Function at 0x4acca0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2a0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [esp + 0x298], eax
lea esi, [esp + 0x108]
push 0x190
push 0
push esi
call fcn.00463600
add esp, 0xc
cmp byte [ebx + 0xb], 0
mov eax, ebx
jns 0x4acce4
mov eax, dword [ebx]
mov dword [esp + 8], ebx
mov ebx, dword [ebp + 8]
push 0xc8
push eax
push esi
call fcn.004b9fd0
add esp, 0xc
push esi
call fcn.0044a8d0
add esp, 4
cmp byte [edi + 0x11], 0
jne 0x4acece
mov dword [esp + 0x20], 0xa
mov eax, dword [0x4e0908]
mov al, byte [eax + 0xa]
test al, al
jne 0x4ad3c2
xor eax, eax
dec eax
lea edi, [esp + 0xe4]
mov dword [edi + 8], eax
mov dword [edi + 4], eax
mov dword [edi], eax
lea esi, [esp + 0x90]
push 0x100
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
push esi
call fcn.0044c8f0
add esp, 0x10
mov ecx, edi
push 0x4f7b18
push esi
call fcn.00434b90
pxor xmm0, xmm0
movdqa xmmword [esp + 0xf0], xmm0
pcmpeqd xmm0, xmm0
movdqu xmmword [esi + 0x3c], xmm0
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ecx, [esp + 0x90]
call fcn.004ba250
xor edi, edi
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0x3e], 0
mov ecx, 0
je 0x4acdb5
call fcn.00449fa0
xor ecx, ecx
cmp eax, 0x10
setge cl
mov edx, dword [esi + 0x18]
xor eax, eax
cmp edx, dword [esi + 0x1c]
setne al
add eax, ecx
je 0x4acdde
lea ecx, [esp + 0x90]
push eax
call fcn.004ba2b0
mov edi, 0x80000
test al, al
je 0x4ace7b
cmp byte [esi + 0x3e], 0
je 0x4ace11
call fcn.00449fa0
cmp eax, 0x10
jl 0x4ace11
lea eax, [esp + 0xf0]
or byte [eax + 0xb], 0x20
lea ecx, [esp + 0x90]
push 0x10
push eax
push 0x20007
call fcn.004ba360
test al, al
je 0x4ace7b
mov dword [esp + 0xc], edi
cmp dword [esi + 0x14], 1
mov ebx, dword [esi + 0x18]
sete cl
mov edi, dword [esi + 0x1c]
cmp ebx, edi
je 0x4acf30
cmp edi, ebx
js 0x4ace78
xor esi, esi
inc esi
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4ad33f
add ebx, 4
cmp ebx, edi
jne 0x4ace31
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x1c]
sub edx, eax
je 0x4ad38f
lea ecx, [esp + 0x90]
push edx
push eax
push 0x20002
call fcn.004ba360
mov cl, 1
test al, al
jne 0x4acf30
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.0042c040
lea edi, [esp + 0x90]
mov ecx, edi
call fcn.004ba280
lea ecx, [esp + 0xe4]
call fcn.00434ca0
mov dword [esp + 0x20], 0xa
mov eax, dword [0x4e0908]
mov al, byte [eax + 0xa]
test al, al
jne 0x4ad39e
mov ecx, dword [esp + 0x298]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x4acee2
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
test eax, eax
js 0x4ad388
mov esi, ebx
mov bl, byte [edi]
mov bh, byte [edi + 0x10]
je 0x4acefe
cmp dword [esp + 8], 0
je 0x4ad381
lea edi, [esp + 0x90]
push eax
push dword [esp + 0xc]
push edi
call fcn.004b75c0
add esp, 0xc
movzx eax, bl
movzx ecx, bh
push eax
push ecx
push edi
mov ebx, esi
push esi
call fcn.004aca60
add esp, 0x10
mov ecx, edi
call fcn.004b7590
jmp 0x4aceb6
mov edi, dword [ebp + 0x10]
cmp byte [edi + 0x12], 0
je 0x4acf41
or byte [esp + 0xc0], 0x80
mov byte [esp + 7], cl
cmp byte [edi + 0x28], 0
je 0x4acf56
mov dword [esp + 0x9c], 0x4d73ac
mov eax, dword [esp + 0xc0]
mov ecx, eax
or ecx, 1
mov dword [esp + 0xc0], ecx
movzx ecx, byte [edi + 0x10]
xor ecx, 1
mov word [esp + 0xc4], cx
mov ecx, dword [edi + 0x30]
mov edx, dword [edi + 0x34]
mov esi, dword [edi + 0x38]
test ecx, ecx
jne 0x4acf8d
test edx, edx
jne 0x4acf8d
test esi, esi
je 0x4acfd4
mov edi, dword [edi + 0x18]
mov ebx, dword [ebp + 0x10]
cmp edi, dword [ebx + 0x1c]
mov edi, dword [ebp + 0x10]
jne 0x4acfb3
test ecx, ecx
je 0x4ad3eb
test edx, edx
je 0x4ad3ee
test esi, esi
je 0x4ad3e8
or eax, 0x101
mov dword [esp + 0xc0], eax
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], edx
mov dword [esp + 0xd4], esi
cmp dword [edi + 0x2c], 0
je 0x4ad015
call fcn.00449fa0
mov edx, dword [esp + 0xc]
lea ecx, [edx + 0x1000000]
cmp eax, 5
cmovl edx, ecx
mov ebx, edx
or ebx, 0x1000000
cmp byte [edi + 0x3c], 0
cmove ebx, edx
pxor xmm0, xmm0
movdqa xmmword [esp + 0x70], xmm0
movzx eax, byte [edi + 0xf]
test al, al
js 0x4ad02b
add edi, 4
jmp 0x4ad031
mov edx, dword [esp + 0xc]
jmp 0x4acfef
lea ecx, [esp + 0x60]
push dword [edx + 4]
push dword [edx]
call fcn.00429fe0
jmp 0x4ad05f
mov eax, dword [edi + 8]
mov edi, dword [edi + 4]
test eax, eax
cmove edi, eax
xor eax, eax
dec eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov edx, dword [ebp + 0xc]
cmp byte [edx + 0xb], 0
js 0x4ad01b
mov eax, dword [edx + 8]
mov dword [esp + 0x68], eax
movq xmm0, qword [edx]
movq qword [esp + 0x60], xmm0
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x24]
test eax, eax
je 0x4ad0a8
xor ecx, ecx
lea edx, [esp + 0x20]
mov dword [edx], ecx
push ecx
push eax
push edx
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x4ad290
or ebx, 0x400
mov ecx, dword [esp + 0x20]
movzx eax, byte [esp + 7]
mov dword [esp + 8], eax
cmp byte [esp + 0x6b], 0
js 0x4ad17a
lea edx, [esp + 0x60]
jmp 0x4ad17e
pxor xmm0, xmm0
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x28], 0
mov cl, byte [edx + 0x4c]
test cl, cl
jne 0x4ad0e3
cmp dword [edx + 0x48], 0
jne 0x4ad0e3
mov dword [esp + 8], 0
mov al, byte [esp + 7]
movzx ecx, al
cmp byte [esp + 0x6b], 0
js 0x4ad136
lea edx, [esp + 0x60]
jmp 0x4ad13a
test cl, cl
je 0x4ad2fd
mov eax, dword [ebp + 0x10]
add eax, 0x40
lea esi, [esp + 0x50]
push eax
push 0x4dd0aa
push esi
call fcn.004ba390
add esp, 0xc
mov eax, dword [esi + 8]
mov dword [esp + 0x28], eax
movq xmm0, qword [esi]
movq qword [esp + 0x20], xmm0
cmp byte [esp + 0x2b], 0
mov al, byte [esp + 7]
jns 0x4ad126
mov ecx, dword [esp + 0x20]
jmp 0x4ad12a
lea ecx, [esp + 0x20]
mov dword [esp + 8], ecx
or ebx, 0x400
jmp 0x4ad0d3
mov edx, dword [esp + 0x60]
lea esi, [esp + 0x70]
xor eax, eax
push esi
lea esi, [esp + 0x98]
push esi
push edi
push dword [esp + 0x14]
push ebx
push ecx
push eax
push eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4ad29e
cmp byte [esp + 0x2b], 0
mov ebx, dword [ebp + 8]
jns 0x4ad1ba
push dword [esp + 0x20]
call fcn.00459b3c
add esp, 4
jmp 0x4ad1ba
mov edx, dword [esp + 0x60]
lea esi, [esp + 0x70]
xor eax, eax
push esi
lea esi, [esp + 0x98]
push esi
push edi
push ecx
push ebx
push dword [esp + 0x1c]
push eax
push eax
push edx
push eax
mov eax, dword [ebp + 0x10]
push dword [eax + 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
push dword [esp + 0x20]
call sub.USERENV.dll_DestroyEnvironmentBlock
test edi, edi
je 0x4ad290
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
pcmpeqd xmm0, xmm0
lea ecx, [esp + 0x50]
movdqa xmmword [ecx], xmm0
lea eax, [esp + 0x70]
push eax
call fcn.004ba640
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4ad1ed
push dword [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x4ad2bf
cmp byte [esi + 0x3d], 0
je 0x4ad206
push dword [esp + 0x50]
call fcn.004b9ce0
add esp, 4
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [esi], 0
je 0x4ad25a
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x1c6
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
push esi
call fcn.0044c8f0
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00434d90
push 0xffffffffffffffff
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, edi
call fcn.00434e00
lea ecx, [esp + 0x50]
call fcn.004ba750
mov ecx, ebx
push eax
call fcn.0042c040
lea ecx, [esp + 0x50]
call fcn.004ba6b0
cmp byte [esp + 0x6b], 0
jns 0x4ace84
push dword [esp + 0x60]
call fcn.00459b3c
add esp, 4
jmp 0x4ace84
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.0042c040
jmp 0x4ad274
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0
call fcn.0042c040
cmp byte [esp + 0x2b], 0
jns 0x4ad274
push dword [esp + 0x20]
call fcn.00459b3c
add esp, 4
jmp 0x4ad274
lea edi, [esp + 0x20]
xor eax, eax
dec eax
mov dword [edi + 4], eax
mov dword [edi], eax
lea ecx, [esp + 0x50]
call fcn.004ba750
mov ecx, edi
push eax
call fcn.0042c040
xor eax, eax
inc eax
mov ecx, edi
push eax
push eax
call fcn.004aba40
mov ecx, ebx
push 0
call fcn.0042c040
mov ecx, edi
call fcn.0042c0b0
jmp 0x4ad26b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
je 0x4ad290
mov esi, eax
mov eax, dword [ebp + 0x10]
add eax, 0x40
lea edx, [esp + 0x50]
push eax
push esi
push edx
call fcn.004ba390
add esp, 0xc
lea ecx, [esp + 0x50]
mov eax, dword [ecx + 8]
mov dword [esp + 0x28], eax
movq xmm0, qword [ecx]
movq qword [esp + 0x20], xmm0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x4ad115
push 0x13b
push str....._baseprocesslaunch_win.cc
push str.LaunchProcess
lea eax, [esp + 0x2c]
push eax
call fcn.0044c8f0
add esp, 0x10
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.004b7bf0
add esp, 8
lea ecx, [esp + 0x8c]
call fcn.004b7ca0
jmp 0x4ace43
push str....._third_partylibc_srcinclude_string_view:313:_assertion___len__0____s___nullptr_failed:_string_view::string_view__CharT___size_t_:_received_nullptr_n
jmp 0x4ad394
push str....._third_partylibc_srcinclude_string_view:311:_assertion___len___static_cast_size_type__numeric_limits_difference_type_::max____failed:_string_view::string_view__CharT___size_t_:_length_does_not_fit_in_difference_type_n
jmp 0x4ad394
push str....._third_partylibc_srcinclude_vector:1400:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d745c
call fcn.00492230
movzx eax, al
mov dword [esp + 0x90], 0
lea ecx, [esp + 0x20]
push 2
push edi
push ecx
push eax
call fcn.004ac6f0
add esp, 0x10
jmp 0x4aceb6
movzx eax, al
lea ecx, [esp + 0x90]
mov dword [ecx], str.LaunchProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004abb00
add esp, 0x10
jmp 0x4acd25
int3
int3
int3