Function at 0x48b780
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor esi, esi
test r9, r9
mov r14, rcx
mov r12d, edx
mov rdi, r8
mov r15, r9
je 0x48b879
mov rsi, qword [r9]
test rsi, rsi
je 0x48b879
mov eax, 1
mov rsi, rax
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x48b7bd
lea r8, [rsi*8]
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.00497ea0
lea r13d, [rsi - 1]
sub rsp, rax
mov rdx, r15
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov r8d, 8
mov rcx, rbx
lea r9, [0x0048b700]
call sub.msvcrt.dll_qsort
lea rax, [r13*8]
mov r13d, 1
mov qword [rbp - 8], rax
lea rsi, [r15 + rax + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.msvcrt.dll_strlen
cmp r15, rsi
lea r13d, [r13 + rax + 1]
jne 0x48b830
movsxd rcx, r13d
call fcn.0048c870
mov rsi, rax
mov rax, qword [rbp - 8]
mov rcx, rsi
lea r13, [rax + rbx + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.0048cf20
cmp r13, rbx
lea rcx, [rax + 1]
jne 0x48b860
mov byte [rax + 1], 0
mov rcx, r14
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r14
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x48bdb1
lea r12, [0x00587354]
xor r8d, r8d
lea rcx, [r8 + rbx + 6]
call fcn.0048c870
mov qword [rbp + 0x60], rdi
mov rdi, r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 8], rsi
mov rbx, rax
movzx eax, byte [r12]
mov rsi, rdi
lea r15, str..com
cmp al, 0x3b
je 0x48bd6f
test al, al
je 0x48bd6f
nop word [rax + rax]
movzx eax, byte [rsi + 1]
add rsi, 1
cmp al, 0x3b
je 0x48b8f8
test al, al
jne 0x48b8e8
mov r12, rsi
mov rcx, rbx
mov rdx, rdi
sub r12, rdi
mov r8, r12
call sub.msvcrt.dll_memcpy
lea r8, [rbx + r12]
cmp rsi, rdi
mov rcx, r8
je 0x48b920
add rcx, 1
mov byte [r8], 0x5c
mov rdx, r14
mov r12, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [rsi], 0x3b
sete al
add rsi, rax
movzx eax, byte [rbx]
test al, al
je 0x48b957
nop dword [rax]
cmp al, 0x2f
jne 0x48b949
mov byte [r12], 0x5c
movzx eax, byte [r12 + 1]
add r12, 1
test al, al
jne 0x48b940
lea rdi, str..com
mov rdx, r15
jmp 0x48b979
mov rdx, qword [rdi + 8]
add rdi, 8
test rdx, rdx
je 0x48bd56
mov rcx, rbx
mov byte [r12], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
cmp rax, 0xffffffffffffffff
je 0x48b968
mov rdi, qword [rbp + 0x60]
mov rcx, rax
mov rsi, qword [rbp - 8]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x48be57
lea rax, [rdi + 8]
xor r8d, r8d
mov qword [rbp - 0x10], rsi
mov rdx, rbx
movabs r13, 0x500000200
mov r14d, 2
nop dword [rax + rax]
movzx r10d, byte [rcx]
lea r11, [rcx - 1]
xor esi, esi
mov r9d, 0xffffffff
test r10b, r10b
je 0x48bd06
mov qword [rbp - 8], rax
jmp 0x48ba31
movzx r10d, byte [r11 + 2]
lea rax, [r11 + 1]
test r10b, r10b
je 0x48baa8
mov r11, rax
mov r15d, r9d
add r9d, 1
cmp r10b, 0x22
ja 0x48ba20
bt r13, r10
jae 0x48ba20
cmp r10b, 0x22
mov esi, 1
jne 0x48ba20
cmp r15d, 0xffffffff
je 0x48bd90
lea rax, [r8 + 1]
mov ebx, r15d
mov r10, r11
add rbx, rax
jmp 0x48ba81
sub r10, 1
cmp rbx, rax
je 0x48bcc0
add rax, 1
cmp byte [r10], 0x5c
mov rsi, r8
mov r8, rax
je 0x48ba70
lea r8, [rsi + 1]
mov esi, 1
movzx r10d, byte [r11 + 2]
lea rax, [r11 + 1]
test r10b, r10b
jne 0x48ba2e
nop dword [rax]
mov r10, r14
mov rax, qword [rbp - 8]
sub r10, rcx
add r10, r11
test esi, esi
jne 0x48bcd8
add r8, r10
mov ecx, 1
add rax, 8
add r8, rcx
mov rcx, qword [rax - 8]
test rcx, rcx
jne 0x48ba00
mov rsi, qword [rbp - 0x10]
mov rbx, rdx
mov rcx, r8
call fcn.0048c870
mov r11, qword [rdi]
mov rdx, rax
test r11, r11
je 0x48be5f
lea r13, [rdi + 8]
mov r9, rax
movabs rdi, 0x500000200
nop dword [rax + rax]
movzx r8d, byte [r11]
mov ecx, 1
test r8b, r8b
mov eax, r8d
jne 0x48bb3a
jmp 0x48bb44
add rcx, 1
movzx eax, byte [r11 + rcx - 1]
test al, al
je 0x48bd10
cmp al, 0x22
ja 0x48bb28
bt rdi, rax
jae 0x48bb28
mov byte [r9], 0x22
movzx r8d, byte [r11]
lea rax, [r9 + 1]
test r8b, r8b
je 0x48be47
mov r14d, 1
lea rcx, [r11 - 1]
mov r10d, 0xffffffff
jmp 0x48bb8a
movzx r8d, byte [rcx + 1]
lea rax, [r15 + 1]
add rcx, 1
mov byte [r15], r8b
movzx r8d, byte [rcx + 1]
test r8b, r8b
je 0x48bbe0
mov r9d, r10d
add r10d, 1
cmp r8b, 0x22
mov r15, rax
jne 0x48bb70
cmp r9d, 0xffffffff
je 0x48bda1
lea r15, [rax + r9 + 1]
mov r8, rcx
jmp 0x48bbc1
sub r8, 1
cmp r15, rax
mov byte [rax - 1], 0x5c
je 0x48bca8
cmp byte [r8], 0x5c
mov r9, rax
lea rax, [rax + 1]
je 0x48bbb0
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x48bb70
test r14d, r14d
jne 0x48bd20
mov r11, qword [r13]
lea r9, [rax + 1]
add r13, 8
mov byte [rax], 0x20
test r11, r11
jne 0x48bb10
mov rax, qword [rbp + 0x80]
mov byte [r9 - 1], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], eax
mov qword [rbp - 8], rdx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbp - 8]
test eax, eax
je 0x48be89
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
call r12
mov rax, qword [rbp + 0x80]
mov rdx, qword [rbp - 8]
mov rdi, qword [rax]
mov rcx, rsi
mov qword [rbp - 8], rdx
call fcn.004a6450
mov rcx, qword [rbp - 8]
call fcn.004a6450
mov rcx, rbx
call fcn.004a6450
mov rax, rdi
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r9, r15
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x48bb70
mov rsi, rbx
lea r8, [rsi + 1]
mov esi, 1
jmp 0x48ba96
movsxd r9, r9d
add r9, rcx
lea ecx, [r15 + 2]
add rcx, r8
jmp 0x48bcfd
add r8, 1
sub r9, 1
cmp r8, rcx
je 0x48bd03
cmp byte [r9], 0x5c
je 0x48bcf0
add r8, r10
mov ecx, 3
jmp 0x48bac5
mov rax, r9
xor r14d, r14d
jmp 0x48bb5f
movsxd rcx, r10d
mov r10d, r10d
lea r9, [rax + r10 + 1]
add rcx, r11
jmp 0x48bd3d
sub rcx, 1
cmp r9, rax
mov byte [rax - 1], 0x5c
je 0x48bd80
cmp byte [rcx], 0x5c
mov r8, rax
lea rax, [rax + 1]
je 0x48bd30
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x48bbe9
movzx eax, byte [rsi]
test al, al
je 0x48be67
mov rdi, rsi
cmp al, 0x3b
mov rsi, rdi
jne 0x48b8da
mov rcx, rbx
jmp 0x48b920
mov r8, r9
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x48bbe9
mov rsi, r8
lea r8, [rsi + 1]
mov esi, 1
jmp 0x48ba96
mov r9, rax
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x48bb70
mov edx, 0x5c
mov rcx, r14
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x48b89a
and r12d, 1
je 0x48b89a
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r12, rax
je 0x48b89a
movzx edx, byte [rax]
test dl, dl
je 0x48b8a1
mov rcx, rax
xor r8d, r8d
cmp dl, 0x3b
mov rax, rcx
je 0x48be41
nop word [rax + rax]
movzx edx, byte [rax + 1]
add rax, 1
cmp dl, 0x3b
je 0x48be19
test dl, dl
jne 0x48be08
mov r9, rax
sub r9, rcx
mov rcx, rax
cmp r8, r9
cmovb r8, r9
cmp dl, 0x3b
je 0x48be41
movzx edx, byte [rcx]
test dl, dl
je 0x48b8a4
cmp dl, 0x3b
mov rax, rcx
jne 0x48be08
lea rcx, [rax + 1]
jmp 0x48be2e
mov r8, rax
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x48bbe9
xor r8d, r8d
jmp 0x48bae0
mov r9, rax
jmp 0x48bc01
mov rcx, rbx
mov qword [rbp - 0x10], rdx
mov rsi, qword [rbp - 8]
xor ebx, ebx
call fcn.004a6450
mov rdi, 0xffffffffffffffff
mov rdx, qword [rbp - 0x10]
jmp 0x48bc73
mov rdi, 0xffffffffffffffff
jmp 0x48bc73