Function at 0x428bf0
Capabilities:
Create process on windows
Delete file
Set environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x158
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x148], 0
mov rax, qword [0x0042e3c0]
mov byte [rax], 1
nop
lea rcx, [0x00425b30]
call fcn.0040d890
nop
lea rcx, [0x00438350]
lea rdx, [0x004252d0]
call fcn.0040d030
mov rax, qword [0x0042e110]
mov dword [rax], 0
mov rcx, qword [0x00425310]
mov dl, 1
call fcn.004256a0
mov qword [0x00438358], rax
mov rcx, qword [0x00438358]
lea rdx, [0x0042909c]
call fcn.004258b0
test al, al
je 0x428fce
mov rax, qword [0x00438358]
mov rcx, qword [rax + 0x60]
lea rdx, [0x00438314]
mov rax, qword [0x00438358]
movsxd r8, dword [rax + 0x68]
call fcn.00405190
mov rcx, qword [0x00438358]
call fcn.00425790
mov rcx, qword [0x00438358]
lea rdx, [0x004290b4]
call fcn.004258b0
test al, al
je 0x428f9a
lea rcx, [rbp + 0x90]
call fcn.0040f0b0
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x90]
call fcn.0040efd0
lea rcx, [0x00438338]
mov rdx, qword [rbp + 0x98]
call fcn.004094b0
lea rcx, [rbp + 0x80]
lea rdx, [0x00438314]
call fcn.00409ef0
lea rcx, [rbp + 0x88]
mov rdx, qword [0x00438338]
mov r8, qword [rbp + 0x80]
call fcn.0040ec60
lea rcx, [0x00438340]
mov rdx, qword [rbp + 0x88]
call fcn.004094b0
mov rcx, qword [0x00438358]
mov rdx, qword [0x00438340]
call fcn.004257b0
lea rcx, [rbp + 0x78]
lea rdx, [0x004252c0]
call fcn.0040d030
mov rcx, qword [rbp + 0x78]
call fcn.00409d90
mov rbx, rax
lea rcx, [rbp + 0x70]
call fcn.0040f250
mov rcx, qword [rbp + 0x70]
call fcn.00409d90
mov rcx, rbx
mov rdx, rax
call sub.kernel32.dll_SetEnvironmentVariableW
lea rcx, [rbp + 0x68]
mov rax, qword [0x0042e338]
mov rdx, qword [rax]
call fcn.00409e10
lea rcx, [0x00438350]
mov edx, 5
lea r8, [0x004290d0]
mov r9, qword [0x00438340]
lea rax, [0x004290f8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [0x0042910c]
mov qword [rsp + 0x30], rax
call fcn.0040a1f0
lea rcx, [rbp + 0x148]
mov rdx, qword [0x00438350]
call fcn.00409530
lea rcx, [rbp + 0x128]
mov edx, 0x18
xor r8, r8
call fcn.00405aa0
lea rcx, [rbp + 0xc0]
mov edx, 0x68
xor r8, r8
call fcn.00405aa0
mov dword [rbp + 0x128], 0x18
mov qword [rbp + 0x130], 0
mov dword [rbp + 0xc0], 0x68
mov dword [rbp + 0xfc], 1
mov word [rbp + 0x100], 0
mov dword [rbp + 0x138], 0
xor rbx, rbx
mov rcx, qword [rbp + 0x148]
call fcn.00409d90
xor rcx, rcx
mov rdx, rax
lea r8, [rbp + 0x128]
lea r9, [rbp + 0x128]
test bl, bl
setne al
movzx rax, al
neg eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x428f3b
lea rcx, [rbp + 0x60]
lea rdx, [0x004252f0]
call fcn.0040d030
mov rcx, qword [0x0042e208]
mov rdx, qword [rbp + 0x60]
call fcn.004063f0
mov rcx, rax
call fcn.00406550
call fcn.00405100
jmp 0x428f75
mov rcx, qword [rbp + 0xa8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov rcx, qword [rbp + 0xa8]
lea rdx, [rbp + 0x144]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0xa8]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0xb0]
call sub.kernel32.dll_CloseHandle_1
mov rax, qword [0x0042e110]
mov ecx, dword [rbp + 0x144]
mov dword [rax], ecx
mov rcx, qword [0x00438340]
call fcn.00409d90
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
jmp 0x428ffb
lea rcx, [rbp + 0x58]
lea rdx, [0x004252e0]
call fcn.0040d030
mov rcx, qword [rbp + 0x58]
call fcn.00409d90
xor rcx, rcx
mov rdx, rax
lea r8, [0x00429110]
mov r9d, 0x30
call sub.user32.dll_MessageBoxW
jmp 0x428ffb
lea rcx, [rbp + 0x50]
lea rdx, [0x00425300]
call fcn.0040d030
mov rcx, qword [0x0042e208]
mov rdx, qword [rbp + 0x50]
call fcn.004063f0
mov rcx, rax
call fcn.00406550
call fcn.00405100
mov rcx, qword [0x00438358]
call fcn.00406a30
nop
lea rcx, [rbp + 0x50]
mov edx, 0xa
call fcn.00409060
lea rcx, [rbp + 0x148]
call fcn.00408f80
call fcn.00408c30
jmp 0x429032
lea rsp, [rbp + 0x158]
pop rbx
pop rbp
ret