Function at 0x405ffd
Capabilities:
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0041d8a0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.00409c24
mov esi, eax
cmp esi, ebx
jge 0x406042
push 0x403744
jmp 0x4062ce
push dword [0x42af48]
call fcn.00409cbd
mov esi, eax
cmp esi, ebx
jge 0x40605d
push 0x403764
jmp 0x4062ce
lea eax, [ebp - 0xc]
call fcn.00409f0c
mov esi, eax
cmp esi, ebx
jge 0x406075
push 0x403784
jmp 0x4062ce
push dword [0x42af48]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x4037ac
call esi
test eax, eax
jne 0x4060b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x4060a6
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x4060ad
mov esi, 0x80004005
push 0x4037d0
jmp 0x4062ce
push dword [ebp - 0xc]
push 0x4037f0
call esi
test eax, eax
jne 0x4060f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x4060df
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x4060e6
mov esi, 0x80004005
push 0x40381c
jmp 0x4062ce
push dword [0x42af4c]
push 0x403840
call esi
test eax, eax
jne 0x40612c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x40611b
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x406122
mov esi, 0x80004005
push 0x403870
jmp 0x4062ce
cmp dword [ebp + 0xc], 1
jne 0x40616d
push 0x403898
push 0x40389c
call esi
test eax, eax
jne 0x40616d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x40615c
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x406163
mov esi, 0x80004005
push 0x4038bc
jmp 0x4062ce
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x4061a5
lea esi, [ebp - 8]
call fcn.00408d5f
mov esi, eax
test esi, esi
jns 0x406198
push 0x403914
jmp 0x4062ce
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x4061dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4061bf
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x4061c6
mov esi, 0x80004005
push dword [ebp + 8]
push 0x4038dc
push esi
call fcn.00408ad3
add esp, 0xc
jmp 0x4062ff
push dword [ebp - 8]
xor edi, edi
inc edi
mov eax, edi
push 0x403940
push edi
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], ax
call fcn.00408a57
add esp, 0xc
xor ebx, ebx
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x42af48]
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40627b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40623b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070005
je 0x40624d
cmp esi, 0x80070020
jne 0x406270
push esi
push 0x403960
push edi
call fcn.00408a57
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x406205
cmp esi, ebx
jge 0x40627b
push 0x403990
jmp 0x4062ce
mov dword [ebp + 8], ebx
mov edi, dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x4062a7
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, dword [ebp + 0xc]
je 0x4062be
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, ebx
jne 0x40628a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x32
jl 0x40627e
call fcn.00406b54
mov esi, eax
cmp esi, ebx
jge 0x4062d8
push 0x4039ac
push esi
call fcn.00408ad3
pop ecx
pop ecx
jmp 0x4062ff
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x40630c
push edi
call fcn.00409cbd
cmp dword [ebp - 8], 0
je 0x40631a
push dword [ebp - 8]
call fcn.00409396
cmp dword [ebp - 0xc], 0
je 0x406328
push dword [ebp - 0xc]
call fcn.00409396
test edi, edi
je 0x406332
push edi
call fcn.00409396
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc