Function at 0x403820
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x425219
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x10084
call fcn.0041ff90
mov eax, dword [0x4304f0]
xor eax, esp
mov dword [esp + 0x10080], eax
push ebx
push esi
push edi
mov eax, dword [0x4304f0]
xor eax, esp
push eax
lea eax, [esp + 0x10098]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x1b], 0
call fcn.00404010
test al, al
jne 0x4038ac
mov eax, dword [ebx + 4]
cmp dword [eax + 4], edi
jne 0x4038b3
call fcn.00406730
mov esi, eax
mov ecx, esi
call fcn.00406810
test al, al
je 0x4038a5
mov ecx, esi
call fcn.00406be0
mov edi, ebx
call fcn.00404830
xor eax, eax
jmp 0x403c9b
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov dword [esp + 0x100a0], edi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov edi, 0x200
sub eax, edi
or eax, ecx
jge 0x4038f6
mov eax, edi
lea ecx, [esp + 0x20]
call fcn.00401be0
mov esi, dword [esp + 0x20]
cmp dword [esi - 8], edi
jge 0x403905
push 0x80070057
call fcn.00401000
push edi
push esi
xor ecx, ecx
mov dword [esi - 0xc], edi
push 0x42950c
mov word [esi + 0x400], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40399f
push 0x42950c
push str._s_environment_variable_found__entering_blocking_mode
call fcn.004116b0
mov eax, dword [esi - 8]
push eax
push esi
call fcn.00413c94
add esp, 0x10
test eax, eax
js 0x4038fb
cmp eax, dword [esi - 8]
jg 0x4038fb
xor edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], dx
mov byte [esp + 0x17], 1
xor bl, bl
xor edi, edi
mov dword [esp + 0x100a0], edi
test byte [esp + 0x18], 1
je 0x403987
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403987
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4039d3
push 0x42950c
push str._wait_option_is_set__entering_blocking_mode
call fcn.004116b0
add esp, 8
jmp 0x4039da
lea eax, [esp + 0x1c]
push eax
mov ecx, str.wait
call fcn.00401310
mov byte [esp + 0x100a0], 1
mov ecx, dword [ebx + 4]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], 1
call fcn.00405cf0
test al, al
je 0x403955
mov bl, 1
jmp 0x403957
cmp byte [esp + 0x17], 0
je 0x4039f8
mov edi, dword [esp + 0x28]
call fcn.00404830
test al, al
jne 0x403c70
mov dword [esp + 0x24], 1
jmp 0x403c70
lea esi, [esp + 0x8c]
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp word [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x28], eax
mov edi, eax
je 0x403a53
jmp 0x403a20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call ebx
mov ecx, dword [esp + 0x18]
add ecx, eax
mov dword [esp + 0x18], ecx
cmp ecx, 0x7530
ja 0x403a53
push esi
call ebx
push edi
lea esi, [esi + eax*2 + 2]
call ebx
cmp word [edi + eax*2 + 2], 0
lea edi, [edi + eax*2 + 2]
jne 0x403a20
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x42950c
push str._s1
lea edi, [esp + 0x20]
mov byte [esp + 0x100a8], 2
call fcn.00404c80
mov edi, dword [esp + 0x20]
add esp, 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call ebx
push esi
call ebx
mov edx, dword [esp + 0x28]
lea esi, [esi + eax*2 + 2]
xor ecx, ecx
push edx
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea esi, [esp + 0x2c]
call fcn.004047d0
xor eax, eax
mov byte [esp + 0x100a0], 3
push 0x44
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x4c]
push eax
call fcn.004158a0
add esp, 0xc
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x1c]
push edx
mov ecx, eax
call fcn.00401310
mov bl, 4
mov byte [esp + 0x100a0], bl
mov eax, dword [esp + 0x1c]
mov esi, 1
cmp dword [eax - 4], esi
jle 0x403b2f
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00401700
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x48]
push ecx
push 0
lea edx, [esp + 0x98]
push edx
push 0x20404
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403ba0
push str.Handler_process_successfully_spawned
call fcn.004116d0
add esp, 4
call fcn.004115e0
mov esi, eax
call fcn.00411a00
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esp + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x30]
push eax
call esi
mov dword [esp + 0x24], 0
jmp 0x403bf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x40]
push ecx
mov ecx, eax
call fcn.00412d50
add esp, 4
mov byte [esp + 0x100a0], 5
mov eax, dword [eax]
push eax
push str.Failed_to_launch_handler_process.__s
call fcn.00411710
mov byte [esp + 0x100a8], bl
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403bf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], esi
mov byte [esp + 0x100a0], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c20
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x100a0], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x100a0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x20]
lea eax, [esi - 0x10]
mov dword [esp + 0x100a0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10098]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10080]
xor ecx, esp
call fcn.00413430
mov esp, ebp
pop ebp
ret