Function at 0x401780
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0c
mov eax, dword [0x405030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x4010e8
push edi
mov dword [ebp - 0xa28], ebx
mov dword [ebp - 0xa24], eax
mov dword [ebp - 0xa20], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4017da
push 0x4010fc
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x402392
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa20], 1
push eax
push 0x4018fc
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x401805
lea edi, [ebp - 0x218]
cmp dword [ebp + 0x14], 0
jne 0x4023a4
mov eax, ebx
mov ecx, ebx
neg eax
sbb eax, eax
not eax
and eax, edi
neg ecx
mov dword [ebp - 0xa30], eax
sbb ecx, ecx
and ecx, edi
mov dword [ebp - 0xa2c], ecx
mov dx, word [ebp + 0x18]
xor ebx, ebx
mov word [ebp - 0xa60], dx
xor esi, esi
xor edx, edx
mov dword [ebp - 0xa90], 0x44
mov word [ebp - 0xa5e], dx
inc esi
lea edx, [ebp - 0xa44]
mov dword [ebp - 0xa8c], edi
push edx
lea edx, [ebp - 0xa90]
mov dword [ebp - 0xa84], edi
push edx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push eax
push ecx
mov dword [ebp - 0xa88], ebx
mov dword [ebp - 0xa74], ebx
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa5c], ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateProcessW]
mov dword [ebp - 0xa1c], eax
test eax, eax
je 0x4024fc
mov ebx, dword [ebp - 0xa1c]
cmp dword [ebp + 0x10], 0
jne 0x402663
push dword [ebp - 0xa44]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test esi, esi
je 0x4018dd
push dword [ebp - 0xa40]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp dword [ebp + 0x10], 0
jne 0x402676
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401940
mov esp, ebp
pop ebp
ret 0x18
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
jmp 0x4017f5
xor eax, eax
mov esi, eax
cmp dword [0x40538c], eax
jne 0x4023e0
push eax
push eax
push 0x4034f8
mov ebx, eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test eax, eax
je 0x4018e7
push 0x402724
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0x40538c], eax
test eax, eax
je 0x4018e7
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4023e7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x402413
xor eax, eax
jmp 0x4018e9
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0xa24]
jne 0x402418
sub edx, ecx
mov ecx, ebx
sar edx, 1
push edi
inc edx
call fcn.004021d4
cmp dword [ebp - 0xa28], esi
jne 0x40245a
mov ecx, ebx
call fcn.0040384b
mov esi, eax
test esi, esi
je 0x40245a
xor eax, eax
cmp word [esi], ax
je 0x402458
mov word [esi], ax
add esi, 2
jmp 0x40245a
mov esi, eax
mov ecx, ebx
call fcn.0040357f
push 0x3c
pop edi
xor eax, eax
push edi
push eax
lea eax, [ebp - 0xacc]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x18]
add esp, 0xc
movzx eax, ax
mov dword [ebp - 0xab0], eax
lea eax, [ebp - 0xacc]
mov dword [ebp - 0xab8], esi
mov esi, dword [0x40538c]
mov ecx, esi
push eax
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xac8], 0x640
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xac0], 0x402734
call dword [0x406154]
call esi
mov dword [ebp - 0xa1c], eax
test eax, eax
je 0x4024ea
cmp dword [ebp + 0x10], 0
je 0x4024de
push 0xffffffffffffffff
push dword [ebp - 0xa94]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
push dword [ebp - 0xa94]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push ebx
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov ebx, dword [ebp - 0xa1c]
jmp 0x4018e7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x2e4
jne 0x402694
cmp dword [ebp + 0x1c], ebx
je 0x402694
mov esi, ebx
mov dword [ebp - 0xa34], ebx
cmp dword [0x40538c], ebx
jne 0x402556
xor eax, eax
push eax
push eax
push 0x4034f8
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
test eax, eax
je 0x40269a
push 0x402724
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [0x40538c], eax
test eax, eax
je 0x40269a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40255b
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40240c
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0xa24]
jne 0x402589
sub edx, ecx
mov ecx, ebx
sar edx, 1
push edi
inc edx
call fcn.004021d4
cmp dword [ebp - 0xa28], esi
jne 0x4025cb
mov ecx, ebx
call fcn.0040384b
mov esi, eax
test esi, esi
je 0x4025cb
xor eax, eax
cmp word [esi], ax
je 0x4025c9
mov word [esi], ax
add esi, 2
jmp 0x4025cb
mov esi, eax
mov ecx, ebx
call fcn.0040357f
xor eax, eax
push 0x3c
push eax
lea eax, [ebp - 0xb08]
push eax
call sub.msvcrt.dll_memset
movzx eax, word [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 0xaec], eax
lea eax, [ebp - 0xb08]
mov dword [ebp - 0xaf4], esi
mov esi, dword [0x40538c]
mov ecx, esi
push eax
mov dword [ebp - 0xb08], 0x3c
mov dword [ebp - 0xb04], 0x640
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xafc], 0x402740
call dword [0x406154]
call esi
mov dword [ebp - 0xa1c], eax
test eax, eax
je 0x402647
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xa44], eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
mov ebx, dword [ebp - 0xa1c]
test ebx, ebx
je 0x40269a
mov esi, dword [ebp - 0xa34]
jmp 0x4018b7
push 0xffffffffffffffff
push dword [ebp - 0xa44]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
jmp 0x4018c1
call fcn.00401995
test al, al
jne 0x4018e7
mov eax, dword [ebp - 0xa30]
mov ecx, dword [ebp - 0xa2c]
jmp 0x40182d
mov ebx, dword [ebp - 0xa1c]
call fcn.004035be
test eax, eax
jne 0x4018e7
mov ecx, dword fs:[0x30]
mov eax, dword [0x7ffe02d8]
cmp eax, dword [ecx + 0x1d4]
je 0x4018e7
cmp dword [ebp - 0xa20], 1
jne 0x4018e7
call fcn.00401995
test al, al
je 0x4018e7
mov esi, 0x200
lea eax, [ebp - 0xa18]
push esi
push eax
push 0x648
xor edi, edi
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
push esi
lea eax, [ebp - 0x618]
push eax
push 0x647
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadStringW]
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x618]
push eax
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_DisplayMessageAndExitWindows]
jmp 0x4018e7