Function at 0x405e74
Capabilities:
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0041d610
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.0040992d
mov esi, eax
cmp esi, ebx
jge 0x405eb9
push 0x40362c
jmp 0x406145
push dword [0x429f18]
call fcn.004099c6
mov esi, eax
cmp esi, ebx
jge 0x405ed4
push 0x40364c
jmp 0x406145
lea eax, [ebp - 0xc]
call fcn.00409c15
mov esi, eax
cmp esi, ebx
jge 0x405eec
push 0x40366c
jmp 0x406145
push dword [0x429f18]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x403694
call esi
test eax, eax
jne 0x405f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405f1d
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405f24
mov esi, 0x80004005
push 0x4036b8
jmp 0x406145
push dword [ebp - 0xc]
push 0x4036d8
call esi
test eax, eax
jne 0x405f67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405f56
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405f5d
mov esi, 0x80004005
push 0x403704
jmp 0x406145
push dword [0x429f1c]
push 0x403728
call esi
test eax, eax
jne 0x405fa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405f92
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405f99
mov esi, 0x80004005
push 0x403758
jmp 0x406145
cmp dword [ebp + 0xc], 1
jne 0x405fe4
push 0x403780
push 0x403784
call esi
test eax, eax
jne 0x405fe4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405fd3
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405fda
mov esi, 0x80004005
push 0x4037a4
jmp 0x406145
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x40601c
lea esi, [ebp - 8]
call fcn.00408be8
mov esi, eax
test esi, esi
jns 0x40600f
push 0x4037fc
jmp 0x406145
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x406053
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x406036
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40603d
mov esi, 0x80004005
push dword [ebp + 8]
push 0x4037c4
push esi
call fcn.0040895c
add esp, 0xc
jmp 0x406176
push dword [ebp - 8]
xor edi, edi
inc edi
mov eax, edi
push 0x403828
push edi
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], ax
call fcn.004088e0
add esp, 0xc
xor ebx, ebx
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x429f18]
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4060f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4060b2
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070005
je 0x4060c4
cmp esi, 0x80070020
jne 0x4060e7
push esi
push 0x403848
push edi
call fcn.004088e0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x40607c
cmp esi, ebx
jge 0x4060f2
push 0x403878
jmp 0x406145
mov dword [ebp + 8], ebx
mov edi, dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x40611e
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, dword [ebp + 0xc]
je 0x406135
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, ebx
jne 0x406101
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x32
jl 0x4060f5
call fcn.004069cb
mov esi, eax
cmp esi, ebx
jge 0x40614f
push 0x403894
push esi
call fcn.0040895c
pop ecx
pop ecx
jmp 0x406176
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x406183
push edi
call fcn.004099c6
cmp dword [ebp - 8], 0
je 0x406191
push dword [ebp - 8]
call fcn.0040921f
cmp dword [ebp - 0xc], 0
je 0x40619f
push dword [ebp - 0xc]
call fcn.0040921f
test edi, edi
je 0x4061a9
push edi
call fcn.0040921f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc