Function at 0x407800
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Get ntdll base address
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40cbf9
mov eax, dword fs:[0]
push eax
mov eax, 0x1360
call fcn.0040c650
mov eax, dword [0x41304c]
xor eax, esp
mov dword [esp + 0x1358], eax
push esi
push edi
mov eax, dword [0x41304c]
xor eax, esp
push eax
lea eax, [esp + 0x136c]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 0x1374], 0
push 0x44
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x2c]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
push 0x1ac
push ecx
lea edx, [esp + 0x1be]
push edx
mov edi, eax
mov word [esp + 0x1c0], cx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0x1ae
lea eax, [esp + 0x1bc]
push eax
push 0x400
push edi
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
or dword [esp + 0x50], 0x100
xor edx, edx
push 0xf8
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
push edx
lea eax, [esp + 0xbe]
push eax
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x68], ecx
mov word [esp + 0xc0], dx
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x138c]
add esp, 0xc
cmp dword [esp + 0x1394], 0x10
jae 0x40790f
lea ecx, [esp + 0x1380]
lea edx, [esp + 0xb4]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x407916
push 0xfff
lea ecx, [esp + 0x369]
push 0
push ecx
mov byte [esp + 0x370], al
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x1000
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
push 0x1000
mov esi, eax
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x407a70
mov ecx, 0x1000
lea eax, [esp + 0x364]
cmp byte [eax], 0
je 0x407980
inc eax
sub ecx, 1
jne 0x407973
jmp 0x4079a3
test ecx, ecx
je 0x4079a3
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x364]
mov eax, str.Path
call fcn.00401060
mov ecx, 0x1000
lea eax, [esp + 0x364]
nop
cmp byte [eax], 0
je 0x4079bd
inc eax
sub ecx, 1
jne 0x4079b0
jmp 0x4079e0
test ecx, ecx
je 0x4079e0
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x364]
mov eax, 0x40f7f4
call fcn.00401060
mov ecx, 0x1000
lea eax, [esp + 0x364]
lea esp, [esp]
cmp byte [eax], 0
je 0x4079fd
inc eax
sub ecx, 1
jne 0x4079f0
jmp 0x407a20
test ecx, ecx
je 0x407a20
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x364]
mov eax, 0x40f808
call fcn.00401060
mov ecx, 0x1000
lea eax, [esp + 0x364]
lea esp, [esp]
cmp byte [eax], 0
je 0x407a3d
inc eax
sub ecx, 1
jne 0x407a30
jmp 0x407a5d
test ecx, ecx
je 0x407a5d
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x364]
mov eax, esi
call fcn.00401060
lea edx, [esp + 0x364]
push edx
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [esp + 0x6c]
push ecx
push eax
mov dword [esp + 0x74], 0x48
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push eax
push 0x40f7f4
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [esp + 0xd4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407ae2
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x415d7c
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
call fcn.004082f0
add esp, 0x20
jmp 0x407af6
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [0x41562c], ecx
lea ecx, [esp + 0x137c]
mov dword [0x415630], edx
mov dword [esp + 0x1374], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x136c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1358]
xor ecx, esp
call fcn.0040bc76
add esp, 0x136c
ret 0x1c