Function at 0x40d20d
Capabilities:
Create process on windows
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 2]
lea ecx, [ebp - 0x70]
push eax
push 0x4108cc
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
push str.Temp
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
push eax
lea eax, [ebp - 0x60]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_char_const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 0xc
lea ecx, [ebp - 0x60]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 1
push 0x10
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::constructor_char_const___int_]
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_bool___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::is_open_void_const]
test al, al
je 0x40d35c
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0xfc]
push eax
call sub.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
pop ecx
pop ecx
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::close_void_]
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x40
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
setne byte [ebp - 2]
cmp dword [ebp - 0x18], esi
mov edi, 0x415a78
je 0x40d33e
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str.remscriptexecd
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, edi
call fcn.00402198
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp byte [ebp - 2], 1
jne 0x40d37a
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str.remscriptsuccess
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, edi
jmp 0x40d375
sub esp, 0x10
lea eax, [ebp - 1]
mov ecx, esp
push eax
push str.remscripterr
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov ecx, 0x415a78
call fcn.00402198
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_ofstream_char__struct_std::char_traits_char__::vbase_dtor_void_]
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp + 0x18]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
leave
ret