Function at 0x401670
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
sub esp, 0x248
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp ebp, ebx
jle 0x4016ac
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop
mov eax, dword [0x4a9f9c]
mov ecx, dword [esp + 0x260]
mov edx, dword [ecx + edi*4]
push eax
push edx
call esi
test eax, eax
je 0x4016b7
inc edi
cmp edi, ebp
jl 0x401690
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret
cmp edi, ebx
mov dword [esp + 0x10], edi
jle 0x4016ac
push 0x207
lea eax, [esp + 0x55]
push ebx
push eax
mov byte [esp + 0x5c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x208
lea ecx, [esp + 0x50]
nop
cmp byte [ecx], bl
je 0x4016ec
inc ecx
sub eax, 1
jne 0x4016e0
jmp 0x401730
cmp eax, ebx
je 0x401730
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x40172d
mov edi, dword [0x4aa0cc]
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401729
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401729
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401713
jmp 0x40172d
cmp ecx, ebx
jne 0x40172e
dec eax
mov byte [eax], bl
mov ecx, 0x208
lea eax, [esp + 0x50]
lea esp, [esp]
cmp byte [eax], bl
je 0x40174c
inc eax
sub ecx, 1
jne 0x401740
jmp 0x40178f
cmp ecx, ebx
je 0x40178f
mov edx, 0x208
sub edx, ecx
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x40178c
mov edi, 0x42a7a8
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401788
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401788
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401772
jmp 0x40178c
cmp ecx, ebx
jne 0x40178d
dec eax
mov byte [eax], bl
mov ebp, 1
cmp dword [esp + 0x25c], ebp
jle 0x401873
cmp ebp, dword [esp + 0x10]
je 0x401865
mov ecx, dword [esp + 0x260]
mov edi, dword [ecx + ebp*4]
mov eax, 0x208
lea ecx, [esp + 0x50]
mov edi, edi
cmp byte [ecx], bl
je 0x4017cc
inc ecx
sub eax, 1
jne 0x4017c0
jmp 0x40180d
cmp eax, ebx
je 0x40180d
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x40180a
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
lea ecx, [ecx]
cmp esi, ebx
je 0x401806
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401806
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x4017f0
jmp 0x40180a
cmp ecx, ebx
jne 0x40180b
dec eax
mov byte [eax], bl
mov eax, 0x208
lea ecx, [esp + 0x50]
cmp byte [ecx], bl
je 0x401822
inc ecx
sub eax, 1
jne 0x401816
jmp 0x401865
cmp eax, ebx
je 0x401865
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401862
mov edi, 0x42a7a8
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x40185e
mov dl, byte [edi + eax]
cmp dl, bl
je 0x40185e
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401848
jmp 0x401862
cmp ecx, ebx
jne 0x401863
dec eax
mov byte [eax], bl
inc ebp
cmp ebp, dword [esp + 0x25c]
jl 0x4017a1
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, dword [0x4aa14c]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [0x4aa064]
mov edx, dword [esp + 0x26c]
mov eax, dword [edx]
add esp, 0xc
mov dword [esp + 0x20], ecx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x50]
push edx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4016ac
mov eax, dword [esp + 0x4c]
push 0xffffffffffffffff
push eax
mov dword [esp + 0x18], 0x41
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]