Function at 0x401da0
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
sub esp, 0x78
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401d00
push eax
push str.PR:_s
push 0x13281d0
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
push 0x13281d0
call ebx
lea edi, [eax*2 + 0x13281d2]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x401e0f
lea esp, [esp]
cmp word [esi], bp
je 0x401e0f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call ebx
push edi
lea esi, [esi + eax*2 + 2]
call ebx
lea edi, [edi + eax*2 + 2]
cmp esi, ebp
jne 0x401df0
xor eax, eax
push 2
mov word [edi], ax
mov edi, dword [esp + 0x90]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebp
je 0x40201a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x22
xor edx, edx
push 0x131e1a8
mov word [0x131e1a8], cx
mov word [0x131e1aa], dx
call edi
push 0x40c4fc
push 0x131e1a8
call edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0x90]
cmp esi, ebp
je 0x401e92
cmp word [esi], bp
je 0x401e92
push esi
push 0x131e1a8
call edi
cmp word [esi], bp
je 0x401e92
push str._preloader
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x401e9e
push str.__preloader
push 0x131e1a8
call edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x48]
push edx
push ebp
push 0x13281d0
push 0x404
push ebp
push ebp
push ebp
push 0x131e1a8
xor eax, eax
push ebp
mov dword [esp + 0x94], ebp
mov word [esp + 0x9e], ax
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x74], ebp
mov dword [esp + 0x6c], 0x44
mov dword [esp + 0x98], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402006
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0x30]
mov esi, eax
mov eax, dword [esp + 0x2c]
push ecx
push eax
push esi
mov edi, eax
mov ebx, ecx
call fcn.00401c80
push ebx
push edi
push esi
mov ebp, eax
call fcn.00401cc0
mov dword [esp + 0x28], eax
xor ebx, ebx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.00405400
add esp, 0x1c
push ebp
push 0xfc000
push ebx
push 4
lea ecx, [esp + 0x28]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea edx, [esp + 0x18]
push edx
mov esi, eax
call fcn.00405360
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
cmp esi, ebx
je 0x401fee
lea ecx, [esp + 0x34]
call fcn.00401bc0
push esi
push 1
call fcn.00405380
add esp, 8
push ebx
push ebx
push ebx
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x401feb
mov eax, dword [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call fcn.00401d30
mov ecx, dword [esp + 0x28]
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x24]
push 0x124f80
push ebx
lea eax, [esp + 0x18]
push eax
push 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push edi
call ebp
lea ecx, [esp + 0x34]
call fcn.00401c50
push esi
call ebp
mov ecx, dword [esp + 0x28]
push ecx
call ebp
mov edx, dword [esp + 0x24]
push edx
call ebp
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x78
ret
push 6
call fcn.004019c0
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x78
ret
push 5
call fcn.004019c0
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x78
ret