Function at 0x40576c
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x220
mov eax, 0x4091f8
call fcn.00408da5
mov eax, dword [ebp + 8]
mov edi, ecx
xor ebx, ebx
lea ecx, reloc.ADVAPI32.dll_EventWrite
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], eax
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], ebx
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], ecx
mov dword [ebp - 0x220], 0x401f50
cmp dword [0x40a040], 0x40a040
je 0x4057c1
lea esi, reloc.ADVAPI32.dll_EventWrite
call fcn.0040727d
mov eax, dword [ebp - reloc.ADVAPI32.dll_EventWrite]
mov dword [ebp - 4], ebx
test edi, edi
je 0x405990
cmp word [edi], bx
je 0x405990
mov eax, dword [eax + 0x10]
lea edx, reloc.ADVAPI32.dll_EventWrite
mov ecx, edi
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], eax
mov dword [ebp - reloc.ADVAPI32.dll_EventWrite], ebx
call fcn.00406e3e
test eax, eax
js 0x405952
mov eax, dword [ebp - reloc.ADVAPI32.dll_EventWrite]
lea ebx, reloc.ADVAPI32.dll_EventWrite
cmp ebx, eax
jb 0x405952
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
push ebx
lea esi, reloc.ADVAPI32.dll_EventWrite
mov byte [ebp - 4], 1
call fcn.0040678c
test al, al
jne 0x405849
mov byte [ebp - 4], al
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
pop ecx
mov edi, 0x8007000e
jmp 0x405957
mov esi, dword [ebp - reloc.ADVAPI32.dll_EventWrite]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
jne 0x40588e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x405876
and edi, 0xffff
or edi, 0x80070000
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
pop ecx
jmp 0x405957
cmp edi, ebx
jbe 0x4058af
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
pop ecx
mov edi, 0x8007007a
jmp 0x405957
mov eax, dword [ebp - reloc.ADVAPI32.dll_EventWrite]
mov al, byte [eax + 0x2c]
mov edx, 0x4010f8
mov ecx, 0x4019e0
test al, al
jne 0x4058c8
mov ecx, edx
mov eax, dword [ebp - reloc.ADVAPI32.dll_EventWrite]
test eax, eax
jne 0x4058d4
mov eax, edx
push ecx
push eax
push 0x401f88
mov eax, 0x100
lea ebx, reloc.ADVAPI32.dll_EventWrite
call fcn.00403d52
add esp, 0xc
push 5
xor ecx, ecx
push ecx
mov eax, ebx
push eax
push esi
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, eax
cmp ebx, 0x20
jg 0x40596a
mov eax, dword [0x40a040]
cmp eax, 0x40a040
je 0x405928
test byte [eax + 0x1c], 8
je 0x405928
push ebx
push 0x16
push dword [eax + 0x14]
mov ecx, esi
push dword [eax + 0x10]
call fcn.00404adf
cmp ebx, 2
jl 0x40593f
cmp ebx, 3
jle 0x405866
cmp ebx, 0xb
je 0x405866
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
pop ecx
mov edi, 0x80004005
or dword [ebp - 4], reloc.ADVAPI32.dll_EventWrite
lea esi, reloc.ADVAPI32.dll_EventWrite
call fcn.004072aa
mov eax, edi
jmp 0x4059a4
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.msvcrt.dll_free]
and dword [ebp - reloc.ADVAPI32.dll_EventWrite], 0
or dword [ebp - 4], 0xffffffff
pop ecx
lea esi, reloc.ADVAPI32.dll_EventWrite
call fcn.004072aa
xor eax, eax
jmp 0x4059a4
or dword [ebp - 4], reloc.ADVAPI32.dll_EventWrite
lea esi, reloc.ADVAPI32.dll_EventWrite
call fcn.004072aa
mov eax, 0x80070057
call fcn.00408e37
ret 4