Function at 0x4024b0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Set environment variable

Disassembly:
sub esp, 0xcb4
cmp dword [esp + 0xcb8], 0
push ebx
push ebp
mov ebp, dword [esp + 0xccc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov esi, edx
jne 0x40254d
xor ecx, ecx
test esi, esi
je 0x4024ea
mov eax, esi
lea esp, [esp]
shr eax, 4
inc ecx
test eax, eax
jne 0x4024e0
jmp 0x4024ef
mov ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x68], ax
test ecx, ecx
je 0x40251f
lea ebx, [ebx]
mov eax, edx
and eax, 0xf
dec ecx
cmp eax, 9
jbe 0x402510
add eax, 0x37
jmp 0x402513
add eax, 0x30
shr edx, 4
mov word [esp + ecx*2 + 0x68], ax
test ecx, ecx
jne 0x402500
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0x401e04
push ecx
push 0x401e2c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg esi
sbb esi, esi
lea edx, [esp + 0x68]
and esi, edx
push esi
push 0x401e4c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
mov edx, edi
test edi, edi
je 0x402561
mov eax, edi
shr eax, 4
inc ecx
test eax, eax
jne 0x402557
jmp 0x402566
mov ecx, 1
xor eax, eax
mov word [esp + ecx*2 + 0x68], ax
test ecx, ecx
je 0x402590
mov eax, edx
and eax, 0xf
dec ecx
cmp eax, 9
jbe 0x402581
add eax, 0x37
jmp 0x402584
add eax, 0x30
shr edx, 4
mov word [esp + ecx*2 + 0x68], ax
test ecx, ecx
jne 0x402571
test ebx, ebx
je 0x4025f6
cmp dword [esp + 0xcc8], 0
jne 0x4025f6
lea eax, [esp + 0x68]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4025a5
sub eax, edx
sar eax, 1
mov ecx, 0x4c
mov word [esp + eax*2 + 0x68], cx
lea esi, [esp + eax*2 + 0x6a]
xor ecx, ecx
mov edx, ebx
mov eax, ebx
shr eax, 4
inc ecx
test eax, eax
jne 0x4025c8
mov word [esi + ecx*2], ax
test ecx, ecx
je 0x4025f6
mov eax, edx
and eax, 0xf
dec ecx
cmp eax, 9
jbe 0x4025e8
add eax, 0x37
jmp 0x4025eb
add eax, 0x30
shr edx, 4
mov word [esi + ecx*2], ax
test ecx, ecx
jne 0x4025d8
cmp word [ebp], 0
je 0x40268f
lea eax, [esp + 0x68]
lea edx, [eax + 2]
jmp 0x402610
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402610
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402626
sub eax, edx
add esi, esi
sar eax, 1
lea edi, [esp + esi + 0x6a]
xor ecx, ecx
mov edx, 2
mov word [edi + 4], cx
mov ecx, eax
and ecx, 0xf
dec edx
cmp ecx, 9
jbe 0x402656
add ecx, 0x37
jmp 0x402659
add ecx, 0x30
shr eax, 4
mov word [edi + edx*2], cx
test edx, edx
jne 0x402646
mov edx, 0x53
mov eax, 0x3a
mov word [esp + esi + 0x68], dx
mov word [esp + esi + 0x6e], ax
sub esi, ebp
mov eax, ebp
lea edx, [esp + esi + 0x70]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402680
mov esi, dword [esp + 0xcd0]
cmp word [esi], 0
je 0x4026df
lea eax, [esp + 0x68]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4026a3
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov edx, 0x55
mov word [esp + ecx + 0x68], dx
sub ecx, esi
mov eax, esi
lea edx, [esp + ecx + 0x6a]
jmp 0x4026d0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4026d0
mov eax, dword [esp + 0xcc8]
xor bl, bl
test eax, eax
je 0x402772
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402751
lea edi, [esp + 0x868]
call fcn.004023a0
test al, al
je 0x40273d
lea eax, [esp + 0x68]
mov ecx, edi
push eax
push ecx
mov edi, esi
call fcn.00402150
mov bl, al
test bl, bl
jne 0x40273d
push 0x10
push 0x40117c
push 0x401e64
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcb4
ret
push 0x10
push 0x40117c
push 0x401e80
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcb4
ret
push 0x44
lea edx, [esp + 0x24]
push 0
push edx
call sub.ntdll.dll_memset
xor eax, eax
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x68]
push eax
push 0x401170
mov dword [esp + 0x28], 0x44
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edi, dword [esp + 0xccc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40283c
lea edi, [esp + 0x868]
call fcn.004023a0
test al, al
je 0x402810
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00401ff0
mov bl, al
test bl, bl
jne 0x402810
push 0x10
push 0x40117c
push 0x401e64
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcb4
ret
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x401ea0]
mov word [esp + eax + 0xa80], cx
add eax, 2
test cx, cx
jne 0x402840
lea esi, [esp + 0xaaa]
xor ecx, ecx
mov eax, edi
sub esi, edi
movzx edx, word [eax]
test dx, dx
je 0x40287c
mov word [esi + eax], dx
inc ecx
add eax, 2
cmp ecx, 0x10a
jl 0x402864
push 0x10
push 0x401d98
lea eax, [esp + 0xa88]
xor edx, edx
push eax
push edx
mov word [esp + ecx*2 + 0xaba], dx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0xcb4
ret