Function at 0x4367f0
Capabilities:
Create process on windows
Resume thread
Set environment variable
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x441004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xb4], eax
xor ebx, ebx
mov eax, dword [0x441180]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [eax + 0xc]
mov ecx, esi
mov dword [ebp - 0xac], edi
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
lea ecx, [ebp - 0xa4]
push edi
mov dword [ebp - 0xa4], eax
call fcn.00433e40
test al, al
jne 0x43687e
test edi, edi
jne 0x43685d
xor ecx, ecx
jmp 0x436871
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436862
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0xa4]
call fcn.00435250
mov eax, dword [0x441180]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4422c4]
mov ecx, 0x441180
call esi
add eax, 0x10
mov dword [ebp - 0x10c], 0x44
xor edi, edi
mov dword [ebp - 0x98], eax
mov eax, edi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
cmp dword [0x441604], eax
je 0x436931
push dword [ebp - 0xac]
push 0x42c94c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x10
push dword [0x4410e0]
lea eax, [ebp - 0x98]
push 0x42c96c
push eax
call fcn.00437aa0
mov esi, dword [ebp - 0x98]
add esp, 0xc
push esi
push 0x42c974
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x4369de
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x436976
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], edi
je 0x436d2e
push 0x42c990
push dword [ebp - 0x98]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], edi
je 0x436d2e
push 0x146
push 0x42c608
push 0x42b77c
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x14
jmp 0x436d2e
push dword [ebp - 0xa8]
push 0x42c9c8
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x436a5a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x436a08
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], edi
je 0x436d2e
push 0x42c9f0
push dword [ebp - 0x98]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], edi
je 0x436d2e
push 0x149
jmp 0x4369c3
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0xa8]
test eax, eax
jne 0x436a7b
mov dword [ebp - 0x94], eax
jmp 0x436b60
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436a80
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ecx + 1]
lea edi, [eax*4]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x90]
mov edx, edi
push eax
lea ecx, [ebp - 0x94]
call fcn.00435b99
push 0
push 0
push edi
push dword [ebp - 0x94]
mov edi, dword [ebp - 0xa8]
push dword [ebp - 0xa0]
push edi
push 0
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0xac], ecx
test eax, eax
jne 0x436b52
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x436b4c
push 0
push 0
push 0
push 0
push dword [ebp - 0xa0]
push edi
push 0
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov edi, eax
lea eax, [ebp - 0x90]
push ecx
push eax
mov edx, edi
lea ecx, [ebp - 0x94]
call fcn.00435b99
push 0
push 0
push edi
push dword [ebp - 0x94]
push dword [ebp - 0xa0]
push dword [ebp - 0xa8]
push 0
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
jmp 0x436b52
mov ecx, dword [ebp - 0xac]
test ecx, ecx
jne 0x436daf
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
cmp dword [eax - 4], 1
jle 0x436b80
push dword [eax - 0xc]
lea ecx, [ebp - 0xa4]
call fcn.004350f0
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0x4000004
push 0
push 0
push 0
push dword [ebp - 0xa4]
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
mov edi, dword [ebp - 0xc4]
mov ecx, eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xa0], eax
test ecx, ecx
jne 0x436bcc
mov byte [ebp - 0x99], 1
jmp 0x436c1e
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x436bdc
mov dword [ebp - 0xb0], ecx
xor eax, eax
lea edx, [ebp - 0xb0]
test ecx, ecx
mov ecx, edi
setne al
push eax
call fcn.0043f64b
test eax, eax
jne 0x436c0c
push 0xffffffffffffffff
push dword [ebp - 0xc4]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov byte [ebp - 0x99], 1
jmp 0x436c1e
push dword [ebp - 0xc0]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
mov byte [ebp - 0x99], bl
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
cmp eax, ecx
je 0x436c38
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
cmp byte [ebp - 0x99], bl
je 0x436cad
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x436c55
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x98]
mov dword [ebp - 0x98], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x436d2e
push 0x42ca40
push dword [ebp - 0x98]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x436d2e
push 0x158
jmp 0x4369c3
mov eax, dword [ebp - 0xa0]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x436d24
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x436cd4
movzx ebx, bx
or ebx, 0x80070000
lea edx, [ebp - 0x98]
mov dword [ebp - 0x98], 0
mov ecx, ebx
call fcn.00435760
cmp dword [0x441604], 0
je 0x436d2e
push 0x42cac8
push dword [ebp - 0x98]
push ebx
push 0x42b728
push 7
push 0xfffffffffffffff4
call fcn.004357e0
add esp, 0x18
cmp dword [0x441604], 0
je 0x436d2e
push 0x15b
jmp 0x4369c3
mov eax, dword [ebp - 0xb4]
mov dword [eax], edi
xor edi, edi
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x436d3f
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test edi, edi
je 0x436d4a
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
or ecx, 0xffffffff
add esi, 0xfffffff0
mov eax, ecx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x436d73
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
or ecx, 0xffffffff
mov eax, dword [ebp - 0xa4]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x436d9a
mov edi, dword [eax]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x4422c4]
mov ecx, edi
call esi
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ffc0
mov esp, ebp
pop ebp
ret 0xc
call fcn.00435b80
int3