Function at 0x441ec7
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Create process on windows
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x310
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x64], eax
push ebx
push esi
mov esi, dword [ebp + 0x70]
push edi
xor ebx, ebx
push 0x207
lea eax, [ebp - 0x233]
push ebx
push eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x248], ebx
mov byte [ebp - 0x234], bl
call fcn.004464f0
xor eax, eax
mov byte [ebp + 0x54], bl
lea edi, [ebp + 0x55]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
stosb byte es:[edi], al
lea eax, [ebp - 0x2b]
push ebx
push eax
mov byte [ebp - 0x2c], bl
call fcn.004464f0
add esp, 0x18
cmp esi, ebx
je 0x4425e4
cmp byte [esi], bl
je 0x4425e4
cmp dword [ebp + 0x74], ebx
jne 0x441f4f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x244], eax
push 0x10
lea eax, [ebp - 0x264]
push ebx
push eax
call fcn.004464f0
push 0x44
pop edi
push edi
lea eax, [ebp - 0x2a8]
push ebx
push eax
call fcn.004464f0
add esp, 0x18
mov dword [ebp - 0x2a8], edi
mov dword [ebp - 0x27c], 1
cmp dword [ebp + 0x74], ebx
je 0x441f8c
push 0xa
pop eax
jmp 0x441f8e
xor eax, eax
mov word [ebp - 0x278], ax
mov dword [ebp - 0x250], 0x20
cmp dword [ebp + 0x74], ebx
jne 0x441fb9
push ebx
call fcn.0043f04b
cmp eax, 4
jle 0x441fb9
mov dword [ebp - 0x250], 0x8000020
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ecx, eax
mov esi, 0x208
add ecx, esi
mov eax, 0x1000
cmp ecx, eax
jle 0x441fde
push dword [ebp - 0x238]
call edi
add eax, esi
push 1
push eax
call fcn.004462a8
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x44201c
cmp dword [ebp + 0x7c], ebx
je 0x442015
cmp dword [0x4725c0], ebx
je 0x442015
push dword [ebp - 0x238]
call edi
add eax, 0x208
push eax
push str.____Out_of_memory:__li_r_n
call fcn.0042036e
pop ecx
pop ecx
xor eax, eax
jmp 0x4425e9
push dword [ebp - 0x238]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x238]
call edi
mov ecx, eax
push 0x7e
inc ecx
pop eax
cmp ecx, eax
jg 0x442044
push dword [ebp - 0x238]
call edi
inc eax
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x2c]
push eax
call edi
cmp eax, 0x7a
jl 0x442073
push 4
lea eax, [ebp + 0x4e]
push 0x463740
push eax
call fcn.00445ea0
add esp, 0xc
push 0x45aca0
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
jne 0x4420a1
push 0x45aca0
push ebx
push esi
call fcn.0043feaa
push 0x45aca0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 3
lea eax, [ebp - 0x234]
push eax
push esi
call fcn.0040dac4
push ebx
push ebx
push 0x4597fe
push 0x45aca0
lea eax, [ebp - 0x234]
push eax
call fcn.0043fa75
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push dword [ebp - 0x250]
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov dword [ebp - 0x240], eax
call edi
inc eax
cmp eax, 0x103
jle 0x442107
mov eax, 0x103
jmp 0x44210b
push esi
call edi
inc eax
push eax
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x240], ebx
jne 0x4425b8
push str..EXE
push dword [ebp - 0x238]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x4421af
push dword [ebp - 0x238]
call edi
add eax, 0x207
push eax
push esi
push ebx
push dword [ebp - 0x238]
call fcn.0040f245
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
push dword [ebp - 0x250]
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov dword [ebp - 0x240], eax
call edi
inc eax
cmp eax, 0x103
jle 0x442190
mov eax, 0x103
jmp 0x442194
push esi
call edi
inc eax
push eax
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x240], ebx
jne 0x4425b8
push 0x45b780
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
je 0x4422f8
push 0xf
push 0x45b780
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp - 0x238]
lea eax, [ebp + 0x54]
push esi
push eax
call fcn.0040cc0a
cmp byte [esi], bl
je 0x4422f8
push esi
call edi
inc eax
push eax
lea eax, [esi + 1]
push esi
push eax
call fcn.00446570
add esp, 0xc
push 0x45aca0
push esi
mov byte [esi], 0x22
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call edi
cmp byte [eax + esi - 1], 0x3a
je 0x442235
push esi
call edi
cmp byte [eax + esi - 1], 0x3d
jne 0x442241
mov dword [ebp - 0x248], 1
jmp 0x44226c
push str.__r_n
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x22
push dword [ebp - 0x238]
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
jne 0x44226c
push 0x45aca0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x238]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x248], ebx
jne 0x4422a0
push 0x22
push dword [ebp - 0x238]
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
jne 0x4422a0
push 0x45aca0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
push dword [ebp - 0x250]
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov dword [ebp - 0x240], eax
call edi
inc eax
cmp eax, 0x103
jle 0x4422d9
mov eax, 0x103
jmp 0x4422dd
push esi
call edi
inc eax
push eax
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
cmp dword [ebp - 0x240], ebx
jne 0x4425b8
push dword [ebp - 0x238]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
cmp dword [ebp + 0x74], ebx
setne al
push eax
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 0x248], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x44249d
push esi
call edi
add eax, 0x208
cmp eax, 0x1000
jle 0x442347
push esi
call edi
add eax, 0x208
jmp 0x44234c
mov eax, 0x1000
push 1
push eax
call fcn.004462a8
push 0x22
push esi
mov dword [ebp - 0x23c], eax
call fcn.00445cc0
add esp, 0x10
test eax, eax
je 0x442390
cmp dword [ebp - 0x23c], ebx
je 0x442388
push 0x22
push esi
call fcn.00445cc0
pop ecx
pop ecx
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x45aca0
jmp 0x4423c3
push 0x20
push esi
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
je 0x4423c9
cmp dword [ebp - 0x23c], ebx
je 0x4423bd
push 0x20
push esi
call fcn.00445cc0
pop ecx
pop ecx
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push str.__r_n
push esi
call fcn.0043fbb2
mov al, byte [esi]
cmp al, bl
je 0x4423f6
cmp al, 0x20
je 0x4423df
cmp al, 9
je 0x4423df
cmp al, 0xd
je 0x4423df
cmp al, 0xa
jne 0x4423f6
lea eax, [esi + 1]
push eax
call edi
inc eax
push eax
lea eax, [esi + 1]
push eax
push esi
call fcn.00446570
add esp, 0xc
jmp 0x4423c9
push esi
call edi
jmp 0x442415
mov cl, byte [eax + esi]
cmp cl, 0x20
je 0x442412
cmp cl, 9
je 0x442412
cmp cl, 0xd
je 0x442412
cmp cl, 0xa
jne 0x44241a
mov byte [eax + esi], bl
dec eax
cmp eax, ebx
jg 0x4423fb
push dword [ebp - 0x248]
push ebx
push dword [ebp - 0x23c]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov dword [ebp - 0x24c], eax
jg 0x442480
push str..EXE
push esi
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x442480
push str..EXE
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x248]
push ebx
push dword [ebp - 0x23c]
push esi
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x23c], ebx
je 0x442494
push dword [ebp - 0x23c]
call fcn.00445e06
pop ecx
cmp dword [ebp - 0x24c], 0x20
jle 0x4424de
cmp dword [ebp + 0x74], ebx
jne 0x4424cf
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebp - 0x244]
je 0x4424cf
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x244]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call fcn.00445e06
pop ecx
xor eax, eax
inc eax
jmp 0x4425e9
push str..EXE
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
jne 0x4425b8
push esi
push ebx
push dword [ebp - 0x238]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x20
jbe 0x4425b8
push str.__r_n
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x45aca0
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
jne 0x44253d
push 0x45aca0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x238]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x45aca0
push dword [ebp - 0x238]
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
jne 0x44256c
push 0x45aca0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
push dword [ebp - 0x250]
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
mov dword [ebp - 0x240], eax
call edi
inc eax
cmp eax, 0x103
jle 0x4425a5
mov eax, 0x103
jmp 0x4425a9
push esi
call edi
inc eax
push eax
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call fcn.00445e06
pop ecx
cmp dword [ebp - 0x240], ebx
jne 0x4425fd
cmp dword [ebp + 0x7c], ebx
je 0x4425e4
cmp dword [0x4725c0], ebx
je 0x4425e4
lea eax, [ebp - 0x2c]
push eax
push str.____Unable_to_start___s__with_any_method
call fcn.0042036e
pop ecx
pop ecx
mov eax, 0xffffcfc3
mov ecx, dword [ebp + 0x64]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x68
leave
ret 0x10
cmp dword [ebp - 0x260], ebx
je 0x442611
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 0x78]
cmp edi, ebx
jge 0x44261c
push 0xffffffffffffffff
jmp 0x442628
mov eax, 0x1388
cmp edi, eax
jle 0x442627
mov eax, edi
push eax
push dword [ebp - 0x264]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp dword [ebp + 0x74], ebx
jne 0x44267c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x25c]
call fcn.0044097a
mov esi, eax
cmp esi, ebx
je 0x44267c
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x44267c
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x44267c
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp edi, ebx
jne 0x44269d
cmp dword [ebp - 0x264], ebx
je 0x4424d6
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4424d6
mov eax, dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add edi, 0x1f4
mov dword [0x477604], eax
mov dword [ebp - 0x244], edi
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x254], 0x103
call esi
sub eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x244]
jae 0x442705
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x264]
call edi
cmp dword [ebp - 0x254], 0x103
je 0x4426d2
mov dword [0x477604], ebx
call esi
sub eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x244]
jb 0x442739
cmp dword [ebp - 0x264], ebx
je 0x44272f
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffcfc4
jmp 0x4425e9
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x264]
call edi
push 0xff
lea eax, [ebp - 0x234]
push eax
push str.ERRORLEVEL
mov byte [ebp - 0x234], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp dword [ebp - 0x264], ebx
je 0x442779
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x254]
jmp 0x4425e9