Function at 0x409110
Capabilities:
Create process on windows
Print debug messages
Query environment variable
Resolve function by parsing pe exports
Resume thread
Set environment variable

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x539d5d
push eax
mov eax, 0x1d28
mov dword fs:[0], esp
call fcn.00423a50
mov eax, dword [0x5925b8]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
test eax, eax
mov dword [esp + 0x20], ebx
je 0x40915b
push str.CSDSystemHelper::OpenFileWithPorcess2_____r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x10
mov eax, dword [esp + 0x1d50]
lea ecx, [esp + 0x18]
push eax
call fcn.0043b640
mov esi, dword [esp + 0x1d48]
lea ecx, [esp + 0x28]
push esi
mov dword [esp + 0x1d44], 0
call fcn.0043b640
lea ecx, [esp + 0x28]
mov byte [esp + 0x1d40], 1
call fcn.0043d110
mov ecx, dword [esp + 0x28]
push str.visio.exe
push ecx
call fcn.00423a7f
add esp, 8
test eax, eax
je 0x4091bd
push 0x56bd40
lea ecx, [esp + 0x1c]
call fcn.0043ca30
lea edx, [esp + 0x10]
push esi
push edx
mov ecx, ebx
call fcn.00409730
push 0x583998
lea ecx, [esp + 0x30]
mov byte [esp + 0x1d44], 2
call fcn.0043b640
mov eax, dword [esp + 0x10]
mov byte [esp + 0x1d40], 3
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x409280
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push 0x56bd34
call ebp
test eax, eax
je 0x409265
lea ebx, [eax + 1]
lea edi, [ebx + ebx]
push edi
call fcn.00520a0a
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push esi
rep stosb byte es:[edi], al
push 0x56bd34
call ebp
push 0x56bd30
lea ecx, [esp + 0x14]
call fcn.0043ca30
push esi
lea ecx, [esp + 0x14]
call fcn.0043ca30
push esi
lea ecx, [esp + 0x30]
call fcn.0043c060
push esi
call fcn.00520a33
add esp, 4
mov eax, dword [esp + 0x10]
push eax
push 0x56bd34
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1d48]
mov eax, dword [0x5925b8]
test eax, eax
je 0x4092a7
mov ecx, dword [esp + 0x18]
push ecx
push str.CSDSystemHelper::OpenFileWithPorcess2_CreateProcess___s__._r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x14
mov eax, dword [esp + 0x1d54]
test eax, eax
je 0x409572
mov ecx, 0x6a3
xor eax, eax
lea edi, [esp + 0x2aa]
mov word [esp + 0x2a8], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x2a8]
mov ebp, 1
push 0x1a90
push edx
mov dword [esp + 0x24], ebp
stosw word es:[edi], ax
call fcn.00401d90
add esp, 8
cmp eax, 0xffffffff
je 0x409428
test eax, eax
jbe 0x409428
mov ebp, dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea edi, [esp + 0x2e8]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], eax
lea esi, [edi - 0x40]
push str.UnforceEncrypt
push esi
call fcn.00423745
add esp, 8
test eax, eax
je 0x409341
push str.ReadOnlySD
push esi
call fcn.00423745
add esp, 8
test eax, eax
jne 0x409403
mov edx, dword [edi]
test edx, edx
je 0x409403
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa2]
mov word [esp + 0xa0], 0
rep stosd dword es:[edi], eax
push edx
lea ecx, [esp + 0x40]
stosw word es:[edi], ax
call fcn.004c0b50
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d40], 4
call fcn.004c1270
push eax
lea ecx, [esp + 0x3c]
call fcn.0043b640
mov eax, dword [eax]
lea ecx, [esp + 0xa0]
push 0x104
push ecx
push eax
call ebp
test eax, eax
lea ecx, [esp + 0x38]
setne bl
call fcn.0043bde0
test bl, bl
je 0x4093ee
mov edx, dword [esp + 0x1d48]
lea ecx, [esp + 0x24]
push edx
call fcn.0043b640
mov eax, dword [eax]
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.00422e74
add esp, 8
lea ecx, [esp + 0x24]
test eax, eax
sete bl
call fcn.0043bde0
test bl, bl
je 0x4093ee
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d40], 3
call fcn.004c0c80
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
add edi, 0x44
dec eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], eax
jne 0x409316
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1d48]
test ebp, ebp
mov dword [esp + 0x1c], 0xffffffff
je 0x409440
push esi
mov ecx, ebx
call fcn.00408bf0
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x1d4c]
lea ecx, [esp + 0x14]
push esi
call fcn.0043b640
push 0x5c
lea ecx, [esp + 0x18]
mov byte [esp + 0x1d44], 5
call fcn.0043cf90
mov ebx, eax
cmp ebx, 1
jle 0x40949d
lea ecx, [esp + 0x24]
push ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043e520
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1d44], 6
call fcn.0043bf70
lea ecx, [esp + 0x24]
mov byte [esp + 0x1d40], 5
call fcn.0043bde0
mov eax, dword [0x5925b8]
test eax, eax
je 0x4094c5
mov edx, dword [esp + 0x14]
push edx
push esi
push str.CSDSystemHelper::ShellExecuteEx_FileName__s__CurrentDir__s__r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x18
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x60]
cmp ebx, 1
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
mov dword [esp + 0x70], eax
setle al
dec eax
lea ecx, [esp + 0x5c]
and eax, edi
push ecx
mov dword [esp + 0x60], 0x3c
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x6c], str.open
mov dword [esp + 0x70], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
test edi, edi
jne 0x409551
mov eax, dword [0x5925b8]
test eax, eax
je 0x40953f
push esi
push str.CSDSystemHelper::ShellExecuteEx__s__r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x14
test ebp, ebp
je 0x409551
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push edx
call fcn.00408c30
push 0x56bba0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x14]
mov byte [esp + 0x1d40], 3
call fcn.0043bde0
jmp 0x409678
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x5c]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], eax
push ecx
mov dword [esp + 0x48], eax
push edx
push eax
push eax
push 0x4000414
push eax
push eax
push eax
push 0x104
lea ecx, [esp + 0x3c]
mov dword [esp + 0x80], 0x44
mov dword [esp + 0x6c], eax
call fcn.0043cab0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x409644
mov eax, dword [esp + 0x44]
mov ecx, ebx
push eax
call fcn.00408c10
mov ecx, dword [0x5925b8]
test ecx, ecx
je 0x4095ff
mov ecx, dword [esp + 0x44]
push eax
push ecx
push str.CSDSystemHelper::OpenFileWithPorcess2_AddTargetProcessID__d__Index__d._r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x18
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [0x5925b8]
test ecx, ecx
je 0x40962e
push eax
push str.CSDSystemHelper::OpenFileWithPorcess2_ResumeThread_Result__d__r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x14
mov eax, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x40]
push ecx
call esi
jmp 0x40966d
mov eax, dword [0x5925b8]
test eax, eax
je 0x40966d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CSDSystemHelper::OpenFileWithPorcess2_CreateProcess_FAILED._LastError:_d_._r_n
push str.SDSystem
push 4
push 0x591d24
call fcn.00469d00
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.0043cb80
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x40969a
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40969a
push eax
push 0x56bd34
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [0x5925b8]
test eax, eax
je 0x4096bd
push edi
push str.CSDSystemHelper::OpenFileWithPorcess2__Ret:_d_._r_n
push str.SDSystem
push 1
push 0x591d24
call fcn.00469d00
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1d40], 2
call fcn.0043bde0
lea ecx, [esp + 0x10]
mov byte [esp + 0x1d40], 1
call fcn.0043bde0
lea ecx, [esp + 0x28]
mov byte [esp + 0x1d40], 0
call fcn.0043bde0
lea ecx, [esp + 0x18]
mov dword [esp + 0x1d40], 0xffffffff
call fcn.0043bde0
mov ecx, dword [esp + 0x1d38]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1d34
ret 0x10