Function at 0x401c70
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401bd0
push eax
push str.PR:_s
push 0x94e0e0
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push 0x94e0e0
call ebx
lea edi, [eax*2 + 0x94e0e2]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x401cdf
lea esp, [esp]
cmp word [esi], bp
je 0x401cdf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call ebx
push edi
lea esi, [esi + eax*2 + 2]
call ebx
lea edi, [edi + eax*2 + 2]
cmp esi, ebp
jne 0x401cc0
xor eax, eax
push 2
mov word [edi], ax
mov edi, dword [esp + 0x80]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebp
je 0x401ec9
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x22
xor edx, edx
push 0x9490c8
mov word [0x9490c8], cx
mov word [0x9490ca], dx
call edi
push 0x40542c
push 0x9490c8
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x80]
cmp esi, ebp
je 0x401d62
cmp word [esi], bp
je 0x401d62
push esi
push 0x9490c8
call edi
cmp word [esi], bp
je 0x401d62
push str._preloader
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x401d6e
push str.__preloader
push 0x9490c8
call edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x38]
push edx
push ebp
push 0x94e0e0
push 0x404
push ebp
push ebp
push ebp
push 0x9490c8
xor eax, eax
push ebp
mov dword [esp + 0x84], ebp
mov word [esp + 0x8e], ax
mov dword [esp + 0x90], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x5c], 0x44
mov dword [esp + 0x88], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401eb5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [esp + 0x2c]
push ecx
push eax
push esi
mov edi, eax
mov ebx, ecx
call fcn.00401b50
push ebx
push edi
push esi
mov ebp, eax
call fcn.00401b90
mov ebx, eax
lea eax, [esp + 0x30]
push eax
call fcn.004042a0
add esp, 0x1c
push ebp
push 0xfc000
push 0
push 4
lea ecx, [esp + 0x28]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea edx, [esp + 0x18]
push edx
mov esi, eax
call fcn.00404200
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
test esi, esi
je 0x401e9d
push esi
push 1
call fcn.00404220
add esp, 8
push 0
push 0
push 0
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x401e9a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call fcn.00401c00
mov edi, eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x24]
push 0x124f80
push 0
lea edx, [esp + 0x18]
push edx
push 2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push edi
call ebp
push esi
call ebp
mov eax, dword [esp + 0x28]
push eax
call ebp
mov ecx, dword [esp + 0x24]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x68
ret
push 6
call fcn.00401950
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x68
ret
push 5
call fcn.00401950
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x68
ret