Function at 0x401000
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1fc
mov eax, dword [0x42c820]
xor eax, esp
mov dword [esp + 0x1f8], eax
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00401980
push 0x12
push str._TEMP_TGLICID.txt
lea ecx, [esp + 0xe0]
mov dword [esp + 0xf4], 0xf
mov dword [esp + 0xf0], 0
mov byte [esp + 0xe0], 0
call fcn.004095a0
push 0x103
lea eax, [esp + 0xf5]
push 0
push eax
mov byte [esp + 0xfc], 0
call fcn.0040e450
add esp, 0xc
cmp dword [esp + 0xec], 0x10
push 0x104
lea ecx, [esp + 0xf4]
lea eax, [esp + 0xdc]
cmovae eax, dword [esp + 0xdc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp + 0xf0], 0
jne 0x4010c5
xor eax, eax
jmp 0x4010d9
lea eax, [esp + 0xf0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010d0
sub eax, edx
push eax
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0xe0]
call fcn.004095a0
cmp dword [esp + 0xec], 0x10
lea eax, [esp + 0xd8]
cmovae eax, dword [esp + 0xd8]
sub esp, 0xc
lea ecx, [esp + 0x24]
push eax
call fcn.00402670
mov edx, 0x42db80
lea ecx, [esp + 0x28]
call fcn.00406080
mov esi, eax
push ecx
mov ecx, esi
call fcn.004089b0
mov ecx, esi
call fcn.00409070
mov edx, 0x42db98
lea ecx, [esp + 0x28]
call fcn.00406080
mov esi, eax
push ecx
mov ecx, esi
call fcn.004089b0
mov ecx, esi
call fcn.00409070
mov edx, 0x42dbb0
lea ecx, [esp + 0x28]
call fcn.00406080
mov esi, eax
push ecx
mov ecx, esi
call fcn.004089b0
mov ecx, esi
call fcn.00409070
push ecx
mov ecx, esi
call fcn.004089b0
mov ecx, esi
call fcn.00409070
lea edx, [esp + 8]
lea ecx, [esp + 0x18]
call fcn.00401300
push ecx
lea ecx, [esp + 0x2c]
call fcn.004089b0
lea ecx, [esp + 0x28]
call fcn.00409070
push ecx
lea ecx, [esp + 0x2c]
call fcn.004089b0
lea ecx, [esp + 0x28]
call fcn.00409070
push dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00407050
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0xc], esi
call fcn.00401450
lea edx, [esp + 8]
lea ecx, [esp + 0x18]
call fcn.00401300
mov edx, 0x42db80
lea ecx, [esp + 0x28]
call fcn.00406080
lea ecx, [esp + 0x28]
call fcn.00409070
lea ecx, [esp + 0x30]
call fcn.00403db0
test eax, eax
jne 0x401234
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x401222
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x401234
push 0
call fcn.00408fe0
cmp dword [esp + 0xec], 0x10
push 5
push 0
push 0
lea eax, [esp + 0xe4]
cmovae eax, dword [esp + 0xe4]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x90]
call fcn.00402750
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x94], vtable.std::ios_base.0
call fcn.0040991c
add esp, 4
cmp dword [esp + 0xec], 0x10
jb 0x40129c
push dword [esp + 0xd8]
call fcn.0040a1cb
add esp, 4
mov esi, dword [esp + 8]
mov dword [esp + 0xec], 0xf
mov dword [esp + 0xe8], 0
mov byte [esp + 0xd8], 0
test esi, esi
je 0x4012db
push dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00407050
push esi
call fcn.0040a1cb
add esp, 0xc
mov ecx, dword [esp + 0x1fc]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040a1bc
mov esp, ebp
pop ebp
ret 0x10