Function at 0x4caf37
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
mov eax, 0x725ed8
call fcn.006db31c
sub esp, 0x4bc
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x4c8]
push 0x230
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.006dca70
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.004c6e26
add esp, 0x14
test al, al
jne 0x4caf9e
cmp byte [0x7ed364], bl
je 0x4cb143
lea ecx, [ebp - 0xd]
call fcn.004bfb8c
mov esi, eax
mov ecx, esi
call fcn.004ba4f5
push esi
call fcn.004cbae5
jmp 0x4cb142
push dword [ebp + 0x10]
lea eax, [ebp - 0x4c8]
push dword [ebp + 0xc]
push eax
call fcn.004c7505
push 0x44
pop esi
push esi
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.006dca70
add esp, 0x18
mov dword [ebp - 0x8c], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x84], str.winsta0default
push ebx
push dword [ebp - 0x14]
push eax
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x4cb014
cmp byte [0x7ed364], bl
je 0x4cb143
lea ecx, [ebp - 0xd]
call fcn.004bf2dd
mov esi, eax
mov ecx, esi
call fcn.004ba5b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.004cbae5
jmp 0x4cb141
xor eax, eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
push 0x20a
lea eax, [ebp - 0x298]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.006dca70
add esp, 0xc
lea eax, [ebp - 0x298]
push 0x105
push eax
push 0x72b890
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
lea ecx, [ebp - 0x298]
mov edx, str.C:WINDOWSSYSTEM32cmd.exe
cmove ecx, edx
push ecx
lea ecx, [ebp - 0x38]
call fcn.004b6b96
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x8c]
push ecx
push ebx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x4c8]
push 0x428
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push ecx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4cb104
cmp byte [0x7ed364], al
je 0x4cb0ce
lea ecx, [ebp - 0xd]
call fcn.004c31de
mov esi, eax
mov ecx, esi
call fcn.004ba51b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.004cbae5
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x4cb143
mov ecx, dword [ebp - 0x38]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
cmp eax, 0x1000
jb 0x4cb13a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00450606
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
jmp 0x4cb13a
mov eax, dword [ebp - 0x24]
mov bl, 1
cmp eax, 8
jb 0x4cb143
mov ecx, dword [ebp - 0x38]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
cmp eax, 0x1000
jb 0x4cb13a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00450606
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push ecx
call fcn.006db2db
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0
je 0x4cb151
push dword [ebp - 0x20]
call sub.USERENV.dll_DestroyEnvironmentBlock
cmp dword [ebp - 0x14], 0
je 0x4cb160
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret