Function at 0x46c950
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
xor esi, esi
test r9, r9
mov r12, rcx
mov edi, edx
mov r13, r8
mov r15, r9
je 0x46ca49
cmp qword [r9], 0
je 0x46ca49
mov eax, 1
lea r14d, [rax - 1]
mov rsi, rax
lea r8, [rax*8]
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x46c98d
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.0047f5f0
sub rsp, rax
mov rdx, r15
movsxd r14, r14d
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov r8d, 8
mov rcx, rbx
lea r9, [0x0046c8e0]
call sub.msvcrt.dll_qsort
lea rax, [r14*8]
mov r14d, 1
mov qword [rbp - 0x28], rax
lea rsi, [r15 + rax + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.msvcrt.dll_strlen
cmp r15, rsi
lea r14d, [r14 + rax + 1]
jne 0x46ca00
movsxd rcx, r14d
call fcn.00474400
mov rsi, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsi
lea r14, [rbx + rax + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.00474870
cmp r14, rbx
lea rcx, [rax + 1]
jne 0x46ca30
mov byte [rax + 1], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r12
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x46cee0
lea r15, [0x005b56f4]
xor ecx, ecx
lea rcx, [rcx + rbx + 6]
call fcn.00474400
movzx edx, byte [r15]
mov rbx, rax
test dl, dl
mov rdi, r15
je 0x46cf60
cmp dl, 0x3b
je 0x46cf60
nop dword [rax + rax]
add rdi, 1
movzx eax, byte [rdi]
cmp al, 0x3b
je 0x46caaf
test al, al
jne 0x46caa0
mov r14, rdi
mov rcx, rbx
mov rdx, r15
sub r14, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
lea r10, [rbx + r14]
cmp rdi, r15
mov rcx, r10
je 0x46cad7
add rcx, 1
mov byte [r10], 0x5c
mov rdx, r12
mov r14, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [rdi], 0x3b
sete al
add rdi, rax
movzx eax, byte [rbx]
test al, al
je 0x46cb08
cmp al, 0x2f
jne 0x46cafc
mov byte [r14], 0x5c
add r14, 1
movzx eax, byte [r14]
test al, al
jne 0x46caf4
lea r15, str..com
lea rdx, str..com
jmp 0x46cb30
add r15, 8
mov rdx, qword [r15]
test rdx, rdx
je 0x46ceb1
mov rcx, rbx
mov byte [r14], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x46cb20
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rax, qword [r13]
test rax, rax
je 0x46cf70
lea r10, [r13 + 8]
xor ecx, ecx
movzx edx, byte [rax]
xor r8d, r8d
xor r11d, r11d
test dl, dl
jne 0x46cbb0
jmp 0x46cd76
add r8, 1
movzx edx, byte [rax + r8]
test dl, dl
je 0x46cc20
mov r14d, edx
mov r12d, r8d
mov r9d, r8d
and r14d, 0xfffffffd
cmp r14b, 0x20
je 0x46cbc8
cmp dl, 9
jne 0x46cba3
cmp dl, 0x22
mov r11d, 1
jne 0x46cba3
test r12d, r12d
je 0x46cc06
cmp byte [rax + r8 - 1], 0x5c
jne 0x46cc06
lea rdx, [r8 - 2]
lea r11, [r8 + rcx - 1]
jmp 0x46cbfb
sub rdx, 1
cmp byte [rax + rdx + 1], 0x5c
jne 0x46cc06
mov rcx, r11
sub rcx, rdx
cmp edx, 0xffffffff
jne 0x46cbf0
add r8, 1
add rcx, 1
mov r11d, 1
movzx edx, byte [rax + r8]
test dl, dl
jne 0x46cbb0
nop dword [rax]
test r11d, r11d
jne 0x46cd40
add rcx, r8
mov eax, 1
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x46cb91
call fcn.00474400
mov r10, qword [r13]
test r10, r10
je 0x46cda1
add r13, 8
mov rdx, rax
movabs r15, 0x500000201
nop dword [rax + rax]
movzx r11d, byte [r10]
cmp r11b, 0x22
ja 0x46cc84
bt r15, r11
jb 0x46ce23
lea rcx, [r10 + 1]
jmp 0x46ccaf
mov r9d, r8d
add rcx, 1
and r9d, 0xfffffffd
cmp r9b, 0x20
je 0x46ce23
cmp r8b, 9
je 0x46ce23
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x46cc90
mov rcx, rdx
xor edx, edx
lea r12, [r10 - 1]
mov r8d, 0xffffffff
jmp 0x46ccf6
movzx r8d, byte [r12 + 1]
lea r9, [rcx + 1]
add r12, 1
mov byte [rcx], r8b
movzx r11d, byte [r12 + 1]
mov r8d, r14d
test r11b, r11b
je 0x46ce40
mov rcx, r9
lea r14d, [r8 + 1]
cmp r11b, 0x22
jne 0x46ccd0
cmp r8d, 0xffffffff
je 0x46cd37
cmp byte [r12], 0x5c
jne 0x46cd37
lea r9, [rcx + r8 + 1]
mov r8, r12
jmp 0x46cd2a
sub r8, 1
cmp byte [r8], 0x5c
jne 0x46cd37
add rcx, 1
mov byte [rcx - 1], 0x5c
cmp rcx, r9
jne 0x46cd20
mov byte [rcx], 0x5c
add rcx, 1
jmp 0x46ccd0
movsxd rdx, r9d
cmp byte [rax + rdx], 0x5c
jne 0x46cd73
lea rax, [rax + rdx - 1]
add rcx, 1
add rdx, rcx
jmp 0x46cd6e
sub rax, 1
cmp byte [rax + 1], 0x5c
jne 0x46cd73
add rcx, 1
cmp rcx, rdx
jne 0x46cd60
add rcx, r8
mov eax, 3
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x46cb91
call fcn.00474400
mov r10, qword [r13]
test r10, r10
jne 0x46cc57
mov rdx, rax
mov byte [rdx - 1], 0
mov rdx, qword [rbp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x48], rdx
mov rdx, qword [rbp + 0x58]
mov qword [rsp + 0x40], rdx
mov edx, dword [rbp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x46cf8a
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
call rdi
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rdx], 0x22
movzx r11d, byte [r10]
lea rcx, [rdx + 1]
test r11b, r11b
je 0x46ce65
mov edx, 1
jmp 0x46ccbd
test edx, edx
jne 0x46ce70
mov r10, qword [r13]
lea rdx, [r9 + 1]
add r13, 8
mov byte [r9], 0x20
test r10, r10
jne 0x46cc70
jmp 0x46cda4
mov rcx, r9
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x46ce44
movsxd rdx, r14d
cmp byte [r10 + rdx], 0x5c
jne 0x46ce62
lea rdx, [r10 + rdx - 1]
lea rcx, [r9 + r14 + 1]
jmp 0x46ce9a
sub rdx, 1
cmp byte [rdx + 1], 0x5c
jne 0x46ce62
add r9, 1
mov byte [r9 - 1], 0x5c
cmp r9, rcx
jne 0x46ce90
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x46ce44
movzx edx, byte [rdi]
mov r15, rdi
test dl, dl
jne 0x46ca84
mov rcx, rbx
mov qword [rbp - 0x28], rax
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x28]
jmp 0x46ce12
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x46ca6a
and edi, 1
je 0x46ca6a
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r15, rax
je 0x46ca6a
movzx edx, byte [rax]
mov r8, rax
xor ecx, ecx
nop
test dl, dl
je 0x46ca73
cmp dl, 0x3b
mov rax, r8
je 0x46cf80
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x3b
je 0x46cf40
test dl, dl
jne 0x46cf30
mov rdi, rax
sub rdi, r8
cmp rcx, rdi
cmovb rcx, rdi
cmp dl, 0x3b
je 0x46cf80
mov r8, rax
jmp 0x46cf20
mov rcx, rbx
jmp 0x46cad7
xor ecx, ecx
jmp 0x46cc45
movzx edx, byte [rax + 1]
add rax, 1
jmp 0x46cf52
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, 0xffffffffffffffff
jmp 0x46ce12