Function at 0x404e70
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Query environment variable
Set current directory
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3a8
push esi
push edi
push ebx
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
lea edi, [esi + 0x421]
push 0x400
lea eax, [ebp - 0x401]
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x400
push 0x40b44d
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push esi
mov esi, 0x40b44d
mov bl, 0
jmp 0x404ed9
lodsb al, byte [esi]
cmp al, 0x25
jne 0x404ed9
push 0x40b44d
call fcn.00405db0
push eax
push 0x40b44d
call sub.kernel32.dll_lstrcpyA
mov bl, 1
jmp 0x404ede
cmp byte [esi], 0
jne 0x404ebb
pop esi
mov edi, 0x40b44d
cmp byte [edi + 1], 0x3a
je 0x404f39
push 0x400
lea eax, [ebp - 0x401]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x401]
push eax
call fcn.00402086
cmp byte [edi], 0x5c
je 0x404f1f
push 0x40b31e
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x401]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
push 0x400
push 0x41acc1
push 5
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41acc1
call fcn.004020dc
push edi
call fcn.004020dc
cmp bl, 1
je 0x404f6e
test dword [esi + 0xd], 1
je 0x404fbb
cmp byte [0x40c094], 0
jne 0x404fb1
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x401]
push eax
call fcn.00402086
push edi
call fcn.00405db0
push eax
push dword [0x40b3e6]
lea eax, [ebp - 0x401]
push eax
push 0x40b320
push edi
call fcn.00405f60
jmp 0x404fb3
xor eax, eax
test al, al
je 0x4052c1
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405059
test dword [esi + 0xd], 0x10
je 0x404fd5
jmp 0x40502d
cmp byte [0x40c094], 0
jne 0x40500a
push 0x400
push 0x41b0c1
push 0x29
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x24
push edi
push 0x41b0c1
push dword [0x40b3e6]
call sub.user32.dll_MessageBoxA
jmp 0x40501f
cmp byte [0x40c096], 1
jne 0x40501a
mov eax, 6
jmp 0x40501f
mov eax, 7
cmp eax, 7
je 0x4052c1
cmp eax, 6
jne 0x405059
push 0x80
push edi
call sub.kernel32.dll_SetFileAttributesA
push 0x400
push 0x41b4c1
push 0x2a
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41b4c1
call fcn.004020dc
cmp byte [edi + 1], 0x3a
jne 0x40508a
cmp byte [edi + 2], 0x5c
jne 0x40508a
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x401]
push eax
call fcn.00402086
lea eax, [ebp - 0x401]
push eax
call fcn.00405fd0
mov eax, dword [esi + 5]
lea eax, [eax + esi]
push dword [esi + 1]
push eax
push edi
call fcn.00405ce4
or eax, eax
jne 0x4050d3
push edi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4052c1
push 0x400
push 0x41b8c1
push 0x2b
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41b8c1
call fcn.004020dc
jmp 0x4052c1
mov eax, dword [esi + 9]
or eax, eax
je 0x405107
push eax
push edi
call sub.kernel32.dll_SetFileAttributesA
cmp eax, 1
jne 0x405107
push 0x400
push 0x41bcc1
push 0x2c
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41bcc1
call fcn.004020dc
test dword [esi + 0xd], 2
je 0x40529c
push 0x400
push 0x41c0c1
push 0x2d
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41c0c1
call fcn.004020dc
cmp byte [edi + 1], 0x3a
jne 0x405160
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x401]
push eax
call fcn.00402086
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
lea ebx, [esi + 0x21]
cmp byte [ebx], 0
jne 0x40516c
xor ebx, ebx
jmp 0x405184
push 0x400
lea eax, [ebp - 0x801]
push eax
push ebx
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea ebx, [ebp - 0x801]
test dword [esi + 0xd], 4
je 0x40525a
push 0x44
lea eax, [ebp - 0xc48]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x10
lea eax, [ebp - 0xc58]
push eax
call sub.kernel32.dll_RtlZeroMemory
push 0x40b32f
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcpyA
cmp byte [edi + 1], 0x3a
je 0x4051f9
lea eax, [ebp - 0xc01]
push eax
push 0x400
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0xc01]
push eax
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
push 0x40b331
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
push 0x40b333
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
push ebx
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xc48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x401]
push eax
push edi
call sub.kernel32.dll_CreateProcessA
push 0xffffffffffffffff
push dword [ebp - 0xc58]
call sub.kernel32.dll_WaitForSingleObject
jmp 0x40526c
push 0xa
push 0
push ebx
push edi
push str.open
push 0
call sub.shell32.dll_ShellExecuteA
test dword [esi + 0xd], 8
je 0x40529c
push 0x400
push 0x41c4c1
push 0x2e
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41c4c1
call fcn.004020dc
push edi
call sub.kernel32.dll_DeleteFileA
push 0x400
push 0x41c8c1
push 0x2f
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41c8c1
call fcn.004020dc
mov byte [ebp - 1], 1
push 0x400
push 0x41ccc1
push 0xc
push dword [0x40b3e2]
call sub.user32.dll_LoadStringA
push 0x41ccc1
call fcn.004020dc
push 0x40b0ef
call fcn.004020dc
push edi
push str.dup2_last_file
call sub.kernel32.dll_SetEnvironmentVariableA
push edi
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x401]
push eax
call fcn.00402086
lea eax, [ebp - 0x401]
push eax
push str.dup2_last_path
call sub.kernel32.dll_SetEnvironmentVariableA
movzx eax, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret 4