Function at 0x408500
Capabilities:
Accept command line arguments
Execute command
Get common file path
Set current directory
Set environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, 0x6858
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00402090
sub esp, eax
mov eax, dword [ecx]
lea ebx, [ebp - 0x6838]
mov dword [ebp - 0x684c], eax
call fcn.00401a20
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], 0x20000
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call sub.msvcrt.dll__setmode
call sub.KERNEL32.dll_GetCommandLineW
lea edx, [ebp - 0x683c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.SHELL32.DLL_CommandLineToArgvW
push edx
push edx
mov dword [esp + 4], 0x40a11e
mov dword [esp], str.SEE_MASK_NOZONECHECKS
mov dword [ebp - 0x6850], eax
call sub.KERNEL32.dll_SetEnvironmentVariableW
push ecx
push ecx
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call sub.KERNEL32.dll_GetWindowsDirectoryW
push esi
push esi
lea esi, [ebp - 0x6220]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._sSystem32mshta.exe
mov dword [esp], ebx
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], ebx
mov dword [esp], str.mshtaPath:__s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleW
push edi
lea edi, [ebp - 0x2018]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x104
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameW
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], str.GetModuleFileName_s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], esi
call dword [sym.imp.SHLWAPI.DLL_PathRemoveFileSpecW]
push eax
mov dword [esp + 4], esi
lea esi, [ebp - 0x6630]
mov dword [esp], esi
call sub.msvcrt.dll_wcscpy
mov dword [esp + 4], esi
mov dword [esp], str.curdir_s_n
call sub.msvcrt.dll_wprintf
lea ecx, [ebp - 0x2018]
mov dword [esp + 4], 0x40a1da
mov dword [esp], ecx
call sub.msvcrt.dll_wcscpy
mov edx, 1
cmp dword [ebp - 0x684c], 1
jg 0x4086b7
lea eax, [ebp - 0x2018]
lea edi, [ebp - 0x6428]
mov dword [esp], eax
call sub.msvcrt.dll__putws
mov dword [esp], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str._s_bin
call sub.USER32.dll_wsprintfW
mov dword [esp], edi
call sub.KERNEL32.dll_SetCurrentDirectoryW
push eax
mov dword [esp + 4], edi
mov dword [esp], str.curdirBin:__s_n
call sub.msvcrt.dll_wprintf
lea eax, [ebp - 0x2018]
mov dword [esp + 8], edi
lea edi, [ebp - 0x6018]
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.__s_run.hta__s
mov dword [esp], edi
call sub.USER32.dll_wsprintfW
cmp word [ebp - 0x6428], 0x5c
je 0x40871c
jmp 0x40877a
mov dword [esp + 4], 0x40a226
mov dword [esp], edi
mov dword [ebp - 0x6854], edx
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x40a22a
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov edx, dword [ebp - 0x6854]
mov eax, dword [ebp - 0x6850]
mov eax, dword [eax + edx*4]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscat
mov dword [esp + 4], 0x40a22a
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
mov edx, dword [ebp - 0x6854]
inc edx
cmp edx, dword [ebp - 0x684c]
jne 0x4086b7
jmp 0x408643
cmp word [ebp - 0x6426], 0x5c
jne 0x40877a
mov dword [esp], esi
call sub.KERNEL32.dll_SetCurrentDirectoryW
push eax
mov dword [esp], str.NET_USE__Z:___DELETE__YES
call sub.msvcrt.dll__wsystem
mov dword [esp + 8], esi
lea esi, [ebp - 0x4018]
mov dword [esp + 4], str.SETLOCAL_ENABLEEXTENSIONS_ENABLEDELAYEDEXPANSION__FOR__F__tokens2____D_IN__NET_USE____s___PERSISTENT:NOFINDSTR__I_unidad__DO_SET_DRIVELETTER__D
mov dword [esp], esi
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], esi
mov dword [esp], str.NetUse:__s_n
call sub.msvcrt.dll_wprintf
mov dword [esp], esi
call sub.msvcrt.dll__wsystem
mov dword [esp], str.Z:_bin_
call sub.KERNEL32.dll_SetCurrentDirectoryW
push eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0040147a
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret