Function at 0x438cd0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
test edi, edi
je 0x4391e1
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x4391e1
mov dword [ebp - 0x2c], 0
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ebp + 8]
inc ebx
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
shl edx, 2
mov ecx, dword [edi + ecx*4]
test ecx, ecx
jne 0x438d01
lea eax, [edx + 0x1e]
and eax, 0xfffffff0
call fcn.004521b0
cld
lea eax, [esp + 0xf]
mov ecx, edx
and eax, 0xfffffff0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov edi, eax
shr ecx, 2
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
push 0x439240
push 4
mov edx, dword [ebp - 0x2c]
mov esi, 1
push edx
push eax
call sub.msvcrt.dll_qsort
add esp, 0x10
mov edx, dword [ebp + 8]
sub esp, 0xc
mov eax, dword [edx + ebx*4]
inc ebx
push eax
call sub.msvcrt.dll_strlen
add esp, 0x10
cmp ebx, dword [ebp - 0x2c]
lea eax, [esi + eax + 1]
mov esi, eax
jne 0x438d58
sub esp, 0xc
xor ebx, ebx
push eax
call fcn.0043b7c0
add esp, 0x10
mov dword [ebp - 0x30], eax
mov edx, eax
push edi
push edi
mov ecx, dword [ebp - 0x48]
mov esi, dword [ecx + ebx*4]
inc ebx
push esi
push edx
call fcn.0044dbf0
add esp, 0x10
cmp ebx, dword [ebp - 0x2c]
lea edx, [eax + 1]
jne 0x438d89
mov byte [eax + 1], 0
sub esp, 0xc
mov ebx, dword [ebp - 0x3c]
push ebx
call sub.msvcrt.dll_strlen
pop edx
pop ecx
mov dword [ebp - 0x4c], eax
push 0x2f
mov eax, dword [ebp - 0x3c]
push eax
call sub.msvcrt.dll_strchr
add esp, 0x10
test eax, eax
je 0x4391ed
mov esi, 0x49fc63
mov ecx, esi
xor ebx, ebx
mov al, byte [ecx]
test al, al
je 0x438e07
mov edx, ecx
cmp al, 0x3b
je 0x438e30
inc edx
mov al, byte [edx]
cmp al, 0x3b
je 0x438def
test al, al
jne 0x438de4
mov edi, edx
sub edi, ecx
cmp al, 0x3b
mov ecx, edi
je 0x438e32
cmp ebx, ecx
jae 0x438dff
mov ebx, ecx
mov ecx, edx
mov al, byte [ecx]
test al, al
jne 0x438dde
mov edx, dword [ebp - 0x4c]
sub esp, 0xc
lea eax, [ebx + edx + 6]
push eax
call fcn.0043b7c0
mov dword [ebp - 0x38], eax
add esp, 0x10
mov al, byte [esi]
cmp al, 0x3b
je 0x438e29
mov edx, esi
test al, al
jne 0x438e35
mov eax, dword [ebp - 0x38]
mov edi, esi
jmp 0x438e62
xor ecx, ecx
inc edx
jmp 0x438df9
inc edx
mov al, byte [edx]
cmp al, 0x3b
je 0x438e40
test al, al
jne 0x438e35
mov ebx, edx
push eax
sub ebx, esi
mov edi, edx
push ebx
push esi
mov eax, dword [ebp - 0x38]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x38]
add esp, 0x10
add eax, ebx
cmp edi, esi
je 0x438e62
mov byte [eax], 0x5c
inc eax
push ebx
push ebx
mov ecx, dword [ebp - 0x3c]
push ecx
push eax
call sub.msvcrt.dll_strcpy
mov ecx, dword [ebp - 0x38]
add esp, 0x10
cmp byte [edi], 0x3b
sete al
and eax, 0xff
mov ebx, ecx
add edi, eax
mov al, byte [ecx]
test al, al
jne 0x438e97
jmp 0x438ea5
inc ebx
mov al, byte [ebx]
test al, al
je 0x438ea5
cmp al, 0x2f
jne 0x438e90
mov byte [ebx], 0x5c
inc ebx
mov al, byte [ebx]
test al, al
jne 0x438e97
mov eax, str..com
xor esi, esi
jmp 0x438ebe
mov eax, dword [esi*4 + 0x49fcd8]
inc esi
test eax, eax
je 0x4391c6
mov byte [ebx], 0
push edx
push edx
push eax
mov eax, dword [ebp - 0x38]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xc
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp - 0x38]
push ecx
call sub.KERNEL32.dll_CreateFileA
pop edx
cmp eax, 0xffffffff
je 0x438eae
sub esp, 0xc
push eax
call sub.KERNEL32.dll_CloseHandle
mov edi, dword [ebp - 0x44]
add esp, 0xc
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
xor edi, edi
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x438fe8
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
mov al, byte [edx]
test al, al
je 0x4391d3
mov ebx, dword [ebp - 0x1c]
xor esi, esi
mov dword [ebp - 0x10], 0
jmp 0x438f4b
cmp al, 0xa
je 0x438f4f
cmp al, 9
je 0x438f80
cmp al, 0x22
je 0x438f5a
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [ebx + 1]
inc ebx
test al, al
je 0x438f93
cmp al, 0x20
jne 0x438f33
mov dword [ebp - 0x10], 1
cmp al, 0x22
jne 0x438f3f
lea ecx, [esi - 1]
cmp ecx, 0xffffffff
je 0x438f7f
cmp byte [ebx - 1], 0x5c
jne 0x438f7f
mov edx, ebx
jmp 0x438f78
mov al, byte [edx - 2]
dec edx
cmp al, 0x5c
jne 0x438f7f
dec ecx
inc edi
cmp ecx, 0xffffffff
jne 0x438f70
inc edi
inc esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], esi
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x438f4b
mov ebx, dword [ebp - 0x10]
xor eax, eax
test ebx, ebx
je 0x438fc4
lea ecx, [esi - 1]
mov edx, dword [ebp - 0x1c]
cmp byte [edx + ecx], 0x5c
jne 0x438fbf
mov edx, dword [ebp - 0x1c]
add edx, esi
jmp 0x438fb8
mov al, byte [edx - 2]
dec edx
cmp al, 0x5c
jne 0x438fbf
dec ecx
inc edi
cmp ecx, 0xffffffff
jne 0x438fb0
mov eax, dword [ebp - 0x10]
add eax, eax
lea eax, [eax + edi + 1]
mov ecx, dword [ebp - 0x20]
lea edi, [eax + ecx]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 4]
add ecx, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ecx
test eax, eax
jne 0x438f18
sub esp, 0xc
push edi
call fcn.0043b7c0
mov edi, dword [ebp - 0x44]
add esp, 0x10
mov dword [ebp - 0x34], eax
mov esi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x4390f4
mov dword [ebp - 0x18], edi
mov al, byte [ecx]
test al, al
je 0x4390dc
cmp al, 0x20
je 0x439043
cmp al, 0xa
je 0x439043
cmp al, 9
je 0x439043
mov edx, ecx
cmp al, 0x22
jne 0x439034
jmp 0x439043
cmp al, 0xa
je 0x439043
cmp al, 9
je 0x439043
inc edx
cmp al, 0x22
je 0x439043
mov al, byte [edx + 1]
test al, al
je 0x4391b1
cmp al, 0x20
jne 0x439027
mov byte [esi], 0x22
inc esi
mov al, byte [ecx]
mov dword [ebp - 0x24], 0
test al, al
je 0x4390b3
mov edi, ecx
mov dword [ebp - 0x28], 1
jmp 0x439078
mov al, byte [edi]
mov byte [esi], al
inc esi
mov edx, dword [ebp - 0x24]
inc edx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x24]
lea edi, [ecx + edx]
mov al, byte [edi]
test al, al
je 0x4390ac
cmp al, 0x22
jne 0x439060
mov ebx, dword [ebp - 0x24]
dec ebx
cmp ebx, 0xffffffff
je 0x4390a6
mov eax, dword [ebp - 0x24]
cmp byte [eax + ecx - 1], 0x5c
jne 0x4390a6
lea edx, [ecx + eax]
jmp 0x43909c
mov al, byte [edx - 2]
dec edx
cmp al, 0x5c
jne 0x4390a6
dec ebx
mov byte [esi], 0x5c
inc esi
cmp ebx, 0xffffffff
jne 0x439094
mov byte [esi], 0x5c
inc esi
jmp 0x439060
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4390dc
mov ebx, dword [ebp - 0x24]
dec ebx
js 0x4390d8
cmp byte [ecx + ebx], 0x5c
jne 0x4390d8
mov edx, dword [ebp - 0x24]
add edx, ecx
jmp 0x4390ce
mov al, byte [edx - 2]
dec edx
cmp al, 0x5c
jne 0x4390d8
dec ebx
mov byte [esi], 0x5c
inc esi
cmp ebx, 0xffffffff
jne 0x4390c6
mov byte [esi], 0x22
inc esi
mov byte [esi], 0x20
inc esi
mov edi, dword [ebp - 0x18]
mov ecx, dword [edi + 4]
add edi, 4
mov dword [ebp - 0x18], edi
test ecx, ecx
jne 0x439009
mov byte [esi - 1], 0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x439183
push eax
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov edi, dword [ebp + 0xc]
push edi
push 1
push 0
push 0
mov esi, dword [ebp - 0x34]
push esi
mov ebx, dword [ebp - 0x38]
push ebx
call sub.KERNEL32.dll_CreateProcessA
pop edx
test eax, eax
pop ecx
je 0x439230
mov eax, dword [ebp + 0x14]
sub esp, 0xc
mov esi, dword [eax + 4]
push esi
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [ebp - 0x38]
push ebx
call sub.msvcrt.dll_free
mov edx, dword [ebp - 0x30]
pop ecx
push edx
call sub.msvcrt.dll_free
mov edx, dword [ebp + 0x14]
add esp, 0x10
mov eax, dword [edx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov edi, dword [ebp - 0x38]
push edi
call sub.msvcrt.dll_free
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp - 0x30]
push eax
call sub.msvcrt.dll_free
pop eax
mov eax, dword [ebp - 0x34]
push eax
call sub.msvcrt.dll_free
pop eax
mov eax, dword [ebp - 0x38]
push eax
call sub.msvcrt.dll_free
or eax, 0xffffffff
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
jmp 0x439060
mov al, byte [edi]
test al, al
je 0x439166
mov esi, edi
jmp 0x438e1f
xor eax, eax
mov dword [ebp - 0x20], 0
jmp 0x438fc4
mov dword [ebp - 0x30], 0
jmp 0x438da8
push eax
push eax
push 0x5c
mov eax, dword [ebp - 0x3c]
push eax
call sub.msvcrt.dll_strchr
add esp, 0x10
test eax, eax
jne 0x438dcf
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x438dcf
sub esp, 0xc
push 0x49fc5e
call sub.msvcrt.dll_getenv
add esp, 0x10
mov esi, eax
test eax, eax
jne 0x438dd4
jmp 0x438dcf
sub esp, 0xc
mov edi, dword [ebp - 0x30]
push edi
jmp 0x439194