Function at 0x401010
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
sub esp, 0x248
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp ebp, ebx
jle 0x40104c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop
mov eax, dword [0x433ac0]
mov ecx, dword [esp + 0x260]
mov edx, dword [ecx + edi*4]
push eax
push edx
call esi
test eax, eax
je 0x401057
inc edi
cmp edi, ebp
jl 0x401030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret
cmp edi, ebx
mov dword [esp + 0x10], edi
jle 0x40104c
push 0x207
lea eax, [esp + 0x55]
push ebx
push eax
mov byte [esp + 0x5c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x208
lea ecx, [esp + 0x50]
nop
cmp byte [ecx], bl
je 0x40108c
inc ecx
sub eax, 1
jne 0x401080
jmp 0x4010d0
cmp eax, ebx
je 0x4010d0
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x4010cd
mov edi, dword [0x433b00]
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x4010c9
mov dl, byte [edi + eax]
cmp dl, bl
je 0x4010c9
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x4010b3
jmp 0x4010cd
cmp ecx, ebx
jne 0x4010ce
dec eax
mov byte [eax], bl
mov ecx, 0x208
lea eax, [esp + 0x50]
lea esp, [esp]
cmp byte [eax], bl
je 0x4010ec
inc eax
sub ecx, 1
jne 0x4010e0
jmp 0x40112f
cmp ecx, ebx
je 0x40112f
mov edx, 0x208
sub edx, ecx
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x40112c
mov edi, 0x40f4b0
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401128
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401128
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401112
jmp 0x40112c
cmp ecx, ebx
jne 0x40112d
dec eax
mov byte [eax], bl
mov ebp, 1
cmp dword [esp + 0x25c], ebp
jle 0x401213
cmp ebp, dword [esp + 0x10]
je 0x401205
mov ecx, dword [esp + 0x260]
mov edi, dword [ecx + ebp*4]
mov eax, 0x208
lea ecx, [esp + 0x50]
mov edi, edi
cmp byte [ecx], bl
je 0x40116c
inc ecx
sub eax, 1
jne 0x401160
jmp 0x4011ad
cmp eax, ebx
je 0x4011ad
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x4011aa
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
lea ecx, [ecx]
cmp esi, ebx
je 0x4011a6
mov dl, byte [edi + eax]
cmp dl, bl
je 0x4011a6
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401190
jmp 0x4011aa
cmp ecx, ebx
jne 0x4011ab
dec eax
mov byte [eax], bl
mov eax, 0x208
lea ecx, [esp + 0x50]
cmp byte [ecx], bl
je 0x4011c2
inc ecx
sub eax, 1
jne 0x4011b6
jmp 0x401205
cmp eax, ebx
je 0x401205
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401202
mov edi, 0x40f4b0
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x4011fe
mov dl, byte [edi + eax]
cmp dl, bl
je 0x4011fe
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x4011e8
jmp 0x401202
cmp ecx, ebx
jne 0x401203
dec eax
mov byte [eax], bl
inc ebp
cmp ebp, dword [esp + 0x25c]
jl 0x401141
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, dword [0x433a10]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [0x433b98]
mov edx, dword [esp + 0x26c]
mov eax, dword [edx]
add esp, 0xc
mov dword [esp + 0x20], ecx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40104c
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x18], 0x41
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]