Function at 0x41bc70
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x5063da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov ecx, dword [0x57614c]
mov dword [esp + 0x220], 0
mov eax, dword [ecx + 0x1f4]
test eax, eax
jne 0x41bcd4
lea ecx, [esp + 0x228]
mov dword [esp + 0x220], 0xffffffff
call fcn.004e1e27
xor eax, eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
add esp, 0x224
ret
cmp eax, 1
jne 0x41bdc0
lea eax, [esp + 0x10]
push 0x104
push eax
push 0x55cc08
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 4]
call fcn.004e1e9b
mov edx, dword [esp + 0x228]
mov eax, dword [esp]
push 5
push 0x5705d0
push edx
push eax
push 0x55cbfc
push 0
mov byte [esp + 0x238], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x41bd7e
push 0xffffffffffffffff
push 0
push 0xefab
call fcn.0041b900
add esp, 0xc
lea ecx, [esp]
mov byte [esp + 0x220], 0
call fcn.004e1e27
lea ecx, [esp + 0x228]
mov dword [esp + 0x220], 0xffffffff
call fcn.004e1e27
xor eax, eax
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
add esp, 0x224
ret
mov byte [esp + 0x220], 0
lea ecx, [esp]
call fcn.004e1e27
lea ecx, [esp + 0x228]
mov dword [esp + 0x220], 0xffffffff
call fcn.004e1e27
mov eax, 1
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
add esp, 0x224
ret
cmp eax, 2
jne 0x41bd8f
mov edx, dword [ecx + 0x250]
add ecx, 0x250
mov eax, dword [edx - 8]
test eax, eax
je 0x41bd8f
mov eax, dword [0x56b44c]
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x228], 3
call fcn.004e1f6e
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.004e1f6e
push 0x5c
lea ecx, [esp + 0xc]
call fcn.004d6fd9
inc eax
lea ecx, [esp + 4]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.004d6f0d
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x228], 4
call fcn.004e1f6e
lea ecx, [esp + 4]
mov byte [esp + 0x224], 3
call fcn.004e1e27
lea edx, [esp + 4]
push 7
push edx
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov eax, dword [eax]
push 0x55ca10
push eax
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 4]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
je 0x41bebe
mov ecx, dword [esp + 0x22c]
lea edx, [esp + 4]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x22c]
add eax, 0xfffffff9
push eax
push edx
call fcn.004d6e91
push eax
lea ecx, [esp + 0x230]
mov byte [esp + 0x228], 5
call fcn.004e1f6e
lea ecx, [esp + 4]
mov byte [esp + 0x224], 3
call fcn.004e1e27
lea eax, [esp + 4]
push 6
push eax
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov ecx, dword [eax]
push 0x55cbec
push ecx
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 4]
test eax, eax
setne bl
call fcn.004e1e27
test bl, bl
pop ebx
je 0x41bf31
lea edx, [esp + 0x228]
lea eax, [esp + 0xc]
push edx
push 0x55cbec
push eax
call fcn.004e2140
push eax
lea ecx, [esp + 0x22c]
mov byte [esp + 0x224], 6
call fcn.004e1f6e
lea ecx, [esp + 0xc]
mov byte [esp + 0x220], 3
call fcn.004e1e27
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 8]
push 5
push ecx
push edx
push eax
push 0x55cbfc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x41bf8a
push 0xffffffffffffffff
push 0
push 0xefab
call fcn.0041b900
add esp, 0xc
lea ecx, [esp + 4]
mov byte [esp + 0x220], 2
call fcn.004e1e27
mov byte [esp + 0x220], 0
lea ecx, [esp + 8]
jmp 0x41bd8a
lea ecx, [esp + 4]
mov byte [esp + 0x220], 2
call fcn.004e1e27
lea ecx, [esp + 8]
mov byte [esp + 0x220], 0
call fcn.004e1e27
lea ecx, [esp + 0x228]
mov dword [esp + 0x220], 0xffffffff
call fcn.004e1e27
mov ecx, dword [esp + 0x218]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x224
ret