Function at 0x4810f0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
xor esi, esi
test r9, r9
mov r12, rcx
mov edi, edx
mov r13, r8
mov r15, r9
je 0x4811e9
cmp qword [r9], 0
je 0x4811e9
mov eax, 1
lea r14d, [rax - 1]
mov rsi, rax
lea r8, [rax*8]
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x48112d
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.0048deb0
sub rsp, rax
mov rdx, r15
movsxd r14, r14d
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov r8d, 8
mov rcx, rbx
lea r9, [0x00481080]
call sub.msvcrt.dll_qsort
lea rax, [r14*8]
mov r14d, 1
mov qword [rbp - 0x28], rax
lea rsi, [r15 + rax + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.msvcrt.dll_strlen
cmp r15, rsi
lea r14d, [r14 + rax + 1]
jne 0x4811a0
movsxd rcx, r14d
call fcn.00482890
mov rsi, rax
mov rax, qword [rbp - 0x28]
mov rcx, rsi
lea r14, [rbx + rax + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.00483000
cmp r14, rbx
lea rcx, [rax + 1]
jne 0x4811d0
mov byte [rax + 1], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r12
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x481680
lea r15, [0x005cc794]
xor ecx, ecx
lea rcx, [rcx + rbx + 6]
call fcn.00482890
movzx edx, byte [r15]
mov rbx, rax
test dl, dl
mov rdi, r15
je 0x481700
cmp dl, 0x3b
je 0x481700
nop dword [rax + rax]
add rdi, 1
movzx eax, byte [rdi]
cmp al, 0x3b
je 0x48124f
test al, al
jne 0x481240
mov r14, rdi
mov rcx, rbx
mov rdx, r15
sub r14, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
lea r10, [rbx + r14]
cmp rdi, r15
mov rcx, r10
je 0x481277
add rcx, 1
mov byte [r10], 0x5c
mov rdx, r12
mov r14, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [rdi], 0x3b
sete al
add rdi, rax
movzx eax, byte [rbx]
test al, al
je 0x4812a8
cmp al, 0x2f
jne 0x48129c
mov byte [r14], 0x5c
add r14, 1
movzx eax, byte [r14]
test al, al
jne 0x481294
lea r15, str..com
lea rdx, str..com
jmp 0x4812d0
add r15, 8
mov rdx, qword [r15]
test rdx, rdx
je 0x481651
mov rcx, rbx
mov byte [r14], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x4812c0
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rax, qword [r13]
test rax, rax
je 0x481710
lea r10, [r13 + 8]
xor ecx, ecx
movzx edx, byte [rax]
xor r8d, r8d
xor r11d, r11d
test dl, dl
jne 0x481350
jmp 0x481516
add r8, 1
movzx edx, byte [rax + r8]
test dl, dl
je 0x4813c0
mov r14d, edx
mov r12d, r8d
mov r9d, r8d
and r14d, 0xfffffffd
cmp r14b, 0x20
je 0x481368
cmp dl, 9
jne 0x481343
cmp dl, 0x22
mov r11d, 1
jne 0x481343
test r12d, r12d
je 0x4813a6
cmp byte [rax + r8 - 1], 0x5c
jne 0x4813a6
lea rdx, [r8 - 2]
lea r11, [r8 + rcx - 1]
jmp 0x48139b
sub rdx, 1
cmp byte [rax + rdx + 1], 0x5c
jne 0x4813a6
mov rcx, r11
sub rcx, rdx
cmp edx, 0xffffffff
jne 0x481390
add r8, 1
add rcx, 1
mov r11d, 1
movzx edx, byte [rax + r8]
test dl, dl
jne 0x481350
nop dword [rax]
test r11d, r11d
jne 0x4814e0
add rcx, r8
mov eax, 1
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x481331
call fcn.00482890
mov r10, qword [r13]
test r10, r10
je 0x481541
add r13, 8
mov rdx, rax
movabs r15, 0x500000201
nop dword [rax + rax]
movzx r11d, byte [r10]
cmp r11b, 0x22
ja 0x481424
bt r15, r11
jb 0x4815c3
lea rcx, [r10 + 1]
jmp 0x48144f
mov r9d, r8d
add rcx, 1
and r9d, 0xfffffffd
cmp r9b, 0x20
je 0x4815c3
cmp r8b, 9
je 0x4815c3
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x481430
mov rcx, rdx
xor edx, edx
lea r12, [r10 - 1]
mov r8d, 0xffffffff
jmp 0x481496
movzx r8d, byte [r12 + 1]
lea r9, [rcx + 1]
add r12, 1
mov byte [rcx], r8b
movzx r11d, byte [r12 + 1]
mov r8d, r14d
test r11b, r11b
je 0x4815e0
mov rcx, r9
lea r14d, [r8 + 1]
cmp r11b, 0x22
jne 0x481470
cmp r8d, 0xffffffff
je 0x4814d7
cmp byte [r12], 0x5c
jne 0x4814d7
lea r9, [rcx + r8 + 1]
mov r8, r12
jmp 0x4814ca
sub r8, 1
cmp byte [r8], 0x5c
jne 0x4814d7
add rcx, 1
mov byte [rcx - 1], 0x5c
cmp rcx, r9
jne 0x4814c0
mov byte [rcx], 0x5c
add rcx, 1
jmp 0x481470
movsxd rdx, r9d
cmp byte [rax + rdx], 0x5c
jne 0x481513
lea rax, [rax + rdx - 1]
add rcx, 1
add rdx, rcx
jmp 0x48150e
sub rax, 1
cmp byte [rax + 1], 0x5c
jne 0x481513
add rcx, 1
cmp rcx, rdx
jne 0x481500
add rcx, r8
mov eax, 3
add r10, 8
add rcx, rax
mov rax, qword [r10 - 8]
test rax, rax
jne 0x481331
call fcn.00482890
mov r10, qword [r13]
test r10, r10
jne 0x4813f7
mov rdx, rax
mov byte [rdx - 1], 0
mov rdx, qword [rbp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x48], rdx
mov rdx, qword [rbp + 0x58]
mov qword [rsp + 0x40], rdx
mov edx, dword [rbp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x48172a
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
call rdi
mov rcx, rbx
call fcn.0049a918
mov rcx, rsi
call fcn.0049a918
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rdx], 0x22
movzx r11d, byte [r10]
lea rcx, [rdx + 1]
test r11b, r11b
je 0x481605
mov edx, 1
jmp 0x48145d
test edx, edx
jne 0x481610
mov r10, qword [r13]
lea rdx, [r9 + 1]
add r13, 8
mov byte [r9], 0x20
test r10, r10
jne 0x481410
jmp 0x481544
mov rcx, r9
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x4815e4
movsxd rdx, r14d
cmp byte [r10 + rdx], 0x5c
jne 0x481602
lea rdx, [r10 + rdx - 1]
lea rcx, [r9 + r14 + 1]
jmp 0x48163a
sub rdx, 1
cmp byte [rdx + 1], 0x5c
jne 0x481602
add r9, 1
mov byte [r9 - 1], 0x5c
cmp r9, rcx
jne 0x481630
lea r9, [rcx + 1]
mov byte [rcx], 0x22
jmp 0x4815e4
movzx edx, byte [rdi]
mov r15, rdi
test dl, dl
jne 0x481224
mov rcx, rbx
mov qword [rbp - 0x28], rax
call fcn.0049a918
mov rcx, rsi
call fcn.0049a918
mov rax, qword [rbp - 0x28]
jmp 0x4815b2
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x48120a
and edi, 1
je 0x48120a
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r15, rax
je 0x48120a
movzx edx, byte [rax]
mov r8, rax
xor ecx, ecx
nop
test dl, dl
je 0x481213
cmp dl, 0x3b
mov rax, r8
je 0x481720
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x3b
je 0x4816e0
test dl, dl
jne 0x4816d0
mov rdi, rax
sub rdi, r8
cmp rcx, rdi
cmovb rcx, rdi
cmp dl, 0x3b
je 0x481720
mov r8, rax
jmp 0x4816c0
mov rcx, rbx
jmp 0x481277
xor ecx, ecx
jmp 0x4813e5
movzx edx, byte [rax + 1]
add rax, 1
jmp 0x4816f2
mov rcx, rsi
call fcn.0049a918
mov rcx, rbx
call fcn.0049a918
mov rax, 0xffffffffffffffff
jmp 0x4815b2