Function at 0x404a10
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [0x5868f4]
xor eax, esp
mov dword [esp + 0x478], eax
push esi
push 0x208
lea eax, [esp + 0x6c]
mov dword [esp + 0x1c], 0
push 0
push eax
mov esi, ecx
call fcn.00516d20
add esp, 0xc
lea eax, [esp + 0x270]
push 0x208
push 0
push eax
call fcn.00516d20
add esp, 0xc
lea eax, [esp + 8]
mov ecx, 0x10
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x404a70
mov ecx, 0x44
lea eax, [esp + 0x20]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x404a84
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x404ae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_detect_the_bitness_of_current_machine
push eax
push 0x58ba20
mov dword [esp + 0x24], eax
call fcn.00437520
mov eax, dword [esp + 0x24]
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x478]
xor ecx, esp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x1c], 0
lea eax, [esp + 0x68]
push 0x104
push eax
je 0x404b12
push str._ProgramW6432_QualysQualysAgentQualysProxy.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x404b08
cmp eax, 0x104
jb 0x404b30
push str.Failed_to_expand_Proxy_path_variable_for_OS_x64
jmp 0x404cab
push str._ProgramFiles_QualysQualysAgentQualysProxy.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x404ca6
cmp eax, 0x104
jae 0x404ca6
cmp dword [esi + 0x154], 8
lea eax, [esi + 0x140]
jb 0x404b41
mov eax, dword [eax]
push eax
push 0x56309c
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.00407d00
add esp, 0x10
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x290]
push eax
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404b9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_create_process_for_QualysProxy
jmp 0x404ab8
push 0x7530
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x18], eax
test eax, eax
je 0x404bfb
cmp eax, 0x80
je 0x404bea
cmp eax, 0x102
je 0x404bd9
push str.External_process_Qualys_Proxy_failed
push eax
push 0x58ba20
call fcn.00437520
add esp, 0xc
jmp 0x404c0d
push str.The_wait_operation_timed_out_for_QualysProxy
push 0x58ba20
call fcn.004372e0
jmp 0x404c0a
push str.The_wait_operation_abandoned_for_QualysProxy
push 0x58ba20
call fcn.004372e0
jmp 0x404c0a
push str.The_wait_operation_completed_for_QualysProxy
push 0x58ba20
call fcn.00437360
add esp, 8
lea eax, [esp + 0x18]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x404c39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_retrieve_the_termination_status_of_the_QualysProxy
push eax
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
jne 0x404c5d
push str.Failed_to_set_proxy__QualysProxy_returns__1
push 0x58ba20
call fcn.004372e0
mov eax, 0x57
add esp, 8
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ecx, ecx
je 0x404c7f
cmp ecx, 0xffffffff
je 0x404c7f
push ecx
call esi
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x404cbd
cmp ecx, 0xffffffff
je 0x404cbd
push ecx
call esi
mov eax, dword [esp + 0x18]
pop esi
mov ecx, dword [esp + 0x478]
xor ecx, esp
call fcn.004fdf3d
mov esp, ebp
pop ebp
push str.Failed_to_expand_Proxy_path_variable_for_OS_x86
push 0x58ba20
call fcn.004372e0
mov eax, 0x7a
add esp, 8
mov ecx, dword [esp + 0x47c]
pop esi
xor ecx, esp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret