Function at 0x4026c3
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x48]
push ebx
sub esp, 0x8c
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
lea ecx, [ebp - 0x78]
mov dword [esp], eax
call fcn.0040166c
push ecx
mov dword [esp + 0x10], 0xa
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.0040248a
lea eax, [ebp - 0x78]
mov dword [esp + 8], str.hi_003_
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004b0a78
lea ebx, [ebp - 0x30]
lea eax, [ebp - 0x60]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004b0990
mov dword [esp], ebx
mov ecx, 0x51609c
call fcn.004015ce
mov ecx, ebx
push edx
call fcn.0049cec0
lea ecx, [ebp - 0x60]
call fcn.0049cec0
mov ecx, esi
call fcn.0049cec0
mov dword [esp], str.temp:_n
call fcn.00401540
mov eax, dword [0x51609c]
mov dword [esp], eax
call fcn.00401540
mov dword [esp], 0x4be2d9
call fcn.00401540
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x51609c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
push eax
push eax
lea eax, [ebp - 0x78]
mov dword [esp + 8], str._config.exe
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004b0a78
mov dword [esp], ebx
mov ecx, 0x516054
call fcn.004015ce
mov ecx, ebx
push eax
call fcn.0049cec0
lea eax, [ebp - 0x78]
mov dword [esp + 8], str._config.inf
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004b0a78
mov dword [esp], ebx
mov ecx, 0x51606c
call fcn.004015ce
mov ecx, ebx
push eax
call fcn.0049cec0
mov dword [esp + 8], str._config.lnk
mov dword [esp + 4], 0x51609c
mov dword [esp], ebx
call fcn.004b0a78
mov dword [esp], ebx
mov ecx, 0x516084
call fcn.004015ce
mov ecx, ebx
push eax
call fcn.0049cec0
mov dword [esp], 0x516054
mov ecx, ebx
call fcn.004a0100
push edi
mov dword [esp + 4], ebx
mov dword [esp], 0x65
call fcn.004016e7
mov ecx, ebx
call fcn.0049cec0
mov dword [esp + 4], 0x5160cc
mov dword [esp], 0x51606c
call fcn.004020d2
lea eax, [ebp - 0x60]
mov dword [esp + 8], 0x51606c
mov dword [esp + 4], str._s__
mov dword [esp], eax
call fcn.004b09f4
mov dword [esp], 0x4be25b
lea ecx, [ebp - 0x60]
call fcn.0049e310
push edx
mov ecx, esi
mov dword [esp], eax
call fcn.0049fea0
push ecx
mov eax, dword [0x516054]
mov ecx, ebx
mov dword [esp], eax
call fcn.0040166c
push edi
lea eax, [ebp - 0x78]
mov dword [esp + 0xc], 0x516084
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004017db
mov ecx, ebx
call fcn.0049cec0
mov ecx, esi
call fcn.0049cec0
lea ecx, [ebp - 0x60]
call fcn.0049cec0
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4be1f4
mov dword [esp + 0xc], edx
mov eax, dword [0x51609c]
mov dword [esp + 4], 0x4be307
mov dword [esp + 8], eax
mov dword [esp], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
sub esp, 0x18
mov edi, 0x3c
cmp eax, 0x20
jbe 0x402971
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x401570
call dword [sym.imp.USER32.dll_EnumWindows]
push eax
push eax
cmp byte [ebp - 0x2c], 0
mov dword [ebp - 0x48], 0x1f4
mov dword [ebp - 0x44], 0
mov dword [esp], esi
je 0x402969
call fcn.0047aba0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x402269
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
sub esp, 0xc
jmp 0x402971
call fcn.0047aba0
dec edi
jne 0x402914
xor eax, eax
mov dword [ebp - 0x30], 0x7d0
mov dword [ebp - 0x2c], eax
mov dword [esp], ebx
call fcn.0047aba0
mov eax, dword [0x51606c]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov dword [esp], eax
call esi
push eax
mov eax, dword [0x516054]
mov dword [esp], eax
call esi
push edi
mov eax, dword [0x516084]
mov dword [esp], eax
call esi
push ecx
lea eax, [ebp - 0x78]
mov dword [esp + 8], 0x4be30c
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004b0a78
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call esi
push edx
mov ecx, ebx
call fcn.0049cec0
mov eax, dword [0x51609c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
push eax
lea ecx, [ebp - 0x78]
call fcn.0049cec0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret