Function at 0x40e0c0
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x521f89
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x55e5f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040db30
movzx eax, al
test eax, eax
je 0x40e125
mov dword [ebp - 0x66c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406090
mov eax, dword [ebp - 0x66c]
jmp 0x40e375
push 4
lea ecx, [ebp - 0x62c]
call fcn.00408cf0
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x62c]
call fcn.0040c170
mov byte [ebp - 4], 1
push 0x529a74
lea edx, [ebp - 0x62c]
push edx
push 0x529a78
lea eax, [ebp - 0x684]
push eax
call fcn.0040c890
add esp, 0xc
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0x674], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x674]
push edx
lea eax, [ebp - 0x680]
push eax
call fcn.0040c7d0
add esp, 0xc
mov dword [ebp - 0x678], eax
mov ecx, dword [ebp - 0x678]
mov dword [ebp - 0x67c], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x67c]
push edx
lea ecx, [ebp - 0x62c]
call fcn.0040c570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x680]
call fcn.00406090
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x684]
call fcn.00406090
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40e347
push 0x104
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40e347
push 0x104
lea eax, [ebp - 0x628]
push eax
push 0x529a7c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40e347
push 0x529a8c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str._c_ping__n_1_127.0.0.1_nulrd__s__q
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x62c]
call fcn.004076f0
push eax
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.___nul
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x668], 0x3c
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], str.Open
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x658], ecx
lea edx, [ebp - 0x218]
mov dword [ebp - 0x654], edx
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x664], 0x40
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e347
push 0x40
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
call fcn.005020cd
mov dword [ebp - 0x688], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x62c]
call fcn.00406090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406090
mov eax, dword [ebp - 0x688]
jmp 0x40e375
mov dword [ebp - 0x68c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x62c]
call fcn.00406090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00406090
mov eax, dword [ebp - 0x68c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4e42
mov esp, ebp
pop ebp
ret