Function at 0x401b20
Capabilities:
Create process on windows
Set environment variable
Terminate process

Disassembly:
sub esp, 0x248
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp ebp, ebx
jle 0x401b5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
nop
mov eax, dword [0x4132ec]
mov ecx, dword [esp + 0x260]
mov edx, dword [ecx + edi*4]
push eax
push edx
call esi
test eax, eax
je 0x401b67
inc edi
cmp edi, ebp
jl 0x401b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret
cmp edi, ebx
mov dword [esp + 0x10], edi
jle 0x401b5c
push 0x207
lea eax, [esp + 0x55]
push ebx
push eax
mov byte [esp + 0x5c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x208
lea ecx, [esp + 0x50]
nop
cmp byte [ecx], bl
je 0x401b9c
inc ecx
sub eax, 1
jne 0x401b90
jmp 0x401be0
cmp eax, ebx
je 0x401be0
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401bdd
mov edi, dword [0x41330c]
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401bd9
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401bd9
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401bc3
jmp 0x401bdd
cmp ecx, ebx
jne 0x401bde
dec eax
mov byte [eax], bl
mov ecx, 0x208
lea eax, [esp + 0x50]
lea esp, [esp]
cmp byte [eax], bl
je 0x401bfc
inc eax
sub ecx, 1
jne 0x401bf0
jmp 0x401c3f
cmp ecx, ebx
je 0x401c3f
mov edx, 0x208
sub edx, ecx
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401c3c
mov edi, 0x40f4e8
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401c38
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401c38
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401c22
jmp 0x401c3c
cmp ecx, ebx
jne 0x401c3d
dec eax
mov byte [eax], bl
mov ebp, 1
cmp dword [esp + 0x25c], ebp
jle 0x401d23
cmp ebp, dword [esp + 0x10]
je 0x401d15
mov ecx, dword [esp + 0x260]
mov edi, dword [ecx + ebp*4]
mov eax, 0x208
lea ecx, [esp + 0x50]
mov edi, edi
cmp byte [ecx], bl
je 0x401c7c
inc ecx
sub eax, 1
jne 0x401c70
jmp 0x401cbd
cmp eax, ebx
je 0x401cbd
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401cba
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
lea ecx, [ecx]
cmp esi, ebx
je 0x401cb6
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401cb6
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401ca0
jmp 0x401cba
cmp ecx, ebx
jne 0x401cbb
dec eax
mov byte [eax], bl
mov eax, 0x208
lea ecx, [esp + 0x50]
cmp byte [ecx], bl
je 0x401cd2
inc ecx
sub eax, 1
jne 0x401cc6
jmp 0x401d15
cmp eax, ebx
je 0x401d15
mov edx, 0x208
sub edx, eax
mov ecx, 0x208
sub ecx, edx
lea eax, [esp + edx + 0x50]
je 0x401d12
mov edi, 0x40f4e8
lea esi, [ecx + edx + 0x7ffffdf7]
sub edi, eax
cmp esi, ebx
je 0x401d0e
mov dl, byte [edi + eax]
cmp dl, bl
je 0x401d0e
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x401cf8
jmp 0x401d12
cmp ecx, ebx
jne 0x401d13
dec eax
mov byte [eax], bl
inc ebp
cmp ebp, dword [esp + 0x25c]
jl 0x401c51
push 6
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, dword [0x4131bc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x38
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esp + 0x26c]
mov edx, dword [ecx]
add esp, 0xc
lea ecx, [esp + 0x14]
lea eax, [esp + 0x50]
push ecx
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x40
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], str.open
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 5
mov dword [esp + 0x38], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x401b5c
mov edx, dword [esp + 0x4c]
push 0xffffffffffffffff
push edx
mov dword [esp + 0x18], 0x41
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]