Function at 0x811bec
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x811f07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b8d8
mov bl, 1
lea eax, [ebp - 8]
mov edx, 0x811f24
call fcn.0040bd94
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x45c]
test eax, eax
je 0x811c3b
mov eax, dword [eax - 4]
cmp eax, 9
je 0x811c4f
lea eax, [ebp - 8]
mov edx, 0x811f38
call fcn.0040bd94
xor ebx, ebx
cmp bl, 1
jne 0x811d09
mov eax, 0x811f40
push 0x200
lea edx, [ebp - 0x210]
push edx
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
lea eax, [ebp - 4]
lea edx, [ebp - 0x210]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor esi, esi
inc esi
cmp esi, 0x14
jg 0x811ccb
push 0x32
call sub.kernel32.dll_Sleep
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e8ba0
call fcn.00811858
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x468], edi
test edi, edi
je 0x811c9c
mov bl, 1
test bl, bl
jne 0x811d09
push 0x32
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
push 0x811f50
call sub.user32.dll_FindWindowW
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x468], esi
test esi, esi
je 0x811cfc
mov bl, 1
jmp 0x811d09
lea eax, [ebp - 8]
mov edx, 0x811f84
call fcn.0040bd94
cmp bl, 1
jne 0x811dd2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x448]
call fcn.0053ed74
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_SetParent
push 0x4000
mov eax, dword [ebp - 0x10]
call fcn.00534524
push eax
mov eax, dword [ebp - 0x10]
call fcn.005344e4
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_SetWindowPos
push 0x32
call sub.kernel32.dll_Sleep
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e8ba0
mov eax, dword [ebp - 0x10]
add eax, 0x46c
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e8ba0
mov eax, dword [ebp - 0x10]
add eax, 0x474
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x478
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x470]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x46c]
mov eax, dword [ebp - 0x10]
call fcn.00811938
mov eax, dword [0x8dd49c]
mov eax, dword [eax]
call fcn.005e8ba0
push 0x32
call sub.kernel32.dll_Sleep
cmp bl, 1
jne 0x811e44
mov eax, dword [ebp - 0x10]
call fcn.008122c0
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
push eax
mov eax, dword [0x8dc8ec]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x46c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x470]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x474]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x478]
push eax
mov eax, dword [0x8dd270]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x45c]
mov dl, 1
mov eax, dword [0x80f600]
call fcn.0080fac0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x47c], eax
test bl, bl
jne 0x811ee7
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x811ee0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x811eac
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x811f98
mov eax, dword [ebp - 0x10]
push dword [eax + 0x45c]
mov eax, dword [0x8dd8ec]
mov eax, dword [eax]
push dword [eax + 0x48c]
push 0x811fac
push dword [ebp - 8]
push 0x811fbc
lea eax, [ebp - 0xc]
mov edx, 6
call fcn.0040c1c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811eb6
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.008554fc
mov eax, dword [ebp - 0x10]
call fcn.005e39dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x811ee7
lea eax, [ebp - 0xc]
call fcn.0040b8d8
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x811f0e
lea eax, [ebp - 8]
call fcn.0040b8d8
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax