Function at 0x4060c8
Capabilities:
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0041e230
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.00409caf
mov esi, eax
cmp esi, ebx
jge 0x40610d
push 0x4038ec
jmp 0x406399
push dword [0x42bef8]
call fcn.00409d4d
mov esi, eax
cmp esi, ebx
jge 0x406128
push 0x40390c
jmp 0x406399
lea eax, [ebp - 0xc]
call fcn.00409fba
mov esi, eax
cmp esi, ebx
jge 0x406140
push 0x40392c
jmp 0x406399
push dword [0x42bef8]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x403954
call esi
test eax, eax
jne 0x406182
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x406171
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x406178
mov esi, 0x80004005
push 0x403978
jmp 0x406399
push dword [ebp - 0xc]
push 0x403998
call esi
test eax, eax
jne 0x4061bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x4061aa
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x4061b1
mov esi, 0x80004005
push 0x4039c4
jmp 0x406399
push dword [0x42befc]
push 0x4039e8
call esi
test eax, eax
jne 0x4061f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x4061e6
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x4061ed
mov esi, 0x80004005
push 0x403a18
jmp 0x406399
cmp dword [ebp + 0xc], 1
jne 0x406238
push 0x403a40
push 0x403a44
cmp al, byte [eax]
call esi
test eax, eax
jne 0x406238
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x406227
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x40622e
mov esi, 0x80004005
push 0x403a64
jmp 0x406399
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x406270
lea esi, [ebp - 8]
call fcn.00408f01
mov esi, eax
test esi, esi
jns 0x406263
push 0x403abc
jmp 0x406399
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x4062a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40628a
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x406291
mov esi, 0x80004005
push dword [ebp + 8]
push 0x403a84
push esi
call fcn.00408c66
add esp, 0xc
jmp 0x4063ca
push dword [ebp - 8]
xor edi, edi
inc edi
mov eax, edi
push 0x403ae8
push edi
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], ax
call fcn.00408be5
add esp, 0xc
xor ebx, ebx
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x42bef8]
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x406346
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x406306
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070005
je 0x406318
cmp esi, 0x80070020
jne 0x40633b
push esi
push 0x403b08
push edi
call fcn.00408be5
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x4062d0
cmp esi, ebx
jge 0x406346
push 0x403b38
jmp 0x406399
mov dword [ebp + 8], ebx
mov edi, dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x406372
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, dword [ebp + 0xc]
je 0x406389
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, ebx
jne 0x406355
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x32
jl 0x406349
call fcn.00406c49
mov esi, eax
cmp esi, ebx
jge 0x4063a3
push 0x403b54
push esi
call fcn.00408c66
pop ecx
pop ecx
jmp 0x4063ca
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x4063d7
push edi
call fcn.00409d4d
cmp dword [ebp - 8], 0
je 0x4063e5
push dword [ebp - 8]
call fcn.0040956f
cmp dword [ebp - 0xc], 0
je 0x4063f3
push dword [ebp - 0xc]
call fcn.0040956f
test edi, edi
je 0x4063fd
push edi
call fcn.0040956f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc