
mov dword [0x40d2bc], eax
call fcn.00409149
mov ebx, 0x1000
push ebx
push dword [0x40d2d8]
call fcn.0040284d
mov esi, 0x9b4
mov dword [0x40d2d8], eax
push esi
push dword [0x40d2d4]
call fcn.0040284d
push esi
push edi
push eax
mov dword [0x40d2d4], eax
call fcn.00402707
add esp, 0x1c
mov ebp, 0x800
push ebp
push dword [0x40d2d8]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x20
push dword [0x40d2bc]
mov esi, 0x4017c8
push 0x30
push esi
call fcn.00409392
push edi
push 0x20
push dword [0x40d2bc]
push 0x30
push 0x4017f8
call fcn.00409392
push edi
push esi
call fcn.00409c8e
push 0x290
push dword [0x40d2bc]
mov dword [0x40d2c8], eax
push 0x40d2cc
push 0x401538
call fcn.0040a2db
push 0x110
push dword [0x40d2bc]
mov dword [0x40d2d0], eax
push 0x40ce68
push 0x401828
call fcn.0040a2db
push ebx
mov dword [0x40d2e4], eax
call fcn.00402839
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
pop ecx
push ebp
push esi
push 0x4021b0
call ebx
test eax, eax
jne 0x40a5ae
push ebp
push esi
push 0x4021cc
call ebx
test eax, eax
jne 0x40a5ae
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
call ebp
push dword [0x40d2d8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push dword [0x40d2d8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
test eax, eax
je 0x40a5f9
call fcn.00409bcd
test eax, eax
jne 0x40a5f8
push edi
push esi
push dword [0x40d2d8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a5fe
push esi
call fcn.00409eaa
push 0x1000
call fcn.00402839
pop ecx
mov esi, 0x800
mov edi, eax
push esi
push edi
push 0x4021dc
call ebx
test eax, eax
jne 0x40a630
push esi
push edi
push 0x4021ec
call ebx
test eax, eax
jne 0x40a630
push eax
jmp 0x40a5a8
push 0x98
push dword [0x40d2e0]
call fcn.0040284d
push 0x40
push dword [0x40d2dc]
mov dword [0x40d2e0], eax
call fcn.0040284d
add esp, 0x10
mov dword [0x40d2dc], eax
push 0
push 0x20
push dword [0x40d2bc]
call fcn.004028e8
push eax
call fcn.00409c8e
push 0
push 0x4017f8
mov dword [0x40d2dc], eax
call fcn.00409c8e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push eax
push dword [0x40d2e0]
call esi
push 0x1000
call fcn.00402839
pop ecx
mov ebx, eax
push edi
push ebx
call esi
push ebx
call ebp
push dword [0x40d2dc]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0xa
pop esi
push ebx
call fcn.0040a367
mov edi, eax
test edi, edi
je 0x40a6cb
push 0x3e8
dec esi
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jle 0x40a6d3
test edi, edi
jne 0x40a6b3
cmp esi, 1
jge 0x40a6df
push 1
jmp 0x40a5a8
push dword [0x401938]
push dword [0x40d2c4]
call fcn.0040284d
push dword [0x401938]
mov dword [0x40d2c4], eax
push dword [0x401154]
push eax
call fcn.004026e5
push dword [0x401940]
push dword [0x40d2c0]
call fcn.0040284d
push dword [0x401940]
mov dword [0x40d2c0], eax
push dword [0x40193c]
push eax
call fcn.004026e5
add esp, 0x28
push 0x40ce70
push dword [0x40d2d4]
call fcn.0040a1bf
call fcn.00409ccf
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00409d8f