Function at 0x4069b0
Capabilities:
Create process on windows
Query environment variable
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x40afc9
mov eax, dword fs:[0]
push eax
mov eax, 0x1164
call fcn.0040abe0
mov eax, dword [0x410018]
xor eax, esp
mov dword [esp + 0x115c], eax
push esi
mov eax, dword [0x410018]
xor eax, esp
push eax
lea eax, [esp + 0x116c]
mov dword fs:[0], eax
push 0xfff
lea eax, [esp + 0x169]
push 0
mov dword [esp + 0x117c], 0
push eax
mov byte [esp + 0x170], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x1000
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
push 0x1000
mov esi, eax
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x406b50
mov ecx, 0x1000
lea eax, [esp + 0x164]
jmp 0x406a50
cmp byte [eax], 0
je 0x406a5d
inc eax
sub ecx, 1
jne 0x406a50
jmp 0x406a80
test ecx, ecx
je 0x406a80
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x164]
mov eax, str.Path
call fcn.004012e0
mov ecx, 0x1000
lea eax, [esp + 0x164]
lea esp, [esp]
cmp byte [eax], 0
je 0x406a9d
inc eax
sub ecx, 1
jne 0x406a90
jmp 0x406ac0
test ecx, ecx
je 0x406ac0
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x164]
mov eax, 0x40c73c
call fcn.004012e0
mov ecx, 0x1000
lea eax, [esp + 0x164]
lea esp, [esp]
cmp byte [eax], 0
je 0x406add
inc eax
sub ecx, 1
jne 0x406ad0
jmp 0x406b00
test ecx, ecx
je 0x406b00
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x164]
mov eax, 0x40c750
call fcn.004012e0
mov ecx, 0x1000
lea eax, [esp + 0x164]
lea esp, [esp]
cmp byte [eax], 0
je 0x406b1d
inc eax
sub ecx, 1
jne 0x406b10
jmp 0x406b3d
test ecx, ecx
je 0x406b3d
mov eax, 0x1000
sub eax, ecx
mov edx, 0x1000
sub edx, eax
lea ecx, [esp + eax + 0x164]
mov eax, esi
call fcn.004012e0
lea ecx, [esp + 0x164]
push ecx
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call sub.MSVCR90.dll_memset
mov eax, dword [edi + 0xc]
or dword [esp + 0x54], 0x100
add esp, 0xc
xor ecx, ecx
push 0xf8
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], eax
mov eax, dword [edi]
push ecx
lea edx, [esp + 0x6e]
push edx
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x60], eax
mov word [esp + 0x70], cx
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x118c]
add esp, 0xc
cmp dword [esp + 0x1194], 0x10
jae 0x406bc5
lea ecx, [esp + 0x1180]
lea edx, [esp + 0x64]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x406bd0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x40c73c
push 0
push 0x8000000
push 1
push 0
push 0
lea edx, [esp + 0x84]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406c2a
push 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x412cc4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
call fcn.00407160
add esp, 0x20
jmp 0x406c3e
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x117c]
mov dword [0x4125e4], edx
mov dword [0x4125e8], eax
mov dword [esp + 0x1174], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x116c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x115c]
xor ecx, esp
call fcn.00409cfa
add esp, 0x1170
ret 0x1c