Function at 0x4ed1f0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], 0
test ebx, ebx
je 0x4ed2dc
mov eax, dword [ebx]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4ed2dc
xor edi, edi
add edi, 1
mov ecx, dword [ebx + edi*4]
lea esi, [edi*4]
test ecx, ecx
jne 0x4ed223
lea eax, [esi + 0x1b]
shr eax, 4
shl eax, 4
call fcn.00471ce0
sub esp, eax
lea eax, [esp + 0x37]
mov dword [esp + 8], esi
and eax, 0xfffffff0
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call sym._memcpy
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], edi
mov edi, 1
mov dword [esp + 0xc], sym._env_compare
mov dword [esp], eax
mov dword [esp + 8], 4
call sym._qsort
lea eax, [esi + ebx]
mov dword [ebp - 0x24], esi
mov esi, eax
lea esi, [esi]
mov eax, dword [ebx]
add ebx, 4
mov dword [esp], eax
call sym._strlen
lea edi, [edi + eax + 1]
cmp esi, ebx
jne 0x4ed290
mov dword [esp], edi
mov esi, dword [ebp - 0x24]
call sym._xmalloc
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov edx, eax
add esi, ebx
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], edx
add ebx, 4
mov dword [esp + 4], eax
call sym._stpcpy
lea edx, [eax + 1]
cmp esi, ebx
jne 0x4ed2c0
mov byte [eax + 1], 0
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
call sym._strlen
mov dword [esp + 4], 0x2f
mov dword [esp], esi
mov dword [ebp - 0x20], eax
call sym._strchr
test eax, eax
je 0x4ed73a
mov ebx, 0x560fc4
xor esi, esi
mov eax, dword [ebp - 0x20]
mov edi, ebx
lea eax, [esi + eax + 6]
mov dword [esp], eax
call sym._xmalloc
mov dword [ebp - 0x28], eax
mov esi, eax
movzx eax, byte [ebx]
test al, al
je 0x4ed718
cmp al, 0x3b
je 0x4ed718
lea esi, [esi]
movzx eax, byte [edi + 1]
add edi, 1
cmp al, 0x3b
je 0x4ed347
test al, al
jne 0x4ed338
mov ecx, edi
mov dword [esp + 4], ebx
sub ecx, ebx
mov dword [esp], esi
mov dword [esp + 8], ecx
mov dword [ebp - 0x20], ecx
call sym._memcpy
mov ecx, dword [ebp - 0x20]
add ecx, esi
mov eax, ecx
cmp edi, ebx
je 0x4ed36f
mov byte [ecx], 0x5c
add eax, 1
mov ebx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov ebx, esi
call sym._strcpy
xor eax, eax
cmp byte [edi], 0x3b
sete al
add edi, eax
movzx eax, byte [esi]
test al, al
je 0x4ed3aa
lea esi, [esi]
cmp al, 0x2f
jne 0x4ed39f
mov byte [ebx], 0x5c
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
jne 0x4ed398
mov ecx, 0x569940
mov dword [ebp - 0x20], edi
mov eax, str..com
mov edi, ecx
jmp 0x4ed3ce
mov eax, dword [edi + 4]
add edi, 4
test eax, eax
je 0x4ed6fe
mov byte [ebx], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x4ed3c0
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34], eax
call eax
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov edi, dword [eax]
test edi, edi
je 0x4ed7c4
add eax, 4
xor edx, edx
mov dword [ebp - 0x20], eax
lea esi, [esi]
nop
movzx eax, byte [edi]
xor esi, esi
xor ebx, ebx
test al, al
je 0x4ed6e1
mov dword [ebp - 0x1c], edx
jmp 0x4ed46e
movzx eax, byte [edi + ebx + 1]
lea ecx, [ebx + 1]
test al, al
je 0x4ed4d0
mov ebx, ecx
lea ecx, [eax - 9]
cmp cl, 0x19
ja 0x4ed460
mov edx, 0x2800001
shr edx, cl
mov ecx, edx
and ecx, 1
mov ecx, 1
cmovne esi, ecx
cmp al, 0x22
jne 0x4ed460
mov ecx, dword [ebp - 0x1c]
lea eax, [ebx - 1]
test ebx, ebx
je 0x4ed4b4
mov edx, dword [ebp - 0x1c]
jmp 0x4ed4a9
sub eax, 1
jb 0x4ed6b8
cmp byte [edi + eax], 0x5c
mov ecx, edx
lea edx, [edx + 1]
je 0x4ed4a0
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
movzx eax, byte [edi + ebx + 1]
lea ecx, [ebx + 1]
test al, al
jne 0x4ed46c
lea esi, [esi]
lea esi, [esi]
mov edx, dword [ebp - 0x1c]
test esi, esi
jne 0x4ed6c8
add edx, ecx
xor eax, eax
add dword [ebp - 0x20], 4
lea edx, [edx + eax + 1]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax - 4]
test edi, edi
jne 0x4ed448
mov dword [esp], edx
call sym._xmalloc
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov edi, dword [esi]
test edi, edi
je 0x4ed7cb
add esi, 4
mov edx, eax
mov dword [ebp - 0x1c], esi
lea esi, [esi]
movzx ebx, byte [edi]
lea ecx, [edi + 1]
mov eax, ebx
test bl, bl
jne 0x4ed53e
jmp 0x4ed54f
movzx eax, byte [ecx]
add ecx, 1
test al, al
je 0x4ed6f0
sub eax, 9
cmp al, 0x19
ja 0x4ed530
mov esi, 0x2800001
bt esi, eax
jae 0x4ed530
mov byte [edx], 0x22
movzx ebx, byte [edi]
lea eax, [edx + 1]
test bl, bl
je 0x4ed72d
mov dword [ebp - 0x20], 1
mov ecx, 0xffffffff
mov edx, ebx
jmp 0x4ed583
movzx edx, byte [edi + esi + 1]
lea eax, [ebx + 1]
mov byte [ebx], dl
movzx edx, byte [edi + ecx + 1]
test dl, dl
je 0x4ed5c0
mov esi, ecx
mov ebx, eax
add ecx, 1
cmp dl, 0x22
jne 0x4ed570
mov ebx, esi
cmp esi, 0xffffffff
jne 0x4ed5ad
jmp 0x4ed6a8
mov byte [eax - 1], 0x5c
sub ebx, 1
jb 0x4ed6a8
cmp byte [edi + ebx], 0x5c
mov edx, eax
lea eax, [eax + 1]
je 0x4ed5a0
mov byte [edx], 0x5c
lea ebx, [edx + 1]
jmp 0x4ed570
mov edx, dword [ebp - 0x20]
add ecx, edi
lea ebx, [eax + esi + 2]
test edx, edx
jne 0x4ed68f
add dword [ebp - 0x1c], 4
lea edx, [eax + 1]
mov byte [eax], 0x20
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax - 4]
test edi, edi
jne 0x4ed518
mov eax, dword [ebp + 0x14]
mov byte [edx - 1], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x4ed7f3
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [eax - 1], 0x5c
sub ecx, 1
cmp ebx, eax
je 0x4ed720
cmp byte [ecx], 0x5c
mov edx, eax
lea eax, [eax + 1]
je 0x4ed680
mov byte [edx], 0x22
lea eax, [edx + 1]
jmp 0x4ed5d1
mov edx, eax
mov byte [edx], 0x5c
lea ebx, [edx + 1]
jmp 0x4ed570
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
jmp 0x4ed4ba
add edi, ebx
lea eax, [ecx + edx]
jmp 0x4ed6da
add edx, 1
sub edi, 1
cmp edx, eax
je 0x4ed6df
cmp byte [edi], 0x5c
je 0x4ed6d0
add edx, ecx
mov eax, 2
jmp 0x4ed4df
mov dword [ebp - 0x20], 0
mov eax, edx
jmp 0x4ed567
mov edi, dword [ebp - 0x20]
movzx eax, byte [edi]
test al, al
je 0x4ed7d3
mov ebx, edi
mov edi, ebx
test al, al
jne 0x4ed32a
mov eax, esi
jmp 0x4ed36f
mov edx, ebx
mov byte [edx], 0x22
lea eax, [edx + 1]
jmp 0x4ed5d1
mov edx, eax
mov byte [edx], 0x22
lea eax, [edx + 1]
jmp 0x4ed5d1
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sym._strchr
test eax, eax
jne 0x4ed302
test byte [ebp - 0x28], 1
je 0x4ed302
mov dword [esp], str.PATH
call sym._getenv
mov ebx, eax
test eax, eax
je 0x4ed302
movzx eax, byte [eax]
test al, al
je 0x4ed307
mov ecx, ebx
xor esi, esi
mov edx, ecx
cmp al, 0x3b
je 0x4ed7bf
lea esi, [esi]
nop
movzx eax, byte [edx + 1]
add edx, 1
cmp al, 0x3b
je 0x4ed79f
test al, al
jne 0x4ed790
mov edi, edx
sub edi, ecx
mov ecx, edx
cmp esi, edi
cmovb esi, edi
cmp al, 0x3b
je 0x4ed7bf
movzx eax, byte [ecx]
test al, al
je 0x4ed309
mov edx, ecx
cmp al, 0x3b
jne 0x4ed790
add ecx, 1
jmp 0x4ed7ae
xor edx, edx
jmp 0x4ed4f5
mov edx, dword [ebp - 0x30]
jmp 0x4ed5e9
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov eax, 0xffffffff
jmp 0x4ed673
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, 0xffffffff
jmp 0x4ed673