Function at 0x403de2
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, 0x20e4
call fcn.00412050
push esi
push 0xd
mov esi, ecx
push 0x4140a4
push esi
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x403e48
push 0x38
push eax
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c]
add esi, 0x1a
push eax
mov dword [ebp - 0x2c], 0x3c
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x404229
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x40422b
push ebx
xor ebx, ebx
push edi
mov eax, 0x100
push esi
lea edi, [ebp + 0x20]
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x68], ebx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x3c], ebx
call fcn.00406a00
mov eax, dword [ebp + 0x20]
cmp eax, ebx
jne 0x403e98
mov esi, 0x4134d0
mov dword [ebp + 0x70], esi
jmp 0x403edb
cmp word [eax], 0x22
mov dword [ebp + 0x70], eax
jne 0x403ed6
lea esi, [eax + 2]
push 0x22
push esi
call sub.msvcrt.dll_wcschr
cmp eax, ebx
pop ecx
pop ecx
je 0x403ec6
mov word [eax], bx
inc eax
inc eax
cmp word [eax], 0x20
je 0x403eb5
push eax
lea edi, [ebp + 0x34]
call fcn.00406a00
push esi
lea edi, [ebp + 0x5c]
call fcn.00406a00
mov esi, 0x4134d0
jmp 0x403f0a
mov esi, 0x4134d0
push 0x20
push dword [ebp + 0x70]
call sub.msvcrt.dll_wcschr
cmp eax, ebx
pop ecx
pop ecx
je 0x403eff
mov word [eax], bx
inc eax
inc eax
cmp word [eax], 0x20
je 0x403eee
push eax
lea edi, [ebp + 0x34]
call fcn.00406a00
push dword [ebp + 0x70]
lea edi, [ebp + 0x5c]
call fcn.00406a00
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
jne 0x403f13
mov eax, esi
push 0x25
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
mov edi, 0x7fe
je 0x403f77
push edi
lea eax, [ebp - 0x86e]
push ebx
push eax
mov word [ebp - 0x870], bx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp eax, ebx
jne 0x403f47
mov eax, esi
push 0x3ff
lea ecx, [ebp - 0x870]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
cmp word [ebp - 0x870], bx
je 0x403f77
lea eax, [ebp - 0x870]
push eax
lea edi, [ebp + 0x5c]
call fcn.00406a00
mov edi, 0x7fe
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
jne 0x403f80
mov eax, esi
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x404063
push edi
lea eax, [ebp - 0x86e]
push ebx
push eax
mov dword [ebp + 0x70], ebx
mov word [ebp - 0x870], bx
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp eax, ebx
jne 0x403fb6
mov eax, esi
lea ecx, [ebp + 0x70]
push ecx
lea ecx, [ebp - 0x870]
push ecx
push 0x3ff
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SearchPathW]
cmp word [ebp - 0x870], bx
je 0x403fe9
lea eax, [ebp - 0x870]
push eax
lea edi, [ebp + 0x5c]
call fcn.00406a00
jmp 0x404063
push edi
lea eax, [ebp - 0x186e]
push ebx
push eax
mov word [ebp - 0x1870], bx
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x106e]
push ebx
push eax
mov word [ebp - 0x1070], bx
call sub.msvcrt.dll_memset
add esp, 0x18
cmp dword [ebp + 0x5c], ebx
je 0x40401e
mov esi, dword [ebp + 0x5c]
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
lea eax, [ebp - 0x1870]
push 0x3ff
push eax
call sub.msvcrt.dll__snwprintf
lea eax, [ebp - 0x1870]
push eax
lea esi, [ebp - 0x1070]
call fcn.00410feb
add esp, 0x14
cmp word [ebp - 0x1070], bx
je 0x40405e
mov eax, esi
push eax
lea edi, [ebp + 0x5c]
call fcn.00406a00
mov esi, 0x4134d0
mov edi, dword [ebp + 0x5c]
cmp edi, ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x58], 0x100
mov dword [ebp + 0x50], ebx
mov eax, esi
je 0x404081
mov eax, edi
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x4040c0
cmp edi, ebx
mov eax, esi
je 0x404097
mov eax, edi
push 0x20
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x4040c0
cmp edi, ebx
mov eax, esi
je 0x4040ad
mov eax, edi
push eax
or eax, 0xffffffff
lea edi, [ebp + 0x48]
call fcn.00406a5c
push 0x414130
jmp 0x4040ea
push 0x414134
or eax, 0xffffffff
lea edi, [ebp + 0x48]
call fcn.00406a5c
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
jne 0x4040d9
mov eax, esi
push eax
or eax, 0xffffffff
lea edi, [ebp + 0x48]
call fcn.00406a5c
push 0x414138
or eax, 0xffffffff
lea edi, [ebp + 0x48]
call fcn.00406a5c
mov eax, dword [ebp + 0x34]
cmp eax, ebx
jne 0x4040fe
mov eax, esi
push eax
or eax, 0xffffffff
lea edi, [ebp + 0x48]
call fcn.00406a5c
push 0x7fe
lea eax, [ebp - 0x206e]
push ebx
push eax
mov word [ebp - 0x2070], bx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0x5c], ebx
je 0x40412e
mov esi, dword [ebp + 0x5c]
push esi
lea esi, [ebp - 0x2070]
call fcn.00405b6e
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov dword [ebp + 0x10], ebx
xor eax, eax
lea edi, [ebp + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x10
stosd dword es:[edi], eax
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], 5
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call fcn.0040650d
test eax, eax
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
pop ecx
je 0x40419d
push str.Wow64DisableWow64FsRedirection
push str.kernel32.dll
call edi
push eax
call esi
cmp eax, ebx
je 0x40419d
push dword [ebp + 0x7c]
call eax
mov ecx, dword [ebp + 0x48]
cmp ecx, ebx
jne 0x4041a9
mov ecx, 0x4134d0
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
jne 0x4041b5
mov eax, 0x4134d0
lea edx, [ebp + 0x10]
push edx
lea edx, [ebp - 0x70]
push edx
lea edx, [ebp - 0x2070]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call fcn.0040650d
test eax, eax
pop ecx
je 0x404202
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
push str.Wow64RevertWow64FsRedirection
push str.kernel32.dll
mov dword [ebp + 0x70], eax
call edi
push eax
call esi
cmp eax, ebx
je 0x404202
push dword [ebp + 0x70]
call eax
mov eax, dword [ebp + 0x7c]
lea esi, [ebp + 0x48]
mov dword [eax], ebx
call fcn.004069db
lea esi, [ebp + 0x34]
call fcn.004069db
lea esi, [ebp + 0x5c]
call fcn.004069db
lea esi, [ebp + 0x20]
call fcn.004069db
pop edi
pop ebx
xor eax, eax
pop esi
add ebp, 0x74
leave
ret 4