Function at 0x402930
Capabilities:
Create process on windows
Get comspec environment variable
Print debug messages
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x41f284]
xor eax, ebp
mov dword [ebp - 0x40], eax
push esi
push edi
push str.ProgSelfDel
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push 0x104
lea eax, [ebp - 0x250]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x402b97
push 0x104
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
test eax, eax
je 0x402b97
push 0x104
lea eax, [ebp - 0x358]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
je 0x402b97
mov ecx, dword [str._c_del]
mov dword [ebp - 0x148], ecx
mov edx, dword [0x421d8c]
mov dword [ebp - 0x144], edx
lea eax, [ebp - 0x250]
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
mov dword [ebp - 0x360], ecx
mov edx, dword [ebp - 0x35c]
mov al, byte [edx]
mov byte [ebp - 0x361], al
add dword [ebp - 0x35c], 1
cmp byte [ebp - 0x361], 0
jne 0x4029dc
mov ecx, dword [ebp - 0x35c]
sub ecx, dword [ebp - 0x360]
mov edx, dword [ebp - 0x360]
mov dword [ebp - 0x368], edx
mov dword [ebp - 0x36c], ecx
lea eax, [ebp - 0x148]
add eax, 0xffffffff
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x371], dl
add dword [ebp - 0x370], 1
cmp byte [ebp - 0x371], 0
jne 0x402a27
mov edi, dword [ebp - 0x370]
mov esi, dword [ebp - 0x368]
mov eax, dword [ebp - 0x36c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x378], str.___nul
mov ecx, dword [ebp - 0x378]
mov dword [ebp - 0x37c], ecx
mov edx, dword [ebp - 0x378]
mov al, byte [edx]
mov byte [ebp - 0x37d], al
add dword [ebp - 0x378], 1
cmp byte [ebp - 0x37d], 0
jne 0x402a7c
mov ecx, dword [ebp - 0x378]
sub ecx, dword [ebp - 0x37c]
mov edx, dword [ebp - 0x37c]
mov dword [ebp - 0x384], edx
mov dword [ebp - 0x388], ecx
lea eax, [ebp - 0x148]
add eax, 0xffffffff
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x38d], dl
add dword [ebp - 0x38c], 1
cmp byte [ebp - 0x38d], 0
jne 0x402ac7
mov edi, dword [ebp - 0x38c]
mov esi, dword [ebp - 0x384]
mov eax, dword [ebp - 0x388]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.Open
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x2c], ecx
lea edx, [ebp - 0x148]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x38], 0x8040
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x402b97
push 0x40
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push 0xf
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0
lea edx, [ebp - 0x250]
push edx
push 1
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov eax, 1
jmp 0x402b99
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.0040e98e
mov esp, ebp
pop ebp
ret