Function at 0x4dee65
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Query environment variable

Disassembly:
mov eax, 0x10300
call fcn.00547290
nop
mov qword [rbp + 0x10], rcx
movabs rax, 0
mov qword [rbp - 0x10060], rax
movabs rax, 0
mov qword [rbp - 0x10058], rax
mov eax, 0
mov dword [rbp - 0x10050], eax
mov eax, 0
mov dword [rbp - 0x1004c], eax
mov eax, 0x18
mov r8, rax
lea rax, [rbp - 0x10060]
mov r11, rax
lea rax, [rbp - 0x10048]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov byte [rbp - 0x10030], al
movabs rax, 0xffff
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1002f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x30], rax
movabs rax, 0
mov qword [rbp - 0x28], rax
movabs rax, 0
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
mov eax, 0x10040
mov r11, rax
lea rax, [rbp - 0x10048]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0045af32
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x10]
add rax, 0x88
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
mov eax, 0x18
mov dword [rbp - 0x10130], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1012c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x10128], rax
movabs rax, 0
mov qword [rbp - 0x10120], rax
movabs rax, 0
mov qword [rbp - 0x10118], rax
mov eax, 0
mov dword [rbp - 0x10110], eax
mov eax, 0
mov dword [rbp - 0x1010c], eax
mov eax, 0
mov dword [rbp - 0x10108], eax
mov eax, 0
mov dword [rbp - 0x10104], eax
mov eax, 0
mov dword [rbp - 0x10100], eax
mov eax, 0
mov dword [rbp - 0x100fc], eax
mov eax, 0
mov dword [rbp - 0x100f8], eax
mov eax, 0
mov dword [rbp - 0x100f4], eax
mov eax, 0
mov word [rbp - 0x100f0], ax
mov eax, 0
mov word [rbp - 0x100ee], ax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x100ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x100e8], rax
movabs rax, 0
mov qword [rbp - 0x100e0], rax
movabs rax, 0
mov qword [rbp - 0x100d8], rax
movabs rax, 0
mov qword [rbp - 0x100d0], rax
mov eax, 0x68
mov r8, rax
lea rax, [rbp - 0x10130]
mov r11, rax
lea rax, [rbp - 0x100c8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov rax, qword [rbp + 0x10]
add rax, 0x78
movzx ecx, byte [rax]
cmp ecx, 0
je 0x4df467
mov eax, 0
mov dword [rbp - 0x10160], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1015c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov qword [rbp - 0x10158], rax
mov eax, 0
mov byte [rbp - 0x10150], al
movabs rax, 7
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1014f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0x18
mov r8, rax
lea rax, [rbp - 0x10160]
mov r11, rax
lea rax, [rbp - 0x10148]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0x18
mov dword [rbp - 0x10148], eax
mov eax, 1
mov byte [rbp - 0x10138], al
mov rax, qword [rbp - 8]
add rax, 0x10020
mov rcx, qword [rbp - 8]
add rcx, 0x10028
mov edx, 0
mov r9, rdx
lea rdx, [rbp - 0x10148]
mov r8, rdx
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreatePipe
mov byte [rbp - 0x10161], al
lea rax, str.CreatePipe_stdout
mov qword [rbp - 0x10178], rax
mov eax, 0x11
mov dword [rbp - 0x10170], eax
mov eax, 1
mov dword [rbp - 0x1016c], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10178]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
movzx eax, byte [rbp - 0x10161]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004deb5d
mov rax, qword [rbp - 8]
add rax, 0x10020
mov ecx, 0
mov r8, rcx
mov ecx, 1
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetHandleInformation
mov byte [rbp - 0x10179], al
lea rax, [0x005512d2]
mov qword [rbp - 0x10190], rax
mov eax, 0x14
mov dword [rbp - 0x10188], eax
mov eax, 1
mov dword [rbp - 0x10184], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10190]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
movzx eax, byte [rbp - 0x10179]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004deb5d
mov rax, qword [rbp - 8]
add rax, 0x10030
mov rcx, qword [rbp - 8]
add rcx, 0x10038
mov edx, 0
mov r9, rdx
lea rdx, [rbp - 0x10148]
mov r8, rdx
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreatePipe
mov byte [rbp - 0x10191], al
lea rax, str.CreatePipe_stderr
mov qword [rbp - 0x101a8], rax
mov eax, 0x11
mov dword [rbp - 0x101a0], eax
mov eax, 1
mov dword [rbp - 0x1019c], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x101a8]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
movzx eax, byte [rbp - 0x10191]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004deb5d
mov rax, qword [rbp - 8]
add rax, 0x10030
mov ecx, 0
mov r8, rcx
mov ecx, 1
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetHandleInformation
mov byte [rbp - 0x101a9], al
lea rax, str.SetHandleInformation_stderr
mov qword [rbp - 0x101c0], rax
mov eax, 0x1b
mov dword [rbp - 0x101b8], eax
mov eax, 1
mov dword [rbp - 0x101b4], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x101c0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
movzx eax, byte [rbp - 0x101a9]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004deb5d
mov rax, qword [rbp - 8]
add rax, 0x10018
mov rcx, qword [rax]
mov qword [rbp - 0x10078], rcx
mov rax, qword [rbp - 8]
add rax, 0x10028
mov rcx, qword [rax]
mov qword [rbp - 0x10070], rcx
mov rax, qword [rbp - 8]
add rax, 0x10038
mov rcx, qword [rax]
mov qword [rbp - 0x10068], rcx
mov eax, 0x100
mov dword [rbp - 0x1008c], eax
lea rax, [0x00551315]
mov qword [rbp - 0x10250], rax
mov eax, 0
mov dword [rbp - 0x10248], eax
mov eax, 1
mov dword [rbp - 0x10244], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10250]
mov r11, rax
lea rax, [rbp - 0x10240]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0xfe10
mov dword [rbp - 0x10230], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x1022c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x10]
mov ecx, 0x10
mov r8, rcx
mov r11, rax
lea rcx, [rbp - 0x10228]
mov r10, rcx
mov qword [rbp - 0x10258], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [0x00551316]
mov qword [rbp - 0x10268], rax
mov eax, 1
mov dword [rbp - 0x10260], eax
mov eax, 1
mov dword [rbp - 0x1025c], eax
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x10268]
mov r11, rax
lea rax, [rbp - 0x10218]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
mov eax, 0
mov dword [rbp - 0x10208], eax
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x10204]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov dword [rbp - 0x10200], eax
movabs rax, 0xc
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x101fc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x10240]
mov r8, rax
mov eax, 2
mov r11, rax
lea rax, [rbp - 0x101f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00475a61
mov rax, qword [rbp + 0x10]
add rax, 0x30
lea rcx, [0x00551318]
mov qword [rbp - 0x10288], rcx
mov ecx, 1
mov dword [rbp - 0x10280], ecx
mov ecx, 1
mov dword [rbp - 0x1027c], ecx
lea rcx, [rsp + 0x20]
mov edx, 0x10
mov r8, rdx
lea rdx, [rbp - 0x10288]
mov r11, rdx
mov r10, rcx
mov qword [rbp - 0x10258], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x20
mov r8, rcx
mov rcx, qword [rbp - 0x10258]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r8, [rsp + 0x20]
lea r11, [rsp + 0x30]
lea rax, [rbp - 0x10278]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0046fc09
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x10278]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x30]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x101f0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r8, [rsp + 0x20]
lea r11, [rsp + 0x30]
lea rax, [rbp - 0x101e0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.00469b8f
mov eax, 0x10
mov r8, rax
lea rax, [rbp - 0x101e0]
mov r11, rax
lea rax, [rbp - 0x101d0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x101d0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r10, [rsp + 0x20]
mov rcx, r10
call fcn.00476e52
mov rcx, qword [rbp - 8]
add rcx, 0x18
mov edx, 0x8000
mov r8, rdx
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, 0x20
mov dword [rbp - 0x1028c], eax
mov rax, qword [rbp + 0x10]
add rax, 0x79
movzx ecx, byte [rax]
cmp ecx, 0
je 0x4df79e
mov eax, dword [rbp - 0x1028c]
or eax, 0x200
mov dword [rbp - 0x1028c], eax
mov rax, qword [rbp - 8]
add rax, 0x18
mov rcx, qword [rbp - 8]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x100c8]
mov qword [rsp + 0x40], rcx
movabs rcx, 0
mov qword [rsp + 0x38], rcx
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x1028c]
mov qword [rsp + 0x28], rcx
mov ecx, 1
mov qword [rsp + 0x20], rcx
movabs rcx, 0
mov r9, rcx
movabs rcx, 0
mov r8, rcx
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateProcessW
mov byte [rbp - 0x1028d], al
lea rax, str.CreateProcess
mov qword [rbp - 0x102a0], rax
mov eax, 0xd
mov dword [rbp - 0x10298], eax
mov eax, 1
mov dword [rbp - 0x10294], eax
lea rax, [rsp + 0x20]
mov ecx, 0x10
mov r8, rcx
lea rcx, [rbp - 0x102a0]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memmove
lea r11, [rsp + 0x20]
movzx eax, byte [rbp - 0x1028d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.004deb5d
mov rax, qword [rbp + 0x10]
add rax, 0x78
movzx ecx, byte [rax]
cmp ecx, 0
je 0x4df8cc
mov rax, qword [rbp - 8]
add rax, 0x10028
mov r10, rax
mov rcx, r10
call fcn.004dee0d
mov rax, qword [rbp - 8]
add rax, 0x10038
mov r10, rax
mov rcx, r10
call fcn.004dee0d
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rbp - 8]
add rcx, 0x10
mov edx, dword [rcx]
mov dword [rax], edx
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov ecx, dword [rax]
mov dword [rbp - 0x102a4], ecx
mov eax, dword [rbp - 0x102a4]
leave
ret