Function at 0x80ced0
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x80d1ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040b8d8
mov bl, 1
lea eax, [ebp - 8]
mov edx, 0x80d21c
call fcn.0040bd94
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x45c]
test eax, eax
je 0x80cf1f
mov eax, dword [eax - 4]
cmp eax, 9
je 0x80cf33
lea eax, [ebp - 8]
mov edx, 0x80d230
call fcn.0040bd94
xor ebx, ebx
cmp bl, 1
jne 0x80d001
mov eax, 0x80d238
push 0x200
lea edx, [ebp - 0x210]
push edx
push eax
call sub.kernel32.dll_GetEnvironmentVariableW
lea eax, [ebp - 4]
lea edx, [ebp - 0x210]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor esi, esi
inc esi
cmp esi, 0x28
jg 0x80cfaf
push 0x19
call sub.kernel32.dll_Sleep
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
call fcn.0080cb3c
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x468], edi
test edi, edi
je 0x80cf80
mov bl, 1
test bl, bl
jne 0x80d001
xor esi, esi
inc esi
cmp esi, 0x28
jle 0x80cfca
lea eax, [ebp - 8]
mov edx, 0x80d254
call fcn.0040bd94
jmp 0x80d001
push 0x19
call sub.kernel32.dll_Sleep
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
push 0x80d25c
call sub.user32.dll_FindWindowW
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x468], edi
test edi, edi
je 0x80cfb5
mov bl, 1
cmp bl, 1
jne 0x80d0ca
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x448]
call fcn.0053e644
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_SetParent
push 0x4000
mov eax, dword [ebp - 0x10]
call fcn.00533df4
push eax
mov eax, dword [ebp - 0x10]
call fcn.00533db4
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_SetWindowPos
push 0x32
call sub.kernel32.dll_Sleep
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
mov eax, dword [ebp - 0x10]
add eax, 0x46c
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x468]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
mov eax, dword [ebp - 0x10]
add eax, 0x474
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x478
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x470]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x46c]
mov eax, dword [ebp - 0x10]
call fcn.0080cc1c
mov eax, dword [0x8d24f8]
mov eax, dword [eax]
call fcn.005e8470
push 0x32
call sub.kernel32.dll_Sleep
cmp bl, 1
jne 0x80d13c
mov eax, dword [ebp - 0x10]
call fcn.0080d5b8
mov eax, dword [0x8d2950]
mov eax, dword [eax]
mov eax, dword [eax + 0x48c]
push eax
mov eax, dword [0x8d1940]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x46c]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x470]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x474]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x478]
push eax
mov eax, dword [0x8d22cc]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x45c]
mov dl, 1
mov eax, dword [0x80b2e0]
call fcn.0080b3d4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x47c], eax
test bl, bl
jne 0x80d1df
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x80d1d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x80d1a4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80d290
mov eax, dword [ebp - 0x10]
push dword [eax + 0x45c]
mov eax, dword [0x8d2950]
mov eax, dword [eax]
push dword [eax + 0x48c]
push 0x80d2a4
push dword [ebp - 8]
push 0x80d2b4
lea eax, [ebp - 0xc]
mov edx, 6
call fcn.0040c1c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x80d1ae
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0084d184
mov eax, dword [ebp - 0x10]
call fcn.005e32ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80d1df
lea eax, [ebp - 0xc]
call fcn.0040b8d8
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x80d206
lea eax, [ebp - 8]
call fcn.0040b8d8
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax