Function at 0x401053
Capabilities:
Create process on windows
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
xor ebx, ebx
cmp dword [ebp + 0x20], ebx
push esi
push edi
jne 0x4012eb
push 0x10
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004014b5
mov eax, dword [ebp - 0x28]
mov word [eax], bx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x2c]
test eax, 0xfffffffe
jne 0x4010ce
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebx
push ebx
push str.Path
call edi
mov esi, eax
inc esi
lea eax, [esi + esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
push esi
mov ebx, eax
push ebx
push str.Path
call edi
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [ebx + eax*2]
push eax
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401586
push ebx
call fcn.0040754f
pop ecx
xor ebx, ebx
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040663a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x2c]
call fcn.004014d1
mov edi, dword [ebp + 0x3c]
mov eax, dword [edi + 4]
sub eax, dword [edi]
test eax, 0xfffffffe
je 0x401252
xor esi, esi
sar eax, 1
mov dword [ebp - 0xc], eax
push ebx
push 0x3b
mov ecx, edi
call fcn.004015fc
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401199
lea eax, [ebp + 0x3f]
push eax
mov eax, ebx
sub eax, esi
push eax
push esi
push edi
lea ecx, [ebp - 0x3c]
call fcn.00401456
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00403fbf
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
push 0x3b
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401705
add esp, 0xc
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00401775
lea ecx, [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
je 0x401170
push dword [eax + 4]
lea ecx, [ebp - 0x1c]
push dword [eax]
call fcn.00401586
lea ecx, [ebp - 0x6c]
call fcn.0040144a
lea ecx, [ebp - 0x5c]
call fcn.0040144a
lea ecx, [ebp - 0x4c]
lea esi, [ebx + 1]
call fcn.0040144a
lea ecx, [ebp - 0x3c]
call fcn.0040144a
push esi
jmp 0x401103
mov ebx, dword [ebp - 0xc]
cmp esi, ebx
jge 0x401250
lea eax, [ebp + 0x3f]
push eax
mov ecx, edi
call fcn.0040144f
push eax
sub ebx, esi
push ebx
push esi
push edi
lea ecx, [ebp - 0x4c]
call fcn.00401456
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00403fbf
pop ecx
pop ecx
lea eax, [ebp - 0x1c]
push eax
push 0x3b
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00401705
add esp, 0xc
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401775
lea ecx, [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
je 0x401203
push dword [eax + 4]
lea ecx, [ebp - 0x1c]
push dword [eax]
call fcn.00401586
push 1
pop edi
push edi
xor esi, esi
push esi
lea ecx, [ebp - 0x5c]
call fcn.00406637
lea ecx, [ebp - 0x5c]
call fcn.0040144a
push edi
push esi
lea ecx, [ebp - 0x6c]
call fcn.00406637
lea ecx, [ebp - 0x6c]
call fcn.0040144a
push edi
push esi
lea ecx, [ebp - 0x3c]
call fcn.00406637
lea ecx, [ebp - 0x3c]
call fcn.0040144a
push edi
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406637
lea ecx, [ebp - 0x4c]
call fcn.0040144a
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
push 0x3b
push dword [ebp + 0x38]
lea eax, [ebp - 0x4c]
push eax
call fcn.00401000
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401705
add esp, 0xc
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00401775
lea ecx, [ebp - 0x1c]
add esp, 0xc
cmp eax, ecx
je 0x401294
push dword [eax + 4]
lea ecx, [ebp - 0x1c]
push dword [eax]
call fcn.00401586
push 1
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00406637
lea ecx, [ebp - 0x6c]
call fcn.0040144a
push 1
push ebx
lea ecx, [ebp - 0x5c]
call fcn.00406637
lea ecx, [ebp - 0x5c]
call fcn.0040144a
push 1
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00406637
lea ecx, [ebp - 0x4c]
call fcn.0040144a
push dword [ebp - 0x1c]
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0x1c]
call fcn.0040144a
lea ecx, [ebp - 0x2c]
call fcn.0040144a
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
call fcn.00406bb3
test al, al
pop ecx
pop ecx
je 0x40130c
cmp dword [ebp - 8], 2
jne 0x40130c
mov al, 1
jmp 0x40130e
xor al, al
mov cl, byte [ebp + 0x34]
neg al
sbb eax, eax
and eax, 0x800
neg cl
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
or eax, ecx
mov ecx, dword [ebp + 0x30]
or eax, dword [ebp + 0x1c]
cmp ecx, ebx
jne 0x401336
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp + 0x2c]
push esi
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
cmp eax, 1
jne 0x40138a
cmp byte [ebp + 0x34], 0
jne 0x40138d
push dword [ebp + 0x40]
push dword [ebp + 0x38]
push dword [esi + 4]
push dword [esi]
push dword [esi + 8]
push dword [ebp + 8]
call fcn.00401394
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x40138d
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x40138d
push 1
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret