Function at 0x406b40
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4146a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
push esi
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.SystemDrive
mov dword [esp + 0x90], 3
call esi
add esp, 4
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::CString_3
push 0x41e088
mov byte [esp + 0x90], 4
call esi
add esp, 4
lea ecx, [esp + 0xc]
push eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0xc]
mov byte [esp + 0x8c], 5
call sub.MFC42u.DLL_CString::MakeUpper
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_1
push str.MININT
lea ecx, [esp + 0x10]
mov byte [esp + 0x90], 6
call sub.MFC42u.DLL_CString::Find_2
or esi, 0xffffffff
cmp eax, esi
jne 0x406c1a
push str.I386
lea ecx, [esp + 0x10]
call sub.MFC42u.DLL_CString::Find_2
cmp eax, esi
jne 0x406c1a
lea eax, [esp + 0x10]
push str.IBMTOOLS
lea ecx, [esp + 0x2c]
push eax
push ecx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x90], 8
call fcn.00413dfa
mov byte [esp + 0x8c], 6
lea ecx, [esp + 0x28]
jmp 0x406c4c
lea edx, [esp + 0x10]
push str.preboot
lea eax, [esp + 0x2c]
push edx
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x90], 7
call fcn.00413dfa
mov byte [esp + 0x8c], 6
lea ecx, [esp + 0x28]
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
push ecx
push str._sPython22python.exe
push edx
mov byte [esp + 0x98], 9
call sub.MFC42u.DLL_CString::Format
mov eax, dword [esp + 0x14]
add esp, 0xc
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406f3f
push edi
push str.utilslogger_setlogentry.pyc
lea ecx, [esp + 0x20]
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x1c]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x9c], 0xa
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x90], 0xc
call sub.MFC42u.DLL_CString::CString
push str.___r
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::CString_3
push str.___m__
lea ecx, [esp + 0x2c]
mov byte [esp + 0x94], 0xd
call sub.MFC42u.DLL_CString::CString_3
push str.__t__
lea ecx, [esp + 0x28]
mov byte [esp + 0x94], 0xe
call sub.MFC42u.DLL_CString::CString_3
push str.__a_RRU__e
lea ecx, [esp + 0x24]
mov byte [esp + 0x94], 0xf
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x98]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov byte [esp + 0x9c], 0x10
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x24]
lea edx, [esp + 0x44]
push ecx
push eax
push edx
mov byte [esp + 0x9c], 0x11
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x9c]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x9c], 0x12
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
push ecx
push eax
push edx
mov byte [esp + 0x9c], 0x13
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0xa0]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov byte [esp + 0x9c], 0x14
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x90], 0x15
push ecx
lea edx, [esp + 0x38]
push eax
push edx
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
mov byte [esp + 0x9c], 0x16
call sub.MFC42u.DLL_operator_3
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x94], 0x17
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x30]
mov byte [esp + 0x90], 0x16
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 0x15
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x90], 0x14
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x90], 0x13
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x90], 0x12
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x90], 0x11
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x90], 0x10
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x90], 0xf
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x90], 0xe
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x90], 0xd
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x90], 0xc
call sub.MFC42u.DLL_CString::CString
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x4c]
push str.utilslogger
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push eax
push ecx
mov dword [esp + 0x5c], 0x4440
mov dword [esp + 0x64], str.open
call sub.MFC42u.DLL_operator_1
mov eax, dword [eax]
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], eax
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x4c]
mov dword [esp + 0x5c], edx
push ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], 0
mov dword [esp + 0x50], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop edi
je 0x406f2e
mov eax, dword [esp + 0x80]
test eax, eax
je 0x406f2e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov byte [esp + 0x8c], 9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x8c], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x8c], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x8c], 4
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x8c], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x94]
mov byte [esp + 0x8c], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x98]
mov byte [esp + 0x8c], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x9c]
mov byte [esp + 0x8c], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xa0]
mov dword [esp + 0x8c], esi
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x84]
pop esi
mov dword fs:[0], ecx
add esp, 0x8c
ret