Function at 0x402360
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413cbb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test ecx, ecx
mov dword [ebp - 4], 2
mov edx, 0x8000000
mov eax, 0x10
cmove eax, edx
mov dword [ebp - 0x80], eax
call fcn.00401160
mov ecx, eax
test ecx, ecx
je 0x402652
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 3
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4023fb
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00402de0
mov edi, dword [ebp - 0x18]
cmp dword [edi - 8], 0x104
jl 0x402648
push 0x104
mov dword [edi - 0xc], 0x104
xor eax, eax
push edi
mov word [edi + 0x208], ax
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [edi - 8]
push edi
call fcn.00408231
add esp, 8
test eax, eax
js 0x402648
cmp eax, dword [edi - 8]
jg 0x402648
xor ecx, ecx
mov dword [edi - 0xc], eax
push 0x5c
push edi
mov word [edi + eax*2], cx
call fcn.00404752
add esp, 8
test eax, eax
jne 0x402461
or eax, 0xffffffff
jmp 0x402465
sub eax, edi
sar eax, 1
xor ecx, ecx
add eax, 1
cmovns ecx, eax
mov dword [ebp - 0x7c], ecx
cmp ecx, dword [edi - 0xc]
jl 0x402488
lea ecx, [edi - 0x10]
call fcn.00402d00
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
jmp 0x402513
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x40249c
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4024b4
call fcn.00401160
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x40265c
mov eax, dword [ecx]
push 2
push dword [ebp - 0x7c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x402666
mov ecx, dword [ebp - 0x7c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov eax, esi
test ecx, ecx
js 0x402648
cmp ecx, dword [eax - 8]
jg 0x402648
mov dword [eax - 0xc], ecx
xor edx, edx
add ecx, ecx
mov word [ecx + eax], dx
test ecx, ecx
je 0x402513
test esi, esi
jne 0x402508
call fcn.004069b1
mov dword [eax], 0x16
call fcn.004068d7
jmp 0x402513
push ecx
push edi
push esi
call fcn.00404a60
add esp, 0xc
mov edi, esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x18]
push dword [ebx + 0xc]
push 0x419c68
push eax
call fcn.00403060
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0x44
add esp, 0xc
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x78], xmm0
cmp dword [edi - 4], 1
jle 0x402577
push dword [edi - 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00402c40
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
cmp dword [edi - 4], 1
jle 0x40258e
push dword [edi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00402c40
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push 0
push dword [ebp - 0x80]
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4025b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4025e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4025f8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 8]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x402612
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40262a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00403637
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x80070057
call fcn.00401030
push 0x80004005
call fcn.00401030
push 0x80004005
call fcn.00401030
call fcn.00402e40
int3