Function at 0x40ead4
Capabilities:
Create process on windows
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x49e
push 0
push 0
dec ecx
jne 0x40eadc
push ecx
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x68]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push ebp
push 0x40f1bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2478]
xor eax, eax
call fcn.004027c8
mov eax, dword [ebp - 0x2478]
lea edx, [ebp - 0x2474]
call fcn.00406e44
mov eax, dword [ebp - 0x2474]
lea edx, [ebp - 0x10]
call fcn.0040dec4
lea eax, [ebp - 0x68]
call fcn.0040ea98
test al, al
je 0x40ebd0
lea eax, [ebp - 0x14]
call fcn.0040df48
mov eax, dword [ebp - 0x14]
call fcn.00406cb4
test al, al
jne 0x40eb7b
lea eax, [ebp - 0x247c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x40f1d8
call fcn.00403ce0
mov ecx, dword [ebp - 0x247c]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
mov edx, 0x40
mov eax, dword [ebp - 0x14]
call fcn.00406af0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40ebc5
push 0x40f204
push dword [ebp - 0x14]
push 0x40f218
lea eax, [ebp - 0x2480]
mov edx, 3
call fcn.00403d54
mov ecx, dword [ebp - 0x2480]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
mov ebx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x54]
jmp 0x40ec85
lea edx, [ebp - 0x2484]
mov eax, dword [ebp - 0x10]
call fcn.0040de40
mov edx, dword [ebp - 0x2484]
lea eax, [ebp - 0x14]
mov ecx, 0x40f244
call fcn.00403ce0
mov eax, dword [ebp - 0x14]
call fcn.00406cb4
test al, al
jne 0x40ec27
lea eax, [ebp - 0x2488]
mov ecx, dword [ebp - 0x10]
mov edx, 0x40f254
call fcn.00403ce0
mov ecx, dword [ebp - 0x2488]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
mov edx, 0x40
mov eax, dword [ebp - 0x14]
call fcn.00406af0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40ec71
push 0x40f204
push dword [ebp - 0x14]
push 0x40f218
lea eax, [ebp - 0x248c]
mov edx, 3
call fcn.00403d54
mov ecx, dword [ebp - 0x248c]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
xor ebx, ebx
mov ecx, 2
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.00406c04
mov esi, eax
dec esi
push 0x105
lea eax, [ebp - 0x223d]
push eax
push 0x40f2ac
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x40ece0
push 0x105
lea eax, [ebp - 0x223d]
push eax
push 0x40f2b4
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jne 0x40ece0
lea edx, [ebp - 0x2490]
mov eax, 0x4b5
call fcn.00406ad4
mov ecx, dword [ebp - 0x2490]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
lea eax, [ebp - 0x223d]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
test eax, eax
jne 0x40ed0b
mov ecx, 0x40f2c0
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
lea eax, [ebp - 0x2342]
push eax
push 0
push 0x40f300
lea eax, [ebp - 0x223d]
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebp - 0x2342]
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x2494]
lea eax, [ebp - 0x2342]
call fcn.004071b4
mov eax, dword [ebp - 0x2494]
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.00406da4
lea edx, [ebp - 0x2498]
mov eax, dword [ebp - 0xc]
call fcn.00406810
cmp dword [ebp - 0x2498], 0
jne 0x40ed7f
mov ecx, 0x40f2c0
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
mov eax, dword [ebp - 0xc]
call fcn.00407060
test al, al
jne 0x40ed99
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x223d]
call fcn.004071b4
mov eax, dword [ebp - 0xc]
call fcn.0040e64c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x40edb5
cmp dword [ebp - 0x30], 0xffffffff
jbe 0x40ee0a
jmp 0x40edb7
jle 0x40ee0a
cmp dword [ebp - 0x2c], 0
jne 0x40edc8
cmp dword [ebp - 0x30], 0x7a1200
jae 0x40ee0a
jmp 0x40edca
jge 0x40ee0a
mov dword [ebp - 0x24a8], 0x7a1200
mov byte [ebp - 0x24a4], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24a0], eax
mov byte [ebp - 0x249c], 0xb
lea eax, [ebp - 0x24a8]
push eax
push 1
mov ecx, 0x40f30c
mov dl, 1
mov eax, dword [0x405d10]
call fcn.0040886c
call fcn.00403474
xor eax, eax
push ebp
push 0x40f14e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x1c]
call fcn.00406c04
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2138]
mov edx, ebx
mov eax, dword [ebp - 0x1c]
call fcn.0040df58
cmp dword [ebp - 0x20], 0
jne 0x40ee54
mov ecx, 0x40f3b4
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
lea eax, [ebp - 0x2138]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 0x1c]
call fcn.0040e6e4
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x2120]
call fcn.00403c5c
lea edx, [ebp - 0x24ac]
mov eax, dword [ebp - 0x18]
call fcn.00406e84
mov eax, dword [ebp - 0x24ac]
push eax
lea edx, [ebp - 0x24b0]
mov eax, dword [ebp - 0xc]
call fcn.0040de40
mov edx, dword [ebp - 0x24b0]
lea eax, [ebp - 8]
pop ecx
call fcn.00403ce0
mov eax, dword [ebp - 8]
call fcn.00406cb4
test al, al
jne 0x40eefb
lea eax, [ebp - 0x24b4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24bc], eax
mov byte [ebp - 0x24b8], 0xb
lea edx, [ebp - 0x24bc]
xor ecx, ecx
mov eax, 0x40f428
call fcn.00407654
mov ecx, dword [ebp - 0x24b4]
mov dl, 1
mov eax, dword [0x405d10]
call fcn.00408824
call fcn.00403474
test byte [0x412858], 2
je 0x40ef5e
push dword [ebp - 8]
push 0x40f484
lea eax, [ebp - 0x24c4]
call fcn.0040df48
mov eax, dword [ebp - 0x24c4]
lea edx, [ebp - 0x24c0]
call fcn.00406e84
push dword [ebp - 0x24c0]
push 0x40f498
lea edx, [ebp - 0x24c8]
mov eax, dword [ebp - 0x10]
call fcn.0040dec4
push dword [ebp - 0x24c8]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 6
call fcn.00403d54
jmp 0x40efef
lea eax, [ebp - 0x68]
call fcn.0040ea98
test al, al
je 0x40efc1
push dword [ebp - 8]
push 0x40f4b4
lea eax, [ebp - 0x24d0]
call fcn.0040df48
mov eax, dword [ebp - 0x24d0]
lea edx, [ebp - 0x24cc]
call fcn.00406e84
push dword [ebp - 0x24cc]
push 0x40f4c4
lea edx, [ebp - 0x24d4]
mov eax, dword [ebp - 0x10]
call fcn.0040dec4
push dword [ebp - 0x24d4]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 6
call fcn.00403d54
jmp 0x40efef
push dword [ebp - 8]
push 0x40f4d4
lea edx, [ebp - 0x24d8]
mov eax, dword [ebp - 0x10]
call fcn.0040dec4
push dword [ebp - 0x24d8]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403d54
test byte [0x412858], 4
je 0x40f018
push dword [ebp - 4]
push 0x40f4e4
push dword [0x412864]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403d54
test byte [0x412858], 1
je 0x40f041
push dword [ebp - 4]
push 0x40f4e4
push dword [0x41285c]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403d54
test byte [0x412858], 8
je 0x40f06a
push dword [ebp - 4]
push 0x40f4e4
push dword [0x412868]
push 0x40f4a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403d54
lea eax, [ebp - 0x246f]
mov edx, dword [ebp - 4]
call fcn.00407104
push 5
lea eax, [ebp - 0x246f]
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
cmp ebx, 0x20
jge 0x40f138
lea eax, [ebp - 0x24]
mov edx, 0x40f4f0
call fcn.00403aac
mov eax, ebx
sub eax, 2
je 0x40f0bc
dec eax
je 0x40f0cb
sub eax, 8
jne 0x40f0d8
lea eax, [ebp - 0x24]
mov edx, 0x40f500
call fcn.00403aac
jmp 0x40f0d8
lea eax, [ebp - 0x24]
mov edx, 0x40f524
call fcn.00403aac
jmp 0x40f0d8
lea eax, [ebp - 0x24]
mov edx, 0x40f550
call fcn.00403aac
lea edx, [ebp - 0x24f4]
lea eax, [ebp - 0x246f]
call fcn.004071b4
mov eax, dword [ebp - 0x24f4]
mov dword [ebp - 0x24f0], eax
mov byte [ebp - 0x24ec], 0xb
mov dword [ebp - 0x24e8], ebx
mov byte [ebp - 0x24e4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24e0], eax
mov byte [ebp - 0x24dc], 0xb
lea eax, [ebp - 0x24f0]
push eax
push 2
mov ecx, 0x40f57c
mov dl, 1
mov eax, dword [0x405d10]
call fcn.0040886c
call fcn.00403474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f155
mov eax, dword [ebp - 0x1c]
call fcn.00406c30
ret