Function at 0x403a48
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x40f314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov ecx, 0x4015d4
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403aa0
test dx, dx
je 0x403a9c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403aa0
add eax, 4
add ecx, 4
test dx, dx
jne 0x403a7a
xor eax, eax
jmp 0x403aa5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x403abb
push ecx
xor edx, edx
call fcn.00403902
test eax, eax
je 0x403b17
call dword [sym.imp.DUI70.dll_StartMessagePump]
lea eax, [ebp - 0x214]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x21c]
call fcn.004042fb
test eax, eax
je 0x403b17
cmp dword [ebp - 0x21c], 2
jne 0x403b7d
push 1
push 0x106b
push 0
call dword [sym.imp.ntdll.dll_WinSqmIncrementDWORD]
cmp dword [ebp - 0x214], ebx
jne 0x403b2c
mov ecx, dword [ebp - 0x218]
call fcn.0040395c
cmp dword [0x40fbcc], ebx
je 0x403b17
call dword [sym.imp.DUI70.dll_StartMessagePump]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c9b0
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 0x214], 1
jne 0x403b7d
call fcn.0040427c
test eax, eax
je 0x403b7d
xor edx, edx
push ecx
inc edx
call fcn.00403902
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x401538
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x403b17
push 0xa
xor ecx, ecx
lea eax, [ebp - 0x20c]
push ecx
push esi
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x403b17
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x403b17
push ecx
push ecx
call fcn.004037de
xor ecx, ecx
mov dword [0x40fbf0], 1
mov dword [0x40fbe8], ecx
mov dword [0x40fbd8], ecx
mov dword [0x40fbf4], ecx
mov dword [0x40fbd0], 0x401614
mov dword [0x40f038], 0x40fbd8
call fcn.004038b6
push 1
push 1
push 1
push 0x400000
xor esi, esi
push 0xe
mov dword [ebp - 0x210], esi
call dword [sym.imp.DUI70.dll_InitProcessPriv]
test eax, eax
js 0x403cc6
push 2
call dword [sym.imp.DUI70.dll_InitThread]
test eax, eax
js 0x403cc6
cmp dword [ebp - 0x21c], 2
je 0x403c13
mov ecx, dword [ebp - 0x21c]
call fcn.00404fc6
jmp 0x403cc6
lea eax, [ebp - 0x210]
push eax
push 4
push 0xca0000
push esi
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push 0x20
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push esi
push 0x4014e0
call dword [sym.imp.DUI70.dll_public:_static_long_int___stdcall_DirectUI::NativeHWNDHost::Create_unsigned_short_int_const___struct_HWND_____struct_HICON_____int__int__int__int__int__int__unsigned_int__class_DirectUI::NativeHWNDHost___]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x403cd6
lea eax, [ebp - 0x214]
push eax
push ecx
push dword [ebp - 0x218]
lea edx, [ebp - 0x218]
push edi
call fcn.00404070
test eax, eax
js 0x403cc6
push dword [ebp - 0x214]
mov ecx, dword [ebp - 0x218]
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::Element::EndDefer_unsigned_long_int_]
mov eax, dword [ebp - 0x210]
push 1
push esi
push esi
push 0x64
push 0x64
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x210]
push 1
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::NativeHWNDHost::ShowWindow_int_]
mov ecx, dword [ebp - 0x210]
mov ecx, dword [ecx + 4]
call fcn.004043c6
xor edx, edx
xor ebx, ebx
push ecx
inc edx
inc ebx
call fcn.00403902
call dword [sym.imp.DUI70.dll_StartMessagePump]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x403cd6
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::NativeHWNDHost::Destroy_void_]
call dword [sym.imp.DUI70.dll_UnInitThread]
push 0x400000
call dword [sym.imp.DUI70.dll_UnInitProcessPriv]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [0x40f038]
mov edi, 0x40f038
cmp esi, edi
je 0x403d26
jmp 0x403d1c
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x403d1a
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov esi, dword [esi]
test esi, esi
jne 0x403cfe
mov dword [0x40f038], edi
call fcn.00403809
cmp dword [0x40fbcc], 0
je 0x403d46
call dword [sym.imp.DUI70.dll_StartMessagePump]
push dword [0x40fbcc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x403b19