Function at 0x4012e0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
push ecx
mov dword [ebp - 0x41c], edi
call fcn.00401000
lea eax, [edi + 1]
add esp, 4
cmp ecx, eax
jle 0x401325
mov edx, dword [ebx + eax*4]
push edx
push eax
call fcn.00401000
inc eax
add esp, 8
cmp eax, ecx
jl 0x401313
cmp ecx, 6
jge 0x40134c
mov eax, dword [ebx]
push eax
push str.Usage:__s__4_InheritableEventHandles___CommandLineToSpawn__n
call fcn.00401ee5
add esp, 8
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401eb5
mov esp, ebp
pop ebp
ret
push esi
mov byte [ebp - 0x20c], 0
mov dword [ebp - 0x418], 5
cmp ecx, 5
jle 0x4013c6
mov ecx, dword [ebp - 0x418]
mov eax, dword [ebx + ecx*4]
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401370
lea edi, [ebp - 0x20c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401382
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4013a0
mov eax, dword [ebp - 0x418]
mov dx, word [0x40a23c]
inc eax
mov word [edi], dx
mov dword [ebp - 0x418], eax
cmp eax, dword [ebp + 8]
jl 0x401363
xor edi, edi
lea eax, [ebp - 0x20c]
push eax
call fcn.00401000
add esp, 4
push 0x208
lea ecx, [ebp - 0x414]
push ecx
mov edx, eax
push edx
mov byte [ebp - 0x414], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x414]
push eax
call fcn.00401000
push 0x40
lea ecx, [ebp - 0x48c]
push edi
push ecx
call fcn.00401fb0
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor eax, eax
add esp, 0x10
push 0xfffffffffffffff6
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x490], 0x44
mov dword [ebp - 0x464], 0x180
call esi
push 0xfffffffffffffff5
mov dword [ebp - 0x458], eax
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x454], eax
call esi
lea edx, [ebp - 0x420]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x458]
push edx
push eax
mov dword [ebp - 0x420], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x4014b2
mov esi, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x458]
and esi, 0xfffffff8
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x4014b2
mov edx, dword [ebp - 0x420]
push esi
push edx
call fcn.00401000
add esp, 8
jmp 0x4014c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401000
add esp, 4
push 1
push 0x401280
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov eax, dword [ebx + 4]
push eax
call fcn.00401eda
mov ecx, dword [ebx + 8]
push ecx
mov dword [ebp - 0x448], eax
call fcn.00401eda
mov edx, dword [ebx + 0xc]
push edx
mov dword [ebp - 0x444], eax
call fcn.00401eda
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 0x10]
push eax
call fcn.00401eda
add esp, 0x10
push str.Kernel32.dll
mov dword [ebp - 0x43c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push str.Wow64DisableWow64FsRedirection
push ebx
mov dword [ebp - 0x4e8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x40153b
lea ecx, [ebp - 0x438]
push ecx
call eax
jmp 0x401543
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x490]
push eax
push edi
push edi
push 0x200
push 1
push edi
push edi
lea ecx, [ebp - 0x414]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401742
mov edx, dword [ebp - 0x42c]
push edx
call edi
mov eax, dword [ebp - 0x430]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [ebp - 0x44c], eax
lea esp, [esp]
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x44c]
push ecx
push 4
call esi
cmp eax, 4
ja case.default.0x4015b4
jmp dword [eax*4 + 0x4017b4]
call fcn.00401000
mov edx, dword [ebp - 0x424]
push 0
push edx
call fcn.004011d0
mov eax, dword [ebp - 0x428]
add esp, 8
push eax
push 0
jmp 0x4015ea
call fcn.00401000
mov ecx, dword [ebp - 0x428]
push ecx
push 1
call ebx
test eax, eax
jne case.default.0x4015b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401000
add esp, 4
jmp case.default.0x4015b4
call fcn.00401000
mov eax, dword [ebp - 0x430]
lea edx, [ebp - 0x434]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x41c], 1
jmp 0x401714
call fcn.00401000
mov ecx, dword [ebp - 0x428]
push ecx
push 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40164e
call esi
push eax
call fcn.00401000
add esp, 4
call fcn.00401000
mov eax, dword [ebp - 0x458]
push 0
lea edx, [ebp - 0x418]
push edx
push 0xf
push str.Exit_nExit_nExit_n
push eax
mov dword [ebp - 0x418], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x418]
push ecx
call fcn.00401000
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401000
mov edx, dword [ebp - 0x458]
push edx
call edi
test eax, eax
jne 0x4016ae
call esi
push eax
call fcn.00401000
add esp, 4
call fcn.00401000
mov eax, dword [ebp - 0x454]
push eax
call edi
test eax, eax
jne 0x4016cb
call esi
push eax
call fcn.00401000
add esp, 4
call fcn.00401000
mov ecx, dword [ebp - 0x450]
push ecx
call edi
test eax, eax
jne 0x4016e8
call esi
push eax
call fcn.00401000
add esp, 4
mov edx, dword [ebp - 0x430]
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne case.0x4015b4.3
call fcn.00401000
mov dword [ebp - 0x41c], 1
jmp 0x401714
call fcn.00401000
mov eax, dword [ebp - 0x430]
push eax
call edi
cmp dword [ebp - 0x41c], 0
jne 0x40173c
call fcn.00401000
mov ecx, dword [ebp - 0x424]
push 1
push ecx
call fcn.004011d0
add esp, 8
mov ebx, dword [ebp - 0x4e8]
mov esi, dword [ebp - 0x438]
push str.Wow64RevertWow64FsRedirection
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40175d
push esi
call eax
jmp 0x401765
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [ebp - 0x448]
push edx
call edi
mov eax, dword [ebp - 0x444]
push eax
call edi
mov ecx, dword [ebp - 0x440]
push ecx
call edi
mov edx, dword [ebp - 0x43c]
push edx
call edi
call fcn.00401000
mov esi, dword [ebp - 0x434]
test ebx, ebx
je 0x40179f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00401eb5
mov esp, ebp
pop ebp
ret