Function at 0x470bb4
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xa2c
mov eax, dword [esp + 0xa40]
mov ebp, dword [eax]
mov esi, dword [esp + 0xa44]
mov dword [esp], 0x44
mov ebx, 0xffffffff
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov edx, 5
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov word [esp + 0x30], dx
mov word [esp + 0x32], cx
mov dword [esp + 0x34], ecx
movzx edx, byte [esi]
test edx, edx
je 0x470c52
mov edi, dword [ebp + 0x249c]
movzx ecx, word [edi + 0x24]
mov eax, dword [ebp + 0x24a0]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4]
add ecx, dword [edi]
movzx edi, word [ecx + edx*2]
test edi, 0x40
je 0x470c52
movzx edx, byte [esi + 1]
add esi, 1
test edx, edx
jne 0x470c3b
cmp edx, 0x24
jne 0x470c5d
add esi, 1
movzx edx, byte [esi]
test edx, edx
je 0x470c91
mov edi, dword [ebp + 0x249c]
movzx ecx, word [edi + 0x24]
mov eax, dword [ebp + 0x24a0]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4]
add ecx, dword [edi]
movzx edi, word [ecx + edx*2]
test edi, 0x40
je 0x470c91
movzx edx, byte [esi + 1]
add esi, 1
test edx, edx
jne 0x470c7a
test edx, edx
je 0x470cd5
lea edx, [esp]
lea eax, [esp + 0x44]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
test ebx, ebx
je 0x470cd5
push 0xffffffffffffffff
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jle 0x470d1d
lea edx, [esp + 0xa1c]
push ebx
push 0x4776f4
push edx
call dword [sym.imp.MSVCR71.dll_sprintf]
lea eax, [esp + 0xa28]
push eax
push 0x48243c
push ebp
call fcn.0041ac24
push 0x477980
push 2
push ebp
call fcn.0042e1b4
mov eax, 1
add esp, 0xa50
pop ebx
pop ebp
pop esi
pop edi
ret
push str.COMSPEC
call dword [sym.imp.MSVCR71.dll_getenv]
pop ecx
test eax, eax
je 0x470e13
lea edx, [esp + 0x54]
push dword [ebp + 0x24a0]
push dword [ebp + 0x249c]
push eax
push edx
call sub.OCI.dll_lxscop
add esp, 0x10
movzx edx, byte [esi]
test edx, edx
je 0x470d87
lea edx, [esp + 0x54]
push dword [ebp + 0x24a0]
push dword [ebp + 0x249c]
push str.__c
push edx
call sub.OCI.dll_lxscat
lea edx, [esp + 0x64]
push dword [ebp + 0x24a0]
push dword [ebp + 0x249c]
push esi
push edx
call sub.OCI.dll_lxscat
add esp, 0x20
lea esi, [esp + 0x54]
lea ecx, [esp]
lea edx, [esp + 0x44]
push edx
xor edi, edi
push ecx
push edi
push edi
push edi
push 1
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x470dee
call dword [sym.imp.MSVCR71.dll__errno]
mov eax, dword [eax]
mov dword [ebp + 0x252c], eax
lea edx, [ebp + 0x463c]
push edx
push ebp
call fcn.0040d2f0
push str.Command_not_success._n
push 2
push ebp
call fcn.0042e1b4
push str.Command_not_success.
push 0x48243c
push ebp
call fcn.0041ac24
xor eax, eax
add esp, 0xa4c
pop ebx
pop ebp
pop esi
pop edi
ret
push 0xffffffffffffffff
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x470cd9
push str.No_command_interpreter._n
push 2
push ebp
call fcn.0042e1b4
push str.No_command_interpreter.
push 0x48243c
push ebp
call fcn.0041ac24
xor eax, eax
add esp, 0xa44
pop ebx
pop ebp
pop esi
pop edi
ret