Function at 0x40af40
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x44c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
xor edi, edi
push esi
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.0042f6b0
push esi
lea eax, [ebp - 0x426]
push edi
push eax
mov word [ebp - 0x428], di
call fcn.0042f6b0
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b2dc
push esi
lea eax, [ebp - 0x428]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40b2dc
lea eax, [ebp - 0x4b8]
call fcn.0040dd8f
push 7
pop esi
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x4b8]
push eax
mov dword [ebp - 0x464], esi
mov dword [ebp - 0x468], edi
mov word [ebp - 0x478], di
call fcn.0040e238
test al, al
jne 0x40b001
push edi
push 1
jmp 0x40b2c6
lea eax, [ebp - 0x444]
push str..bat
push eax
lea eax, [ebp - 0x47c]
call fcn.00404efd
pop ecx
pop ecx
lea eax, [ebp - 0x444]
lea ecx, [ebp - 0x47c]
call fcn.0040d1c9
test al, al
jne 0x40b037
xor ebx, ebx
inc ebx
jmp 0x40b2b7
lea eax, [ebp - 0x4b8]
call fcn.0040e1f7
push str.if_not_exist__
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x44c], edi
mov word [ebp - 0x45c], di
call fcn.00404949
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.00404949
push str.___del__0___else__ping_127.0.0.1__n_2del__
lea eax, [ebp - 0x460]
push eax
call fcn.00404949
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.00404949
push str.__0_
lea eax, [ebp - 0x460]
push eax
call fcn.00404949
lea esi, [ebp - 0x4bc]
call fcn.0040d78c
lea eax, [ebp - 0x444]
call fcn.0040e4b6
test al, al
jne 0x40b0d7
mov eax, esi
call fcn.0040e491
xor ebx, ebx
inc ebx
jmp 0x40b2aa
lea ecx, [ebp - 0x460]
lea eax, [ebp - 0x498]
call fcn.0040ebf2
mov ebx, dword [ebp - 0x484]
cmp ebx, edi
je 0x40b28f
cmp dword [ebp - 0x480], 0x10
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x4c0], edi
jae 0x40b111
lea eax, [ebp - 0x494]
push eax
lea esi, [ebp - 0x4c0]
mov edi, ebx
lea eax, [ebp - 0x4bc]
call fcn.0040e4ee
test al, al
je 0x40b28d
cmp dword [ebp - 0x4c0], ebx
jne 0x40b28d
lea esi, [ebp - 0x4bc]
call fcn.0040e520
test al, al
je 0x40b28d
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x4fc]
push 0
push eax
call fcn.0042f6b0
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x518]
push eax
mov eax, str._c__
mov dword [ebp - 0x4fc], esi
mov dword [ebp - 0x4f0], str.Open
call fcn.00404ec6
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x444]
push ecx
xor ebx, ebx
call fcn.004010d7
xor edi, edi
push edi
inc ebx
push ebx
lea esi, [ebp - 0x518]
call fcn.0040115f
push 0x440ed8
lea eax, [ebp - 0x444]
push eax
call fcn.00404949
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
jae 0x40b1cf
lea eax, [ebp - 0x440]
mov dword [ebp - 0x4e8], eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x4ec], eax
lea eax, [ebp - 0x4fc]
push eax
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4f8], 0x8040
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40b292
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x4c4]
call esi
test eax, eax
je 0x40b292
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x40b292
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
push edi
lea ecx, [ebp - 0x498]
push ebx
je 0x40b29a
call fcn.00402e04
lea eax, [ebp - 0x4bc]
call fcn.0040e491
push edi
push ebx
lea esi, [ebp - 0x460]
call fcn.0040115f
push edi
push ebx
lea esi, [ebp - 0x444]
call fcn.0040115f
push edi
push ebx
lea esi, [ebp - 0x47c]
call fcn.0040115f
lea eax, [ebp - 0x4b8]
call fcn.0040e1e1
mov al, bl
jmp 0x40b2de
xor edi, edi
xor ebx, ebx
inc ebx
push edi
push ebx
lea ecx, [ebp - 0x498]
call fcn.00402e04
lea eax, [ebp - 0x4bc]
call fcn.0040e491
push edi
push ebx
lea esi, [ebp - 0x460]
call fcn.0040115f
push edi
push ebx
lea esi, [ebp - 0x444]
call fcn.0040115f
push edi
push ebx
lea esi, [ebp - 0x47c]
call fcn.0040115f
lea eax, [ebp - 0x4b8]
call fcn.0040e1e1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f5f3
leave
ret