Function at 0x4281d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov eax, dword [0x4df19c]
mov esi, dword [ebp + 0x10]
lea ecx, [esp + 0xf0]
xor eax, ebp
mov dword [esp + 0x138], eax
call fcn.00434520
cmp dword [esi + 0x14], 1
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
sete al
cmp edi, ebx
je 0x42822a
mov eax, ebx
sub eax, edi
sar eax, 2
cmp eax, 0x3fffffff
ja 0x4286d0
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x428670
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp byte [edi + 0x11], 0
je 0x42823d
or byte [esp + 0x11c], 0x80
cmp byte [edi + 0x28], 0
mov byte [esp + 0xf], al
je 0x428252
mov dword [esp + 0xf8], 0x4bd2ae
mov eax, dword [esp + 0x11c]
mov ecx, eax
or ecx, 1
mov dword [esp + 0x11c], ecx
movzx ecx, byte [edi + 0x10]
xor ecx, 1
mov word [esp + 0x120], cx
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0x428280
mov edx, dword [edi + 0x34]
jmp 0x42828d
mov edx, dword [edi + 0x34]
test edx, edx
jne 0x42828d
cmp dword [edi + 0x38], 0
je 0x4282b1
or eax, 0x101
mov dword [esp + 0x11c], eax
mov dword [esp + 0x128], ecx
mov dword [esp + 0x12c], edx
mov eax, dword [edi + 0x38]
mov dword [esp + 0x130], eax
cmp dword [edi + 0x2c], 0
je 0x4282c8
call fcn.00434da0
lea ecx, [ebx + 0x1000000]
cmp eax, 5
cmovl ebx, ecx
mov esi, dword [ebp + 0x10]
mov edi, ebx
xorps xmm0, xmm0
or edi, 0x1000000
cmp byte [esi + 0x3c], 0
movaps xmmword [esp + 0x40], xmm0
movzx eax, byte [esi + 0xf]
cmove edi, ebx
test al, al
jns 0x4282f2
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
jmp 0x4282f5
lea ecx, [esi + 4]
test eax, eax
lea ebx, [esp + 0x34]
cmove ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, ebx
push dword [ebp + 0xc]
call fcn.0041f4ec
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4283a7
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x18]
push 0
push eax
push ecx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x42838b
or edi, 0x400
mov ecx, dword [esp + 0x18]
movzx eax, byte [esp + 0xf]
cmp byte [esp + 0x3f], 0
jns 0x42834a
mov ebx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push edx
lea edx, [esp + 0xf4]
push edx
push dword [esp + 0x18]
push ecx
push edi
push eax
push 0
push 0
push ebx
push 0
mov eax, dword [ebp + 0x10]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
push dword [esp + 0x18]
call sub.USERENV.dll_DestroyEnvironmentBlock
test edi, edi
je 0x42838b
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
jmp 0x428572
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.00428770
cmp byte [esp + 0x3f], 0
jns 0x4286dc
jmp 0x42862e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
cmp byte [esi + 0x4c], 0
je 0x4283f3
lea eax, [esi + 0x40]
lea ecx, [esp + 0x28]
push eax
push 0x4c22c6
push ecx
call fcn.00434dc0
add esp, 0xc
cmp byte [esp + 0x23], 0
js 0x428441
mov ebx, dword [ebp + 8]
mov word [esp + 0x18], 0
mov byte [esp + 0x23], 0
jmp 0x428470
cmp dword [esi + 0x48], 0
je 0x428494
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x428536
mov edx, eax
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x28]
lea eax, [eax + 0x40]
push eax
mov dword [esp + 0x18], edx
push edx
push ecx
call fcn.00434dc0
add esp, 0xc
cmp byte [esp + 0x23], 0
js 0x42849b
mov word [esp + 0x18], 0
mov byte [esp + 0x23], 0
jmp 0x4284c7
mov eax, dword [esp + 0x18]
mov ebx, dword [ebp + 8]
mov word [eax], 0
mov dword [esp + 0x1c], 0
cmp byte [esp + 0x23], 0
jns 0x428470
push dword [esp + 0x18]
call fcn.00495666
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
lea esi, [esp + 0x18]
mov dword [esp + 0x20], eax
movsd qword [esp + 0x18], xmm0
cmp byte [esi + 0xb], 0
jns 0x4284ef
mov eax, dword [esp + 0x18]
jmp 0x4284f3
mov ebx, dword [ebp + 8]
xor eax, eax
jmp 0x4284f9
mov eax, dword [esp + 0x18]
mov word [eax], 0
mov dword [esp + 0x1c], 0
cmp byte [esp + 0x23], 0
jns 0x4284c7
push dword [esp + 0x18]
call fcn.00495666
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
lea esi, [esp + 0x18]
mov dword [esp + 0x20], eax
movsd qword [esp + 0x18], xmm0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp byte [esi + 0xb], 0
js 0x42848e
lea eax, [esp + 0x18]
or edi, 0x400
movzx ecx, byte [esp + 0xf]
cmp byte [esp + 0x3f], 0
jns 0x42850b
mov edx, dword [esp + 0x34]
jmp 0x42850f
lea edx, [esp + 0x34]
lea esi, [esp + 0x40]
push esi
lea esi, [esp + 0xf4]
push esi
push dword [esp + 0x18]
push eax
push edi
push ecx
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor esi, esi
test eax, eax
jne 0x428544
mov ecx, ebx
push 0
call fcn.00428770
mov esi, 1
cmp byte [esp + 0x23], 0
mov edi, dword [ebp + 0x10]
js 0x428562
test esi, esi
je 0x428572
cmp byte [esp + 0x3f], 0
jns 0x4286dc
jmp 0x42862e
push dword [esp + 0x18]
call fcn.00495666
add esp, 4
test esi, esi
jne 0x428552
lea eax, [esp + 0x40]
lea ecx, [esp + 0x18]
push eax
call fcn.004351c0
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x428596
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x4285ea
cmp byte [edi + 0x3d], 0
je 0x4285af
push dword [esp + 0x18]
call fcn.0042fdd0
add esp, 4
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [edi], 0
je 0x4285c0
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x20]
mov ecx, dword [0x4e1848]
test ecx, ecx
je 0x4285d7
push dword [ebp + 0xc]
push eax
call fcn.00432c50
lea ecx, [esp + 0x18]
call fcn.00435300
mov ecx, ebx
push eax
call fcn.00428770
jmp 0x42861a
lea ecx, [esp + 0x18]
call fcn.00435300
lea edi, [esp + 0x28]
mov ecx, edi
push eax
call fcn.00428770
mov ecx, edi
push 1
push 1
call fcn.00428990
mov ecx, ebx
push 0
call fcn.00428770
mov ecx, edi
call fcn.00402040
lea ecx, [esp + 0x18]
call fcn.00435210
cmp byte [esp + 0x3f], 0
jns 0x4286dc
push dword [esp + 0x34]
call fcn.00495666
add esp, 4
jmp 0x4286dc
call sub.KERNEL32.dll_GetLastError
lea ecx, [esp + 0x40]
push eax
push 3
push 0xdd
push str..._.._base_process_launch_win.cc
call fcn.00427140
lea ecx, [esp + 0x40]
call fcn.00427200
jmp 0x42867c
push 1
push 1
push dword [edi]
call esi
test eax, eax
je 0x42863f
add edi, 4
cmp ebx, edi
jne 0x428670
lea ecx, [esp + 0xf0]
push 1
call fcn.00434640
test al, al
je 0x4286d0
mov edi, dword [ebp + 0x10]
lea ecx, [esp + 0xf0]
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
sub edx, eax
push edx
push eax
push 0x20002
call fcn.004346d0
mov ebx, dword [ebp + 8]
test al, al
je 0x4286d3
mov al, 1
mov ebx, 0x80000
cmp byte [edi + 0x11], 0
jne 0x428235
jmp 0x42823d
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.00428770
lea ecx, [esp + 0xf0]
call fcn.00434610
mov ecx, dword [esp + 0x138]
xor ecx, ebp
call fcn.004956a1
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret