Function at 0x420ec0
Capabilities:
Check for time delay via gettickcount
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x23c0
call fcn.004b81c0
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2368], eax
mov eax, dword [ebp + 0x14]
mov ebx, 1
push edi
mov dword [ebp - 0x2364], esi
mov dword [ebp - 0x235c], ecx
mov dword [ebp - 0x2360], eax
mov dword [ebp - 0x2358], edx
mov dword [0x4f8838], ebx
test eax, eax
je 0x420f25
call fcn.0040d280
test eax, eax
jne 0x420f25
mov dword [ebp - 0x2360], eax
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x420f30
sub eax, edx
add eax, esi
mov edx, 9
sub eax, ebx
cmp eax, esi
jbe 0x420f5d
mov cl, byte [eax]
cmp cl, 0x2e
je 0x420f66
cmp cl, 0x2f
je 0x420f5d
cmp cl, 0x5c
je 0x420f5d
sub edx, ebx
test edx, edx
jg 0x420f40
cmp byte [eax], 0x2e
jne 0x42104c
lea edx, [ebp - 0x10]
sub edx, eax
jmp 0x420f70
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x420f70
lea eax, [ebp - 0x10]
cmp byte [ebp - 0x10], cl
je 0x420f9e
mov cl, byte [eax]
cmp cl, 0x22
je 0x420f96
cmp cl, 0x27
je 0x420f96
add eax, ebx
cmp byte [eax], 0
jne 0x420f83
cmp byte [eax], 0
je 0x420f9e
mov byte [eax], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004370a0
add esp, 4
mov edx, str..exe
lea ecx, [ebp - 0x10]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x420fd2
test al, al
je 0x420fce
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x420fd2
add ecx, 2
add edx, 2
test al, al
jne 0x420fb2
xor eax, eax
jmp 0x420fd7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4210ea
cmp dword [ebp + 0x1c], 0
jne 0x420fe7
xor ebx, ebx
mov ecx, dword [ebp - 0x2368]
mov edx, dword [ecx + ebx*4]
lea eax, [ebp - 0x2350]
mov edi, 0x1f40
test edx, edx
je 0x42116a
cmp edi, 1
jle 0x42116a
mov byte [ebp - 0x2351], 0
test ebx, ebx
jle 0x42102a
mov cl, byte [edx]
cmp cl, 0x22
je 0x4210f2
test cl, cl
je 0x4210f2
mov esi, edx
mov cl, byte [esi]
test cl, cl
je 0x421103
cmp cl, 0x20
je 0x4210f2
mov cl, byte [esi + 1]
inc esi
test cl, cl
jne 0x421036
jmp 0x421103
cmp byte [esi], 0x22
mov ecx, esi
jne 0x421056
lea ecx, [esi + 1]
mov al, byte [ecx]
cmp al, 0x2f
je 0x4210a8
cmp al, 0x5c
je 0x4210a8
cmp al, 0x61
jl 0x421068
cmp al, 0x7a
jle 0x421070
cmp al, 0x41
jl 0x421081
cmp al, 0x5a
jg 0x421081
cmp byte [ecx + 1], 0x3a
jne 0x421081
mov al, byte [ecx + 2]
cmp al, 0x2f
je 0x4210a8
cmp al, 0x5c
je 0x4210a8
mov al, byte [ecx]
cmp al, 0x61
jl 0x42108b
cmp al, 0x7a
jle 0x421093
cmp al, 0x41
jl 0x421097
cmp al, 0x5a
jg 0x421097
add ecx, ebx
jmp 0x421081
cmp byte [ecx], 0x3a
jne 0x420fdf
mov dword [ebp + 0x1c], ebx
jmp 0x420fe7
push 0x400
lea ecx, [ebp - 0x410]
push esi
push ecx
call fcn.004076e0
push 0x400
lea edx, [ebp - 0x410]
push str..exe
push edx
call fcn.004076a0
lea eax, [ebp - 0x410]
push 0
push eax
call dword [sym.imp.MSVCR100.dll__access]
add esp, 0x20
test eax, eax
jns 0x420fdf
mov dword [ebp + 0x1c], ebx
jmp 0x420fe7
dec edi
mov byte [ebp - 0x2351], 1
cmp edi, 1
jle 0x421103
mov byte [eax], 0x22
inc eax
mov cl, byte [edx]
test cl, cl
je 0x42113a
lea esp, [esp]
dec edi
cmp edi, 1
jle 0x42113a
cmp cl, 0x22
jne 0x42112d
cmp byte [ebp - 0x2351], 0
je 0x42112d
dec edi
cmp edi, 1
jle 0x42112d
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
mov byte [eax], cl
mov cl, byte [edx]
inc eax
test cl, cl
jne 0x421110
cmp byte [ebp - 0x2351], 0
je 0x42114d
dec edi
cmp edi, 1
jle 0x42114d
mov byte [eax], 0x22
inc eax
mov edx, dword [ebp - 0x2368]
mov edx, dword [edx + ebx*4 + 4]
mov esi, dword [ebp - 0x2364]
inc ebx
mov byte [eax], 0x20
inc eax
test edx, edx
jne 0x421003
mov byte [eax], 0
dec eax
lea ecx, [ebp - 0x2350]
cmp eax, ecx
jb 0x42118b
cmp byte [eax], 0x20
jne 0x42118b
mov byte [eax], 0
dec eax
lea edx, [ebp - 0x2350]
cmp eax, edx
jae 0x421178
mov eax, dword [0x50a194]
xor edi, edi
cmp eax, edi
je 0x4211a4
push eax
push edi
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x50a194], edi
cmp dword [ebp + 0x1c], edi
je 0x4212e1
push 0x3c
lea eax, [ebp - 0x23b8]
push edi
push eax
call sub.MSVCR100.dll_memset
mov ecx, dword [0x501860]
add esp, 0xc
cmp byte [esi], 0x22
mov dword [ebp - 0x23b8], 0x3c
mov dword [ebp - 0x23b0], ecx
mov dword [ebp - 0x23ac], 0x4d1ebc
jne 0x421218
mov al, byte [esi + 1]
lea edx, [esi + 1]
lea ecx, [ebp - 0x410]
test al, al
je 0x421207
mov esi, ecx
sub edx, esi
cmp al, 0x22
je 0x421207
mov byte [ecx], al
mov al, byte [edx + ecx + 1]
inc ecx
test al, al
jne 0x4211f8
lea edx, [ebp - 0x410]
mov byte [ecx], 0
mov dword [ebp - 0x23a8], edx
jmp 0x42121e
mov dword [ebp - 0x23a8], esi
cmp byte [ebp - 0x2350], 0
je 0x421233
lea eax, [ebp - 0x2350]
mov dword [ebp - 0x23a4], eax
mov eax, dword [0x50a198]
cmp eax, edi
je 0x42124a
mov dword [ebp - 0x239c], eax
mov dword [0x50a198], edi
jmp 0x421254
mov dword [ebp - 0x239c], 5
lea ecx, [ebp - 0x23b8]
push ecx
mov dword [ebp - 0x23b4], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x421283
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2380]
mov dword [0x4f8834], eax
mov dword [0x50956c], edi
mov dword [0x509570], edi
cmp dword [ebp - 0x2360], edi
je 0x4212b7
cmp eax, edi
je 0x4212b7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x509570], eax
mov eax, dword [ebp - 0x2380]
cmp dword [ebp - 0x2358], edi
je 0x42156b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2380]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x22
jne 0x421314
mov al, byte [esi + 1]
lea edx, [esi + 1]
lea ecx, [ebp - 0x410]
test al, al
je 0x42130f
mov esi, ecx
sub edx, esi
lea ebx, [ebx]
cmp al, 0x22
je 0x42130f
mov byte [ecx], al
mov al, byte [edx + ecx + 1]
inc ecx
test al, al
jne 0x421300
mov byte [ecx], 0
jmp 0x42133c
lea edx, [ebp - 0x410]
push edx
push str.PATH
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
push eax
push esi
call fcn.00430b70
add esp, 0xc
cmp eax, 1
jne 0x42126f
cmp dword [ebp - 0x235c], edi
jne 0x421351
mov eax, dword [sym.imp.MSVCR100.dll__environ]
mov ecx, dword [eax]
mov dword [ebp - 0x235c], ecx
mov esi, dword [ebp - 0x235c]
mov ebx, dword [esi]
mov ecx, 1
test ebx, ebx
je 0x42137d
mov eax, ebx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x421367
sub eax, edi
add esi, 4
lea ecx, [ecx + eax + 1]
mov eax, dword [esi]
test eax, eax
jne 0x421364
push ecx
xor esi, esi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 0x236c], edi
cmp edi, esi
je 0x4213cb
mov esi, dword [ebp - 0x235c]
mov ecx, edi
test ebx, ebx
je 0x4213c6
mov edx, dword [esi]
mov al, byte [edx]
test al, al
je 0x4213ba
lea esp, [esp]
inc edx
mov byte [ecx], al
mov al, byte [edx]
inc ecx
test al, al
jne 0x4213b0
mov byte [ecx], 0
add esi, 4
inc ecx
cmp dword [esi], 0
jne 0x4213a1
mov byte [ecx], 0
xor esi, esi
push 0x44
lea edx, [ebp - 0x23c0]
push esi
push edx
call sub.MSVCR100.dll_memset
mov ecx, dword [0x50a198]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x23b4], eax
mov al, byte [0x501497]
add esp, 0xc
mov dword [ebp - 0x23c0], 0x44
test al, al
jne 0x421406
cmp ecx, esi
je 0x421420
or dword [ebp - 0x2394], 1
test al, al
je 0x421413
xor ecx, ecx
mov word [ebp - 0x2390], cx
mov dword [0x50a198], esi
lea edx, [ebp - 0x237c]
push edx
lea eax, [ebp - 0x23c0]
push eax
push esi
push edi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x2350]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4214be
mov edi, dword [sym.imp.MSVCR100.dll__errno]
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [ebp - 0x236c]
test eax, eax
je 0x421472
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
call edi
cmp dword [eax], 0x2e4
jne 0x42126f
mov eax, dword [ebp - 0x2358]
mov ecx, dword [ebp - 0x2360]
mov edx, dword [ebp - 0x235c]
push 1
push eax
mov eax, dword [ebp - 0x2368]
push ecx
mov ecx, dword [ebp - 0x2364]
push edx
push eax
push ecx
call fcn.00420ec0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret
cmp edi, esi
je 0x4214cc
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [ebp - 0x237c]
mov dword [0x4f8834], edx
cmp dword [ebp - 0x2360], esi
je 0x421525
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, esi
je 0x421512
mov ecx, dword [ebp - 0x237c]
mov edx, dword [ebp - 0x2358]
mov dword [eax], ecx
mov ecx, eax
mov dword [eax + 4], edx
mov dword [ebp - 0x2358], esi
call fcn.00420e80
mov dword [0x50956c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x509570], eax
jmp 0x421536
mov eax, dword [ebp - 0x2370]
mov dword [0x50956c], eax
mov dword [0x509570], esi
mov eax, dword [ebp - 0x2378]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x421549
push eax
call esi
cmp dword [ebp - 0x2358], 0
je 0x421565
mov ecx, dword [ebp - 0x237c]
push ecx
call esi
mov dword [0x4f8834], 0xffffffff
mov eax, dword [ebp - 0x237c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret