Function at 0x409fb0
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54985b
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x424], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [esi + 0x1ee4]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push eax
lea eax, [ebp - 0x41e]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [esi + 0x18cc]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [ebp - 0x464]
push 0x3c
push 0
push eax
call fcn.00530d50
lea eax, [ebp - 0x218]
mov dword [ebp - 0x464], 0x3c
add esp, 0xc
mov dword [ebp - 0x454], eax
cmp dword [esi + 0xa3c], 0
mov ecx, str._qb__passive
mov eax, str._quiet
mov dword [ebp - 0x458], str.open
cmovne eax, ecx
mov dword [ebp - 0x448], 5
push 1
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x460], 0x40
call fcn.00402e00
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 4
test al, al
jne 0x40a0f8
push str.WINSRV03SP1
push str.__COMPAT_LAYER
call ebx
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0x42c]
call esi
test eax, eax
je 0x40a17b
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x480]
push eax
call edi
test eax, eax
je 0x40a150
lea eax, [ebp - 0x480]
push eax
call ebx
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push dword [ebp - 0x42c]
call esi
cmp eax, 0xffffffff
je 0x40a175
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x42c]
call esi
test eax, eax
jne 0x40a125
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x424], 0x642
jne 0x40a20c
call fcn.00412b6d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40a1b6
push 0x80004005
call fcn.00402af0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
push 0x3ff
mov dword [ebp - 4], 0
call fcn.0041a31c
test eax, eax
je 0x40a1f2
push 0x3ff
push eax
lea ecx, [ebp - 0x428]
call fcn.004024b0
mov esi, dword [ebp - 0x428]
push 0x40030
push esi
push str.Visual_C_2015_Redistributable
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.0052fc45
push 1
call fcn.00402e00
add esp, 4
test al, al
jne 0x40a223
push 0
push str.__COMPAT_LAYER
call ebx
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052e288
mov esp, ebp
pop ebp
ret