Function at 0x4a8ca0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2a0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [esp + 0x298], eax
lea esi, [esp + 0x108]
push 0x190
push 0
push esi
call fcn.00460af0
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4a8ce4
mov eax, dword [ebx]
mov dword [esp + 8], ebx
mov ebx, dword [ebp + 8]
push 0xc8
push eax
push esi
call fcn.004b5660
add esp, 0xc
push esi
call fcn.00440200
add esp, 4
cmp byte [edi + 0x11], 0
jne 0x4a8ece
mov dword [esp + 0x20], 0xa
mov eax, dword [0x4da78c]
mov al, byte [eax + 0xa]
test al, al
jne 0x4a93c2
xor eax, eax
dec eax
lea edi, [esp + 0xe4]
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], eax
lea esi, [esp + 0x90]
push 0x100
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
push esi
call fcn.004479e0
add esp, 0x10
mov ecx, edi
push 0x4eeac8
push esi
call fcn.00434250
pxor xmm0, xmm0
movdqa xmmword [esp + 0xf0], xmm0
pcmpeqd xmm0, xmm0
movdqu xmmword [esi + 0x3c], xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ecx, [esp + 0x90]
call fcn.004b58e0
xor edi, edi
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0x3e], 0
mov ecx, 0
je 0x4a8db5
call fcn.00444690
xor ecx, ecx
cmp eax, 0x10
setge cl
mov edx, dword [esi + 0x18]
xor eax, eax
cmp edx, dword [esi + 0x1c]
setne al
add eax, ecx
je 0x4a8dde
lea ecx, [esp + 0x90]
push eax
call fcn.004b5940
mov edi, 0x80000
test al, al
je 0x4a8e7b
cmp byte [esi + 0x3e], 0
je 0x4a8e11
call fcn.00444690
cmp eax, 0x10
jl 0x4a8e11
lea eax, [esp + 0xf0]
or byte [eax + 0xb], 0x20
lea ecx, [esp + 0x90]
push 0x10
push eax
push 0x20007
call fcn.004b59f0
test al, al
je 0x4a8e7b
mov dword [esp + 0xc], edi
cmp dword [esi + 0x14], 1
mov ebx, dword [esi + 0x18]
sete cl
mov edi, dword [esi + 0x1c]
cmp ebx, edi
je 0x4a8f30
cmp edi, ebx
js 0x4a8e78
xor esi, esi
inc esi
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4a933f
add ebx, 4
cmp ebx, edi
jne 0x4a8e31
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
sub edx, eax
je 0x4a938f
lea ecx, [esp + 0x90]
push edx
push eax
push 0x20002
call fcn.004b59f0
mov cl, 1
test al, al
jne 0x4a8f30
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.00445150
lea edi, [esp + 0x90]
mov ecx, edi
call fcn.004b5910
lea ecx, [esp + 0xe4]
call fcn.00434360
mov dword [esp + 0x20], 0xa
mov eax, dword [0x4da78c]
mov al, byte [eax + 0xa]
test al, al
jne 0x4a939e
mov ecx, dword [esp + 0x298]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x4a8ee2
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
test eax, eax
js 0x4a9388
mov esi, ebx
mov bl, byte [edi]
mov bh, byte [edi + 0x10]
je 0x4a8efe
cmp dword [esp + 8], 0
je 0x4a9381
lea edi, [esp + 0x90]
push eax
push dword [esp + 0xc]
push edi
call fcn.004b2f20
add esp, 0xc
movzx eax, bl
movzx ecx, bh
push eax
push ecx
push edi
mov ebx, esi
push esi
call fcn.004a8a60
add esp, 0x10
mov ecx, edi
call fcn.004306a0
jmp 0x4a8eb6
mov edi, dword [ebp + 0x10]
cmp byte [edi + 0x12], 0
je 0x4a8f41
or byte [esp + 0xc0], 0x80
mov byte [esp + 7], cl
cmp byte [edi + 0x28], 0
je 0x4a8f56
mov dword [esp + 0x9c], 0x4d138c
mov eax, dword [esp + 0xc0]
mov ecx, eax
or ecx, 1
mov dword [esp + 0xc0], ecx
movzx ecx, byte [edi + 0x10]
xor ecx, 1
mov word [esp + 0xc4], cx
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
mov esi, dword [edi + 0x38]
test ecx, ecx
jne 0x4a8f8d
test edx, edx
jne 0x4a8f8d
test esi, esi
je 0x4a8fd4
mov edi, dword [edi + 0x18]
mov ebx, dword [ebp + 0x10]
cmp edi, dword [ebx + 0x1c]
mov edi, dword [ebp + 0x10]
jne 0x4a8fb3
test ecx, ecx
je 0x4a93eb
test edx, edx
je 0x4a93ee
test esi, esi
je 0x4a93e8
or eax, 0x101
mov dword [esp + 0xc0], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], edx
mov dword [esp + 0xd4], esi
cmp dword [edi + 0x2c], 0
je 0x4a9015
call fcn.00444690
mov edx, dword [esp + 0xc]
lea ecx, [edx + 0x1000000]
cmp eax, 5
cmovl edx, ecx
mov ebx, edx
or ebx, 0x1000000
cmp byte [edi + 0x3c], 0
cmove ebx, edx
pxor xmm0, xmm0
movdqa xmmword [esp + 0x70], xmm0
movzx eax, byte [edi + 0xf]
test al, al
js 0x4a902b
add edi, 4
jmp 0x4a9031
mov edx, dword [esp + 0xc]
jmp 0x4a8fef
lea ecx, [esp + 0x60]
push dword [edx + 4]
push dword [edx]
call fcn.00444050
jmp 0x4a905f
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
test eax, eax
cmove edi, eax
xor eax, eax
dec eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov edx, dword [ebp + 0xc]
cmp byte [edx + 0xb], 0
js 0x4a901b
mov eax, dword [edx + 8]
mov dword [esp + 0x68], eax
movq xmm0, qword [edx]
movq qword [esp + 0x60], xmm0
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x24]
test eax, eax
je 0x4a90a8
xor ecx, ecx
lea edx, [esp + 0x20]
mov dword [edx], ecx
push ecx
push eax
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4a9290
or ebx, 0x400
mov ecx, dword [esp + 0x20]
movzx eax, byte [esp + 7]
mov dword [esp + 8], eax
cmp byte [esp + 0x6b], 0
js 0x4a917a
lea edx, [esp + 0x60]
jmp 0x4a917e
pxor xmm0, xmm0
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x28], 0
mov cl, byte [edx + 0x4c]
test cl, cl
jne 0x4a90e3
cmp dword [edx + 0x48], 0
jne 0x4a90e3
mov dword [esp + 8], 0
mov al, byte [esp + 7]
movzx ecx, al
cmp byte [esp + 0x6b], 0
js 0x4a9136
lea edx, [esp + 0x60]
jmp 0x4a913a
test cl, cl
je 0x4a92fd
mov eax, dword [ebp + 0x10]
add eax, 0x40
lea esi, [esp + 0x50]
push eax
push 0x4d6f48
push esi
call fcn.004b5a20
add esp, 0xc
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
movq xmm0, qword [esi]
movq qword [esp + 0x20], xmm0
cmp byte [esp + 0x2b], 0
mov al, byte [esp + 7]
jns 0x4a9126
mov ecx, dword [esp + 0x20]
jmp 0x4a912a
lea ecx, [esp + 0x20]
mov dword [esp + 8], ecx
or ebx, 0x400
jmp 0x4a90d3
mov edx, dword [esp + 0x60]
lea esi, [esp + 0x70]
xor eax, eax
push esi
lea esi, [esp + 0x98]
push esi
push edi
push dword [esp + 0x14]
push ebx
push ecx
push eax
push eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a929e
cmp byte [esp + 0x2b], 0
mov ebx, dword [ebp + 8]
jns 0x4a91ba
push dword [esp + 0x20]
call fcn.0045702d
add esp, 4
jmp 0x4a91ba
mov edx, dword [esp + 0x60]
lea esi, [esp + 0x70]
xor eax, eax
push esi
lea esi, [esp + 0x98]
push esi
push edi
push ecx
push ebx
push dword [esp + 0x1c]
push eax
push eax
push edx
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
push dword [esp + 0x20]
call sub.USERENV.dll_DestroyEnvironmentBlock
test edi, edi
je 0x4a9290
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
pcmpeqd xmm0, xmm0
lea ecx, [esp + 0x50]
movdqa xmmword [ecx], xmm0
lea eax, [esp + 0x70]
push eax
call fcn.004b5cd0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4a91ed
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x4a92bf
cmp byte [esi + 0x3d], 0
je 0x4a9206
push dword [esp + 0x50]
call fcn.004b5370
add esp, 4
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [esi], 0
je 0x4a925a
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x1c6
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
push esi
call fcn.004479e0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00434450
push 0xffffffffffffffff
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
call fcn.004344c0
lea ecx, [esp + 0x50]
call fcn.004b5de0
mov ecx, ebx
push eax
call fcn.00445150
lea ecx, [esp + 0x50]
call fcn.004b5d40
cmp byte [esp + 0x6b], 0
jns 0x4a8e84
push dword [esp + 0x60]
call fcn.0045702d
add esp, 4
jmp 0x4a8e84
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.00445150
jmp 0x4a9274
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.00445150
cmp byte [esp + 0x2b], 0
jns 0x4a9274
push dword [esp + 0x20]
call fcn.0045702d
add esp, 4
jmp 0x4a9274
lea edi, [esp + 0x20]
xor eax, eax
dec eax
mov dword [edi + 4], eax
mov dword [edi], eax
lea ecx, [esp + 0x50]
call fcn.004b5de0
mov ecx, edi
push eax
call fcn.00445150
xor eax, eax
inc eax
mov ecx, edi
push eax
push eax
call fcn.004a7a40
mov ecx, ebx
push 0
call fcn.00445150
mov ecx, edi
call fcn.004451c0
jmp 0x4a926b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x4a9290
mov esi, eax
mov eax, dword [ebp + 0x10]
add eax, 0x40
lea edx, [esp + 0x50]
push eax
push esi
push edx
call fcn.004b5a20
add esp, 0xc
lea ecx, [esp + 0x50]
mov eax, dword [ecx + 8]
mov dword [esp + 0x28], eax
movq xmm0, qword [ecx]
movq qword [esp + 0x20], xmm0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x4a9115
push 0x13b
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
lea eax, [esp + 0x2c]
push eax
call fcn.004479e0
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.004b3530
add esp, 8
lea ecx, [esp + 0x8c]
call fcn.004b35e0
jmp 0x4a8e43
push str....._third_partylibc_srcinclude_string_view:313:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x4a9394
push str....._third_partylibc_srcinclude_string_view:311:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
jmp 0x4a9394
push str....._third_partylibc_srcinclude_vector:1400:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d143c
call fcn.0048e9c0
movzx eax, al
mov dword [esp + 0x90], 0
lea ecx, [esp + 0x20]
push 2
push edi
push ecx
push eax
call fcn.004a86f0
add esp, 0x10
jmp 0x4a8eb6
movzx eax, al
lea ecx, [esp + 0x90]
mov dword [ecx], str.LaunchProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004a7b00
add esp, 0x10
jmp 0x4a8d25
int3
int3
int3