Function at 0x40a6e5
Capabilities:
Create process on windows
Query environment variable
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34a18
call fcn.0042c4d8
push ebx
push esi
push edi
push 0x30c
push 0x468658
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.0040a669
push eax
lea eax, [ebp - 0x34a18]
push str.PR:_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
lea eax, [ebp - 0x34a18]
push eax
call edi
lea esi, [ebp + eax*2 - 0x34a16]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ebx, eax
jmp 0x40a769
cmp word [ebx], 0
je 0x40a76d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call edi
push esi
lea ebx, [ebx + eax*2 + 2]
call edi
lea esi, [esi + eax*2 + 2]
test ebx, ebx
jne 0x40a74d
xor eax, eax
push 2
mov word [esi], ax
push eax
mov esi, 0x468658
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor ebx, ebx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40aa23
push 0x22
pop eax
mov word [ebp - 0x2a18], ax
xor eax, eax
mov word [ebp - 0x2a16], ax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2a18]
push eax
call esi
mov edi, 0x42e1ec
push edi
lea eax, [ebp - 0x2a18]
push eax
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x42e1d4
lea eax, [ebp - 0x2a18]
push eax
call esi
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x40a80b
cmp word [eax], bx
je 0x40a80b
push 0x42e1bc
lea eax, [ebp - 0x2a18]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x2a18]
push eax
call esi
push 0x42e1b8
lea eax, [ebp - 0x2a18]
push eax
call esi
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40a8a2
cmp word [eax], bx
je 0x40a8a2
push eax
lea ecx, [ebp - 0x34]
call fcn.00404cea
push 1
push ebx
mov edi, 0x42e1b4
push edi
lea ecx, [ebp - 0x34]
call fcn.0040634d
jmp 0x40a856
push 0x42e1b0
push ebx
lea ecx, [ebp - 0x34]
call fcn.00409948
add ebx, 2
push ebx
push edi
lea ecx, [ebp - 0x34]
call fcn.0040663c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40a83b
push str._app_cmd_b_e_g_i_n
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x40a877
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2a18]
push eax
call esi
push str._e_n_d
lea eax, [ebp - 0x2a18]
push eax
call esi
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.004049f8
xor ebx, ebx
mov edi, 0x42e1ec
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x40a8d2
cmp word [eax], bx
je 0x40a8d2
push str._app_path__
lea eax, [ebp - 0x2a18]
push eax
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x2a18]
push eax
call esi
push edi
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp dword [ebp + 0x14], ebx
jbe 0x40a932
push str._contentbytes__
lea eax, [ebp - 0x2a18]
push eax
call esi
xor eax, eax
push 0xfe
mov word [ebp - 0x178], ax
lea eax, [ebp - 0x176]
push ebx
push eax
call fcn.0042c331
push dword [ebp + 0x14]
lea eax, [ebp - 0x178]
push 0x42e138
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x2a18]
push eax
call esi
push edi
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp byte [ebp + 0x18], 0
je 0x40a946
push str.__checkpe
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp byte [ebp + 0x1c], 0
je 0x40a95a
push str.__hiddenrun
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp byte [ebp + 0x20], 0
je 0x40a96e
push str.__forceforeground
lea eax, [ebp - 0x2a18]
push eax
call esi
cmp byte [ebp + 0x24], 0
je 0x40a982
push str.__norunas
lea eax, [ebp - 0x2a18]
push eax
call esi
xor eax, eax
mov word [ebp - 0x46], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp - 0x34a18]
push eax
push 0x404
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2a18]
push eax
push ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x78], 0x44
mov dword [ebp - 0x4c], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40aa18
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xea60
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0x18]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40aa06
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x28]
cmp eax, 0xffffffef
mov dword [ecx], eax
sete byte [ebp - 1]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x18]
call esi
jmp 0x40aa23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x28]
mov dword [ecx], eax
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 0x24