Function at 0x405e04
Capabilities:
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call fcn.0041d340
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.004098bd
mov esi, eax
cmp esi, ebx
jge 0x405e49
push 0x40362c
jmp 0x4060d5
push dword [0x429ef8]
call fcn.00409956
mov esi, eax
cmp esi, ebx
jge 0x405e64
push 0x40364c
jmp 0x4060d5
lea eax, [ebp - 0xc]
call fcn.00409ba5
mov esi, eax
cmp esi, ebx
jge 0x405e7c
push 0x40366c
jmp 0x4060d5
push dword [0x429ef8]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x403694
call esi
test eax, eax
jne 0x405ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405ead
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405eb4
mov esi, 0x80004005
push 0x4036b8
jmp 0x4060d5
push dword [ebp - 0xc]
push 0x4036d8
call esi
test eax, eax
jne 0x405ef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405ee6
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405eed
mov esi, 0x80004005
push 0x403704
jmp 0x4060d5
push dword [0x429efc]
push 0x403728
call esi
test eax, eax
jne 0x405f33
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405f22
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405f29
mov esi, 0x80004005
push 0x403758
jmp 0x4060d5
cmp dword [ebp + 0xc], 1
jne 0x405f74
push 0x403780
push 0x403784
call esi
test eax, eax
jne 0x405f74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jle 0x405f63
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x405f6a
mov esi, 0x80004005
push 0x4037a4
jmp 0x4060d5
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x405fac
lea esi, [ebp - 8]
call fcn.00408b78
mov esi, eax
test esi, esi
jns 0x405f9f
push 0x4037fc
jmp 0x4060d5
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x405fe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x405fc6
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x405fcd
mov esi, 0x80004005
push dword [ebp + 8]
push 0x4037c4
push esi
call fcn.004088ec
add esp, 0xc
jmp 0x406106
push dword [ebp - 8]
xor edi, edi
inc edi
mov eax, edi
push 0x403828
push edi
mov dword [ebp - 0x6c], 0x44
mov dword [ebp - 0x40], edi
mov word [ebp - 0x3c], ax
call fcn.00408870
add esp, 0xc
xor ebx, ebx
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x429ef8]
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x406082
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x406042
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070005
je 0x406054
cmp esi, 0x80070020
jne 0x406077
push esi
push 0x403848
push edi
call fcn.00408870
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x40600c
cmp esi, ebx
jge 0x406082
push 0x403878
jmp 0x4060d5
mov dword [ebp + 8], ebx
mov edi, dword [ebp - 0x18]
push ebx
call dword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x4060ae
or dword [ebp + 0xc], 0xffffffff
lea eax, [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp edi, dword [ebp + 0xc]
je 0x4060c5
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
cmp esi, ebx
jne 0x406091
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x32
jl 0x406085
call fcn.00406958
mov esi, eax
cmp esi, ebx
jge 0x4060df
push 0x403894
push esi
call fcn.004088ec
pop ecx
pop ecx
jmp 0x406106
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x20]
call edi
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x406113
push edi
call fcn.00409956
cmp dword [ebp - 8], 0
je 0x406121
push dword [ebp - 8]
call fcn.004091af
cmp dword [ebp - 0xc], 0
je 0x40612f
push dword [ebp - 0xc]
call fcn.004091af
test edi, edi
je 0x406139
push edi
call fcn.004091af
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc