Function at 0x402660
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
xor esi, esi
test r9, r9
mov r12, rcx
mov edi, edx
mov r13, r8
mov r15, r9
je 0x402759
cmp qword [r9], 0
je 0x402759
mov eax, 1
lea r14d, [rax - 1]
mov rsi, rax
lea r8, [rax*8]
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x40269d
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.00405f50
sub rsp, rax
mov rdx, r15
movsxd r14, r14d
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov r8d, 8
mov rcx, rbx
lea r9, [0x004025f0]
call sub.msvcrt.dll_qsort
lea rax, [r14*8]
mov r14d, 1
mov qword [rbp - 0x28], rax
lea rsi, [r15 + rax + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.msvcrt.dll_strlen
cmp r15, rsi
lea r14d, [r14 + rax + 1]
jne 0x402710
movsxd rcx, r14d
call fcn.00403690
mov rsi, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsi
lea r14, [rbx + rax + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.00403790
cmp r14, rbx
lea rcx, [rax + 1]
jne 0x402740
mov byte [rax + 1], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r12
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x402bf0
lea r15, [0x0040d2d4]
xor ecx, ecx
lea rcx, [rcx + rbx + 6]
call fcn.00403690
movzx edx, byte [r15]
mov rbx, rax
test dl, dl
mov rdi, r15
je 0x402c70
cmp dl, 0x3b
je 0x402c70
nop dword [rax + rax]
add rdi, 1
movzx eax, byte [rdi]
cmp al, 0x3b
je 0x4027bf
test al, al
jne 0x4027b0
mov r14, rdi
mov rcx, rbx
mov rdx, r15
sub r14, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
lea r10, [rbx + r14]
cmp rdi, r15
mov rcx, r10
je 0x4027e7
add rcx, 1
mov byte [r10], 0x5c
mov rdx, r12
mov r14, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [rdi], 0x3b
sete al
add rdi, rax
movzx eax, byte [rbx]
test al, al
je 0x402818
cmp al, 0x2f
jne 0x40280c
mov byte [r14], 0x5c
add r14, 1
movzx eax, byte [r14]
test al, al
jne 0x402804
lea r15, str..com
lea rdx, str..com
jmp 0x402840
add r15, 8
mov rdx, qword [r15]
test rdx, rdx
je 0x402bc1
mov rcx, rbx
mov byte [r14], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x402830
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rax, qword [r13]
test rax, rax
je 0x402c80
lea r10, [r13 + 8]
xor ecx, ecx
movzx edx, byte [rax]
xor r8d, r8d
xor r11d, r11d
test dl, dl
jne 0x4028c0
jmp 0x402a86
add r8, 1
movzx edx, byte [rax + r8]
test dl, dl
je 0x402930
mov r14d, edx
mov r12d, r8d
mov r9d, r8d
and r14d, 0xfffffffd
cmp r14b, 0x20
je 0x4028d8
cmp dl, 9
jne 0x4028b3
cmp dl, 0x22
mov r11d, 1
jne 0x4028b3
test r12d, r12d
je 0x402916
cmp byte [rax + r8 - 1], 0x5c
jne 0x402916
lea rdx, [r8 - 2]
lea r11, [r8 + rcx - 1]
jmp 0x40290b
sub rdx, 1
cmp byte [rax + rdx + 1], 0x5c
jne 0x402916
mov rcx, r11
sub rcx, rdx
cmp edx, 0xffffffff
jne 0x402900
add r8, 1
add rcx, 1
mov r11d, 1
movzx edx, byte [rax + r8]
test dl, dl
jne 0x4028c0
nop dword [rax]
test r11d, r11d
jne 0x402a50
add rcx, r8
mov eax, 1
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x4028a1
call fcn.00403690
mov r10, qword [r13]
test r10, r10
je 0x402ab1
add r13, 8
mov rdx, rax
movabs r15, 0x500000201
nop dword [rax + rax]
movzx r11d, byte [r10]
cmp r11b, 0x22
ja 0x402994
bt r15, r11
jb 0x402b33
lea rcx, [r10 + 1]
jmp 0x4029bf
mov r9d, r8d
add rcx, 1
and r9d, 0xfffffffd
cmp r9b, 0x20
je 0x402b33
cmp r8b, 9
je 0x402b33
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x4029a0
mov rcx, rdx
xor edx, edx
lea r12, [r10 - 1]
mov r8d, 0xffffffff
jmp 0x402a06
movzx r8d, byte [r12 + 1]
lea r9, [rcx + 1]
add r12, 1
mov byte [rcx], r8b
movzx r11d, byte [r12 + 1]
mov r8d, r14d
test r11b, r11b
je 0x402b50
mov rcx, r9
lea r14d, [r8 + 1]
cmp r11b, 0x22
jne 0x4029e0
cmp r8d, 0xffffffff
je 0x402a47
cmp byte [r12], 0x5c
jne 0x402a47
lea r9, [rcx + r8 + 1]
mov r8, r12
jmp 0x402a3a
sub r8, 1
cmp byte [r8], 0x5c
jne 0x402a47
add rcx, 1
mov byte [rcx - 1], 0x5c
cmp rcx, r9
jne 0x402a30
mov byte [rcx], 0x5c
add rcx, 1
jmp 0x4029e0
movsxd rdx, r9d
cmp byte [rax + rdx], 0x5c
jne 0x402a83
lea rax, [rax + rdx - 1]
add rcx, 1
add rdx, rcx
jmp 0x402a7e
sub rax, 1
cmp byte [rax + 1], 0x5c
jne 0x402a83
add rcx, 1
cmp rcx, rdx
jne 0x402a70
add rcx, r8
mov eax, 3
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x4028a1
call fcn.00403690
mov r10, qword [r13]
test r10, r10
jne 0x402967
mov rdx, rax
mov byte [rdx - 1], 0
mov rdx, qword [rbp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x48], rdx
mov rdx, qword [rbp + 0x58]
mov qword [rsp + 0x40], rdx
mov edx, dword [rbp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402c9a
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
call rdi
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rdx], 0x22
movzx r11d, byte [r10]
lea rcx, [rdx + 1]
test r11b, r11b
je 0x402b75
mov edx, 1
jmp 0x4029cd
test edx, edx
jne 0x402b80
mov r10, qword [r13]
lea rdx, [r9 + 1]
add r13, 8
mov byte [r9], 0x20
test r10, r10
jne 0x402980
jmp 0x402ab4
mov rcx, r9
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x402b54
movsxd rdx, r14d
cmp byte [r10 + rdx], 0x5c
jne 0x402b72
lea rdx, [r10 + rdx - 1]
lea rcx, [r9 + r14 + 1]
jmp 0x402baa
sub rdx, 1
cmp byte [rdx + 1], 0x5c
jne 0x402b72
add r9, 1
mov byte [r9 - 1], 0x5c
cmp r9, rcx
jne 0x402ba0
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x402b54
movzx edx, byte [rdi]
mov r15, rdi
test dl, dl
jne 0x402794
mov rcx, rbx
mov qword [rbp - 0x28], rax
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x28]
jmp 0x402b22
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x40277a
and edi, 1
je 0x40277a
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r15, rax
je 0x40277a
movzx edx, byte [rax]
mov r8, rax
xor ecx, ecx
nop
test dl, dl
je 0x402783
cmp dl, 0x3b
mov rax, r8
je 0x402c90
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x3b
je 0x402c50
test dl, dl
jne 0x402c40
mov rdi, rax
sub rdi, r8
cmp rcx, rdi
cmovb rcx, rdi
cmp dl, 0x3b
je 0x402c90
mov r8, rax
jmp 0x402c30
mov rcx, rbx
jmp 0x4027e7
xor ecx, ecx
jmp 0x402955
movzx edx, byte [rax + 1]
add rax, 1
jmp 0x402c62
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, 0xffffffffffffffff
jmp 0x402b22