Function at 0x402030
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d6e6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x8f0
mov eax, dword [0x42c070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 8]
xor al, al
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x42dc68
push 0x67
push edi
mov byte [ebp - 0x7b9], al
call esi
push 0x64
push 0x42dc00
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.004025e0
push 0
push edi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x42dc68
push 0x42dc00
push 0
mov dword [0x42dbf8], edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 0x7c4], eax
test eax, eax
je 0x40252c
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x7c8], eax
lea eax, [ebp - 0x578]
push 0x12c
push eax
push str.ALLUSERSPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4024a5
push str.ExtensisPortfolio_Server.preferences
mov edx, 0x12c
lea ecx, [ebp - 0x578]
call fcn.00401f30
sub esp, 0xc
lea eax, [ebp - 0x578]
lea ecx, [ebp - 0x8b8]
push eax
call fcn.004029d0
cmp dword [ebp - 0x85c], 0
je 0x40236f
push str.esp.port.admin_web_app
lea ecx, [ebp - 0x7a0]
mov dword [ebp - 0x774], 0xf
mov dword [ebp - 0x778], 0
mov byte [ebp - 0x788], 0
call fcn.00402970
mov ecx, dword [ebp - 0x8b8]
mov eax, dword [ecx + 4]
test byte [ebp + eax - 0x8ac], 1
jne 0x4022fb
nop dword [eax + eax]
lea ecx, [ebp - 0x8b8]
mov dword [ebp - 0x7a4], 0xf
add ecx, eax
mov dword [ebp - 0x7a8], 0
lea eax, [ebp - 0x7d0]
mov byte [ebp - 0x7b8], 0
push eax
call fcn.00401c70
push eax
call fcn.00405120
add esp, 4
mov esi, eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x7cc]
test ecx, ecx
je 0x4021ee
mov edx, dword [ecx]
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x4021ee
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
mov eax, dword [esi]
push 0xa
mov eax, dword [eax + 0x20]
call eax
mov byte [ebp - 0x7bd], al
lea ecx, [ebp - 0x8b8]
push dword [ebp - 0x7bd]
lea eax, [ebp - 0x148]
sub esp, 8
push eax
call fcn.00404670
cmp byte [ebp - 0x148], 0
jne 0x40222e
xor eax, eax
jmp 0x402240
lea eax, [ebp - 0x148]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402237
sub eax, edx
push eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x788]
call fcn.004049f0
push dword [ebp - 0x790]
cmp dword [ebp - 0x78c], 0x10
lea eax, [ebp - 0x7a0]
push ecx
cmovae eax, dword [ebp - 0x7a0]
lea ecx, [ebp - 0x788]
push eax
call fcn.00403bf0
cmp eax, 0xffffffff
je 0x4022cf
push 0x17
push 0
lea ecx, [ebp - 0x788]
mov byte [ebp - 0x7b9], 1
call fcn.004027e0
push str.http:__127.0.0.1:
mov edx, 0x1f4
lea ecx, [ebp - 0x770]
call fcn.00401ec0
cmp dword [ebp - 0x774], 0x10
lea eax, [ebp - 0x788]
mov edx, 0x1f4
lea ecx, [ebp - 0x770]
cmovae eax, dword [ebp - 0x788]
push eax
call fcn.00401f30
lea ecx, [ebp - 0x7b8]
call fcn.00402880
mov ecx, dword [ebp - 0x8b8]
mov eax, dword [ecx + 4]
test byte [ebp + eax - 0x8ac], 1
je 0x402190
mov al, byte [ebp - 0x7b9]
test al, al
jne 0x40231d
mov eax, dword [ecx + 4]
test byte [ebp + eax - 0x8ac], 1
je 0x40231d
push str.http:__127.0.0.1:8091
mov edx, 0x1f4
lea ecx, [ebp - 0x770]
call fcn.00401ec0
lea ecx, [ebp - 0x8a8]
call fcn.004044f0
test eax, eax
jne 0x402357
mov eax, dword [ebp - 0x8b8]
lea ecx, [ebp - 0x8b8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, 2
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], 0
cmovne eax, edx
push eax
call fcn.00401ba0
lea ecx, [ebp - 0x7a0]
call fcn.00402880
lea ecx, [ebp - 0x788]
call fcn.00402880
jmp 0x402384
push str.http:__127.0.0.1:8091
mov edx, 0x1f4
lea ecx, [ebp - 0x770]
call fcn.00401ec0
lea ecx, [ebp - 0x8b8]
call fcn.00402550
mov esi, dword [sym.imp.SHELL32.dll_FindExecutableA]
lea eax, [ebp - 0x448]
push eax
push 0
push str.webadmin.htm
call esi
cmp eax, 0x20
jg 0x4023c3
lea eax, [ebp - 0x448]
push eax
push 0
push str.webadmin.html
call esi
cmp eax, 0x20
jle 0x4024a5
push 0x44
lea eax, [ebp - 0x900]
push 0
push eax
call fcn.004094f0
lea ecx, [ebp - 0x348]
mov dword [ebp - 0x900], 0x44
xorps xmm0, xmm0
mov esi, 0x4295c0
mov eax, ecx
add esp, 0xc
movups xmmword [ebp - 0x7fc], xmm0
mov edx, 0x200
sub esi, eax
nop
lea eax, [edx + 0x7ffffdfe]
test eax, eax
je 0x402419
mov al, byte [ecx + esi]
test al, al
je 0x402419
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402400
test edx, edx
lea eax, [ecx - 1]
mov edx, 0x200
cmovne eax, ecx
lea ecx, [ebp - 0x348]
mov byte [eax], 0
lea eax, [ebp - 0x448]
push eax
call fcn.00401f30
push 0x4295c4
mov edx, 0x200
lea ecx, [ebp - 0x348]
call fcn.00401f30
lea eax, [ebp - 0x770]
mov edx, 0x200
push eax
lea ecx, [ebp - 0x348]
call fcn.00401f30
push 0x4295c0
mov edx, 0x200
lea ecx, [ebp - 0x348]
call fcn.00401f30
lea eax, [ebp - 0x7fc]
push eax
lea eax, [ebp - 0x900]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x348]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x10
push dword [ebp - 0x7c4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x7ec]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x402526
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop word [eax + eax]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x7c8]
push dword [ebp - 0x7ec]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x402513
lea eax, [ebp - 0x7ec]
push eax
call edi
lea eax, [ebp - 0x7ec]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x7ec]
push eax
call esi
test eax, eax
jne 0x4024e0
mov eax, dword [ebp - 0x7e4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406660
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10