Function at 0x4401e0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
test r9, r9
mov r12, rcx
mov dword [rbp - 0x2c], edx
mov rsi, r8
mov r15, r9
je 0x44080c
cmp qword [r9], 0
je 0x44080c
mov edi, 1
jmp 0x440223
mov rdi, rax
lea rax, [rdi + 1]
mov ebx, edi
lea r8, [rdi*8]
cmp qword [r15 + rax*8 - 8], 0
jne 0x440220
lea rax, [r8 + 0x1e]
and rax, 0xfffffffffffffff0
call fcn.00459890
mov r13d, 1
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x50]
mov rcx, r14
call sub.msvcrt.dll_memcpy
lea r9, [0x00440150]
mov rdx, rdi
mov r8d, 8
mov rcx, r14
xor edi, edi
call sub.msvcrt.dll_qsort
nop dword [rax]
mov rcx, qword [r15 + rdi*8]
add rdi, 1
call sub.msvcrt.dll_strlen
cmp ebx, edi
lea r13d, [r13 + rax + 1]
jg 0x440280
movsxd rcx, r13d
xor r15d, r15d
call fcn.004386c0
mov qword [rbp - 0x28], rax
mov rcx, rax
nop dword [rax + rax]
mov rdx, qword [r14 + r15*8]
add r15, 1
call fcn.00441f10
cmp ebx, r15d
lea rcx, [rax + 1]
jg 0x4402b0
mov byte [rax + 1], 0
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r12
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x440819
lea r13, [0x004cb81e]
mov rax, r13
xor ecx, ecx
movzx edx, byte [rax]
test dl, dl
je 0x440344
nop
cmp dl, 0x3b
mov r8, rax
jne 0x440316
jmp 0x440513
cmp r9b, 0x3b
je 0x440323
add r8, 1
movzx r9d, byte [r8]
test r9b, r9b
jne 0x440310
mov rdi, r8
sub rdi, rax
cmp rcx, rdi
cmovb rcx, rdi
cmp r9b, 0x3b
je 0x440513
mov rax, r8
movzx edx, byte [rax]
test dl, dl
jne 0x440300
lea rcx, [rcx + rbx + 6]
mov r15, r13
call fcn.004386c0
mov rbx, rax
movzx eax, byte [r13]
mov r14, qword [sym.imp.KERNEL32.dll_CreateFileA]
test al, al
je 0x4407f0
cmp al, 0x3b
jne 0x440375
jmp 0x4407f0
cmp al, 0x3b
je 0x440381
add r15, 1
movzx eax, byte [r15]
test al, al
jne 0x440371
mov rdi, r15
mov rcx, rbx
mov rdx, r13
sub rdi, r13
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea r9, [rbx + rdi]
cmp r15, r13
mov rcx, r9
je 0x4403a9
add rcx, 1
mov byte [r9], 0x5c
mov rdx, r12
mov r13, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [r15], 0x3b
sete al
add r15, rax
movzx eax, byte [rbx]
test al, al
jne 0x4403dd
jmp 0x4403f3
add r13, 1
movzx eax, byte [r13]
test al, al
je 0x4403f3
cmp al, 0x2f
jne 0x4403d0
mov byte [r13], 0x5c
add r13, 1
movzx eax, byte [r13]
test al, al
jne 0x4403dd
lea rdi, str..com
lea rdx, str..com
jmp 0x440413
add rdi, 8
mov rdx, qword [rdi]
test rdx, rdx
je 0x4407d6
mov rcx, rbx
mov byte [r13], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r8d, 3
mov edx, 0x80000000
mov rcx, rbx
call r14
cmp rax, 0xffffffffffffffff
je 0x440403
mov rcx, rax
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r12
mov r13, qword [rsi]
test r13, r13
je 0x440860
lea r14, [rsi + 8]
xor r10d, r10d
mov r15d, 3
nop dword [rax]
movzx edx, byte [r13]
test dl, dl
je 0x4407f8
mov r11, r15
lea r9, [r13 - 2]
mov eax, 0xffffffff
xor r8d, r8d
sub r11, r13
jmp 0x4404c5
cmp dl, 0x20
je 0x4404cd
cmp dl, 9
je 0x44050b
cmp dl, 0x22
nop
je 0x4404d8
movzx edx, byte [r9 + 3]
lea rax, [r11 + r9]
add r9, 1
test dl, dl
je 0x440520
mov eax, ecx
cmp dl, 0xa
lea ecx, [rax + 1]
jne 0x4404a1
cmp dl, 0x22
mov r8d, 1
jne 0x4404b2
cmp eax, 0xffffffff
je 0x440507
cmp byte [r9 + 1], 0x5c
jne 0x440507
lea rdx, [r10 + 1]
mov r8, r9
add rax, rdx
jmp 0x4404ff
sub r8, 1
cmp byte [r8 + 1], 0x5c
jne 0x440507
add rdx, 1
cmp rdx, rax
mov r10, rdx
jne 0x4404f0
add r10, 1
mov r8d, 1
jmp 0x4404b2
add r8, 1
jmp 0x44033a
test r8d, r8d
mov edx, 1
je 0x44056c
cmp ecx, 0xffffffff
je 0x440567
movsxd rdx, ecx
cmp byte [r13 + rdx], 0x5c
jne 0x440567
lea r8, [r13 + rdx - 1]
lea rdx, [r10 + 1]
add rcx, rdx
jmp 0x44055f
sub r8, 1
cmp byte [r8 + 1], 0x5c
jne 0x440567
add rdx, 1
cmp rdx, rcx
mov r10, rdx
jne 0x440550
mov edx, 3
add r14, 8
mov r13, qword [r14 - 8]
add r10, rax
add r10, rdx
test r13, r13
jne 0x440480
mov rcx, r10
call fcn.004386c0
mov rcx, qword [rsi]
test rcx, rcx
je 0x440877
lea r14, [rsi + 8]
mov r10, rax
nop
movzx edx, byte [rcx]
test dl, dl
je 0x4405f8
mov r8d, edx
and r8d, 0xfffffffd
cmp r8b, 0x20
je 0x4407b1
sub edx, 9
cmp dl, 1
jbe 0x4407b1
add rcx, 1
jmp 0x4405f1
mov r8d, edx
and r8d, 0xfffffffd
cmp r8b, 0x20
je 0x4407b1
sub edx, 9
add rcx, 1
cmp dl, 1
jbe 0x4407b1
movzx edx, byte [rcx]
test dl, dl
jne 0x4405d0
mov r9, r10
xor r15d, r15d
mov rcx, qword [rsi]
movzx r8d, byte [rcx]
test r8b, r8b
je 0x4406ae
mov r13, 0xffffffffffffffff
mov r10d, 1
xor edx, edx
jmp 0x44064c
movzx edx, byte [rcx + rdx]
add r13, 1
lea r11, [r9 + 1]
mov byte [r9], dl
mov rcx, qword [rsi]
mov edx, r10d
lea r9, [r10 + 1]
movzx r8d, byte [rcx + r10]
test r8b, r8b
je 0x4406b3
mov rdx, r10
mov r10, r9
mov r9, r11
cmp r8b, 0x22
jne 0x440620
cmp r13d, 0xffffffff
je 0x4407c4
cmp byte [rcx + r13], 0x5c
jne 0x4407c4
mov ecx, r13d
lea r8, [r13 - 1]
lea r11, [r9 + rcx + 1]
mov rcx, r9
jmp 0x440692
mov r9, qword [rsi]
movzx r9d, byte [r9 + r8]
sub r8, 1
cmp r9b, 0x5c
jne 0x44069f
add rcx, 1
mov byte [rcx - 1], 0x5c
cmp rcx, r11
jne 0x440680
lea r9, [rcx + 1]
mov byte [rcx], 0x5c
mov rcx, qword [rsi]
jmp 0x440620
mov r11, r9
xor edx, edx
test r15d, r15d
je 0x440706
sub edx, 1
cmp edx, 0xffffffff
je 0x440804
movsxd r8, edx
cmp byte [rcx + r8], 0x5c
jne 0x440804
lea r9, [r11 + rdx + 1]
lea rcx, [r8 - 1]
mov rdx, r11
jmp 0x4406f2
mov r8, qword [rsi]
movzx r8d, byte [r8 + rcx]
sub rcx, 1
cmp r8b, 0x5c
jne 0x4406ff
add rdx, 1
mov byte [rdx - 1], 0x5c
cmp rdx, r9
jne 0x4406e0
lea r11, [rdx + 1]
mov byte [rdx], 0x22
mov rsi, r14
add r14, 8
mov byte [r11], 0x20
mov rcx, qword [r14 - 8]
lea r10, [r11 + 1]
test rcx, rcx
jne 0x4405a0
test rax, rax
mov byte [r10 - 1], 0
je 0x440889
mov rdi, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 1
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdx
mov rdi, qword [rbp - 0x28]
mov edx, dword [rbp + 0x50]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x440889
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
call r12
mov rcx, rbx
call sub.msvcrt.dll_free
mov rcx, qword [rbp - 0x28]
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x60]
mov rax, qword [rax]
lea rsp, [rbp - 0x18]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r9, [r10 + 1]
mov byte [r10], 0x22
mov r15d, 1
jmp 0x4405fe
mov rcx, r9
lea r9, [rcx + 1]
mov byte [rcx], 0x5c
mov rcx, qword [rsi]
jmp 0x440620
movzx eax, byte [r15]
test al, al
je 0x44087f
mov r13, r15
test al, al
mov r15, r13
jne 0x440368
mov rcx, rbx
jmp 0x4403a9
mov edx, 1
xor eax, eax
jmp 0x44056c
mov rdx, r11
jmp 0x4406ff
mov qword [rbp - 0x28], 0
jmp 0x4402ca
mov edx, 0x5c
mov rcx, r12
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x4402eb
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x4402eb
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r13, rax
jne 0x4402f2
jmp 0x4402eb
xor r10d, r10d
mov rcx, r10
call fcn.004386c0
mov rcx, qword [rsi]
test rcx, rcx
jne 0x440597
mov r10, rax
jmp 0x440722
mov rcx, rbx
xor ebx, ebx
call sub.msvcrt.dll_free
mov rcx, qword [rbp - 0x28]
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, 0xffffffffffffffff
jmp 0x4407a0