Function at 0x40b030
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x414dd1
push eax
mov eax, 0x1098
mov dword fs:[0], esp
call fcn.00413f20
push esi
push edi
push ecx
mov dword [esp + 0x10ac], 0
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Entering_TryPwd
call fcn.00413dc4
call fcn.0040c2c0
lea eax, [esp + 0x10b4]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call sub.MFC42u.DLL_CString::CString_2
call fcn.0040c2c0
add esp, 4
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString_1
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x4c]
push str.SystemDrive
rep stosd dword es:[edi], eax
xor ecx, ecx
mov byte [esp + 0x10ac], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
lea ecx, [esp + 0x10]
push eax
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 8]
mov byte [esp + 0x10a8], 2
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x10a8], 3
call fcn.0040c6b0
test al, al
je 0x40b106
push str.Preboot_
jmp 0x40b10b
push str.IBMTOOLS_
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::operator_2
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
call sub.MFC42u.DLL_operator_3
push str.Python22python.exe
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x10b4], 4
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x48]
mov byte [esp + 0x10a8], 6
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call sub.MFC42u.DLL_operator_3
push 0x41ecc0
push eax
lea eax, [esp + 0x14]
mov byte [esp + 0x10b0], 7
push eax
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x38]
mov byte [esp + 0x10a8], 9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
push 0x41ecbc
lea edx, [esp + 0x28]
push ecx
push edx
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0xc]
lea edx, [esp + 0x40]
push ecx
push eax
push edx
mov byte [esp + 0x10b4], 0xa
call sub.MFC42u.DLL_operator_3
push str.password.pyc
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x10b0], 0xb
push eax
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x10b0]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x10b4], 0xc
call sub.MFC42u.DLL_operator_3
lea ecx, [esp + 0x44]
mov byte [esp + 0x10a8], 0x10
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x10a8], 0xf
call sub.MFC42u.DLL_CString::CString
mov byte [esp + 0x10a8], 0xe
lea ecx, [esp + 0x24]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x90]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 4
lea edx, [esp + 0x94]
mov ecx, esp
mov dword [esp + 0x40], esp
push edx
call fcn.00413dc4
call fcn.0040c2c0
mov edx, dword [esp + 0x10]
add esp, 4
lea eax, [esp + 0x28]
lea ecx, [esp + 0x4c]
push eax
push ecx
push edx
push 0
push 0x8000000
push 0
push 0
lea eax, [esp + 0xac]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40b2b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov esi, eax
mov ecx, esp
mov dword [esp + 0x40], esp
push str.create_process_failed
call fcn.00413dc4
call fcn.0040c2c0
add esp, 4
push esi
push str.GetLastError_returned__u_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
jmp 0x40b2e8
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x2c]
push edx
call esi
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x18]
mov byte [esp + 0x10a8], 9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x10a8], 6
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x10a8], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x10a8], 2
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x10a8], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10a8], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10b0]
mov dword [esp + 0x10a8], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x10a0]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10a4
ret