Function at 0x466ef0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x50ddca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1fc]
mov dword [esp + 0x224], 0
test eax, eax
je 0x466f57
lea eax, [esp + 0x22c]
push eax
call fcn.00460780
test eax, eax
je 0x466f57
push 0
push ecx
lea edx, [esp + 0x234]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004e1b94
mov ecx, esi
call fcn.004604c0
jmp 0x467364
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x467001
lea eax, [esp + 8]
push 6
push eax
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov ecx, dword [eax]
push 0x55cbec
push ecx
mov byte [esp + 0x22c], 1
call fcn.004bdb15
add esp, 8
test eax, eax
je 0x466fc9
lea edx, [esp + 0xc]
push 4
push edx
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov eax, dword [eax]
push 0x55ce00
push eax
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
je 0x466fcb
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x224], 0
call fcn.004e1e27
test bl, bl
je 0x467001
push ecx
lea edx, [esp + 0x230]
mov ecx, esp
mov dword [esp + 0x10], esp
push edx
call fcn.004e1b94
call fcn.0041bc70
add esp, 4
jmp 0x467364
mov eax, dword [esp + 0x22c]
cmp word [eax], 0x25
jne 0x467030
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0x14]
lea ecx, [esp + 0x22c]
push edx
call fcn.004e1fbe
lea eax, [esp + 8]
push 2
push eax
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov ecx, dword [eax]
push 0x55c42c
push ecx
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 8]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
je 0x4670db
lea edx, [esp + 8]
push 2
push edx
lea ecx, [esp + 0x234]
call fcn.004d6dd8
push eax
lea ecx, [esp + 0x230]
mov byte [esp + 0x228], 2
call fcn.004e1f6e
lea ecx, [esp + 8]
mov byte [esp + 0x224], 0
call fcn.004e1e27
lea eax, [esp + 0x22c]
lea ecx, [esp + 8]
push eax
push 0x5762b0
push ecx
call fcn.004e2066
push eax
lea ecx, [esp + 0x230]
mov byte [esp + 0x228], 3
call fcn.004e1f6e
lea ecx, [esp + 8]
mov byte [esp + 0x224], 0
call fcn.004e1e27
mov eax, dword [esi + 0x1dc]
test eax, eax
je 0x467296
push 0x5c
lea ecx, [esp + 0x230]
call fcn.004d6fd9
push 0x2e
lea ecx, [esp + 0x230]
mov esi, eax
call fcn.004d6fd9
cmp eax, esi
jle 0x467190
push 0x2f
lea ecx, [esp + 0x230]
call fcn.004d6fd9
push 0x2e
lea ecx, [esp + 0x230]
mov esi, eax
call fcn.004d6fd9
cmp eax, esi
jle 0x467190
push 1
push 0x2e
lea ecx, [esp + 0x14]
call fcn.004d689e
lea edx, [esp + 8]
push 1
push edx
lea ecx, [esp + 0x234]
mov byte [esp + 0x22c], 4
call fcn.004d6e91
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
push edx
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 8]
test eax, eax
sete bl
call fcn.004e1e27
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], 0
call fcn.004e1e27
test bl, bl
je 0x467296
lea eax, [esp + 0x10]
push 5
push eax
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov ecx, dword [eax]
push 0x55eec0
push ecx
mov byte [esp + 0x22c], 5
call fcn.004bdb15
add esp, 8
test eax, eax
je 0x467269
lea edx, [esp + 8]
push 2
push edx
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov eax, dword [eax]
push 0x55c748
push eax
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 8]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
jne 0x467269
lea ecx, [esp + 0xc]
push 6
push ecx
lea ecx, [esp + 0x234]
call fcn.004d6f0d
mov edx, dword [eax]
push 0x55fa54
push edx
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 0xc]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
jne 0x467269
mov eax, dword [esp + 0x22c]
cmp dword [eax - 8], 2
jle 0x467265
cmp word [eax + 2], 0x3a
sete cl
test cl, cl
je 0x467265
mov ax, word [eax + 4]
cmp ax, 0x5c
je 0x467269
cmp ax, 0x2f
sete cl
test cl, cl
jne 0x467269
test ax, ax
sete al
test al, al
jne 0x467269
xor bl, bl
jmp 0x46726b
mov bl, 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x224], 0
call fcn.004e1e27
test bl, bl
je 0x467296
mov eax, dword [esp + 0x22c]
push 5
push 0
push 0x5705d0
push eax
jmp 0x467357
mov eax, dword [esp + 0x22c]
cmp dword [eax - 8], 2
jle 0x467382
cmp word [eax + 2], 0x3a
jne 0x467382
mov ax, word [eax + 4]
cmp ax, 0x5c
je 0x4672cb
cmp ax, 0x2f
je 0x4672cb
test ax, ax
jne 0x467382
lea ecx, [esp + 8]
push 4
push ecx
lea ecx, [esp + 0x234]
call fcn.004d6e91
mov edx, dword [eax]
push 0x561c68
push edx
mov byte [esp + 0x22c], 6
call fcn.004bdb15
add esp, 8
test eax, eax
je 0x46732f
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x234]
call fcn.004d6e91
mov ecx, dword [eax]
push 0x561c5c
push ecx
call fcn.004bdb15
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
call fcn.004e1e27
test bl, bl
je 0x467331
mov bl, 1
lea ecx, [esp + 8]
mov byte [esp + 0x224], 0
call fcn.004e1e27
test bl, bl
je 0x467382
mov edx, dword [esp + 0x22c]
push 5
push 0
push 0x5705d0
push edx
push 0x55cbfc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x22c]
mov dword [esp + 0x224], 0xffffffff
call fcn.004e1e27
mov eax, 1
jmp 0x46739b
lea ecx, [esp + 0x22c]
mov dword [esp + 0x224], 0xffffffff
call fcn.004e1e27
xor eax, eax
mov ecx, dword [esp + 0x21c]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x220
ret 4