Function at 0x4041b0
Capabilities:
Query environment variable
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x423680]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x268], edi
push eax
push str.WINDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [ebp + 0xc]
mov esi, eax
lea eax, [ecx - 1]
cmp eax, 0xfff
ja 0x404407
push ebx
push ecx
push dword [ebp + 8]
lea eax, [ebp - 0x268]
push eax
call fcn.00403940
test eax, eax
je 0x4043f2
test esi, esi
je 0x4043f2
cmp esi, 0x104
jae 0x4043f2
mov ecx, 0x104
lea eax, [ebp - 0x108]
nop dword [eax]
cmp byte [eax], 0
je 0x40424b
inc eax
sub ecx, 1
jne 0x404240
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x4043f2
lea ecx, [ebp - 0x108]
lea ecx, [ecx + esi]
sub edx, esi
je 0x404294
mov esi, str._sysnative_rundll32.exe
mov eax, 0x7ffffffe
sub esi, ecx
nop dword [eax]
test eax, eax
je 0x404294
mov bl, byte [esi + ecx]
test bl, bl
je 0x404294
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x404280
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
je 0x4043f2
mov esi, dword [ebp - 0x268]
lea eax, [esi + 0xc]
push eax
push str.rundll32.exe___s__1
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00403e90
add esp, 0x10
test eax, eax
js 0x4043f2
lea eax, [ebp - 0x264]
mov dword [ebp - 0x254], 0x44
push eax
lea eax, [ebp - 0x254]
xorps xmm0, xmm0
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
movlpd qword [ebp - 0x250], xmm0
push eax
lea eax, [ebp - 0x108]
movlpd qword [ebp - 0x248], xmm0
push eax
movups xmmword [ebp - 0x264], xmm0
movlpd qword [ebp - 0x240], xmm0
movlpd qword [ebp - 0x238], xmm0
movlpd qword [ebp - 0x230], xmm0
movlpd qword [ebp - 0x228], xmm0
movlpd qword [ebp - 0x220], xmm0
movlpd qword [ebp - 0x218], xmm0
call dword [ebp - 0x210]
test eax, eax
je 0x4043f2
push dword [esi]
push esi
push 0x41b79c
push dword [ebp - 0x264]
call fcn.00403f10
test eax, eax
jne 0x404397
push 0xffffffffffffffff
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
jmp 0x4043f2
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x1f4
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
cmp dword [ebp - 0x210], edi
mov eax, 1
cmove edi, eax
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x40440f
push eax
call fcn.00405e34
add esp, 4
jmp 0x40440f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004056d3
mov esp, ebp
pop ebp
ret 0x10