Function at 0x40449c
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x411304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov ecx, 0x40160c
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4044f4
test dx, dx
je 0x4044f0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4044f4
add eax, 4
add ecx, 4
test dx, dx
jne 0x4044ce
xor eax, eax
jmp 0x4044f9
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40450f
push ecx
xor edx, edx
call fcn.0040434a
test eax, eax
je 0x40456b
call dword [sym.imp.DUI70.dll_StartMessagePump]
lea eax, [ebp - 0x214]
mov ecx, esi
push eax
lea eax, [ebp - 0x218]
push eax
lea edx, [ebp - 0x21c]
call fcn.00404dc5
test eax, eax
je 0x40456b
cmp dword [ebp - 0x21c], 2
jne 0x4045cf
push 1
push 0x106b
push 0
call dword [sym.imp.ntdll.dll_WinSqmIncrementDWORD]
cmp dword [ebp - 0x214], ebx
jne 0x40457e
mov ecx, dword [ebp - 0x218]
call fcn.004043aa
cmp dword [0x411bd0], ebx
je 0x40456b
call dword [sym.imp.DUI70.dll_StartMessagePump]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ed00
leave
ret 0x10
cmp dword [ebp - 0x214], 1
jne 0x4045cf
call fcn.00404d42
test eax, eax
je 0x4045cf
xor edx, edx
push ecx
inc edx
call fcn.0040434a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x401570
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x40456b
push 0xa
xor ecx, ecx
lea eax, [ebp - 0x20c]
push ecx
push esi
push eax
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40456b
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40456b
push ecx
push ecx
call fcn.00404213
xor ecx, ecx
mov dword [0x411bf8], 1
mov dword [0x411bf0], ecx
mov dword [0x411be0], ecx
mov dword [0x411bfc], ecx
mov dword [0x411bd8], 0x40164c
mov dword [0x411038], 0x411be0
call fcn.004042fa
push 1
push 1
push 1
push 0x400000
xor esi, esi
push 0xe
mov dword [ebp - 0x210], esi
call dword [sym.imp.DUI70.dll_InitProcessPriv]
test eax, eax
js 0x404718
push 2
call dword [sym.imp.DUI70.dll_InitThread]
test eax, eax
js 0x404718
cmp dword [ebp - 0x21c], 2
je 0x404665
mov ecx, dword [ebp - 0x21c]
call fcn.00405bd4
jmp 0x404718
lea eax, [ebp - 0x210]
push eax
push 4
push 0xca0000
push esi
mov eax, 0x80000000
push eax
push eax
push eax
push eax
push 0x20
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push esi
push 0x40151c
call dword [sym.imp.DUI70.dll_public:_static_long_int___stdcall_DirectUI::NativeHWNDHost::Create_unsigned_short_int_const___struct_HWND_____struct_HICON_____int__int__int__int__int__int__unsigned_int__class_DirectUI::NativeHWNDHost___]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x404728
lea eax, [ebp - 0x214]
push eax
push ecx
push dword [ebp - 0x218]
lea edx, [ebp - 0x218]
push edi
call fcn.00404b1c
test eax, eax
js 0x404718
push dword [ebp - 0x214]
mov ecx, dword [ebp - 0x218]
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::Element::EndDefer_unsigned_long_int_]
mov eax, dword [ebp - 0x210]
push 1
push esi
push esi
push 0x64
push 0x64
push 0xffffffffffffffff
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x210]
push 1
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::NativeHWNDHost::ShowWindow_int_]
mov ecx, dword [ebp - 0x210]
mov ecx, dword [ecx + 4]
call fcn.00404e9c
xor edx, edx
xor ebx, ebx
push ecx
inc edx
inc ebx
call fcn.0040434a
call dword [sym.imp.DUI70.dll_StartMessagePump]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x404728
call dword [sym.imp.DUI70.dll_public:_void___thiscall_DirectUI::NativeHWNDHost::Destroy_void_]
call dword [sym.imp.DUI70.dll_UnInitThread]
push 0x400000
call dword [sym.imp.DUI70.dll_UnInitProcessPriv]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [0x411038]
mov edi, 0x411038
cmp esi, edi
je 0x404778
jmp 0x40476e
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
je 0x40476c
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov esi, dword [esi]
test esi, esi
jne 0x404750
mov dword [0x411038], edi
call fcn.00404244
cmp dword [0x411bd0], 0
je 0x404798
call dword [sym.imp.DUI70.dll_StartMessagePump]
push dword [0x411bd0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x40456d