Function at 0x4c9da0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
sub rsp, 0x380
mov rbp, rsp
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x50], r8
mov qword [rbp + 0x70], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x370], 0
mov qword [rbp + 0xd8], 0
nop
xor rax, rax
mov byte [rbp + 0x67], al
lea rcx, [rbp + 0x378]
mov rdx, 0xffffffff80000000
lea r8, [0x004ca480]
xor r9, r9
call fcn.004aa3d0
cmp qword [rbp + 0x378], 0
je 0x4ca2e4
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4c9ed3
mov rcx, qword [rbp + 0x378]
call fcn.00411e10
mov rcx, rax
lea rdx, [rbp + 0x166]
mov r8d, 0x104
call sub.kernel32.dll_ExpandEnvironmentStringsW
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x166]
mov r8d, 0x105
call fcn.00411f10
jmp 0x4c9f34
lea rcx, [rbp + 0xc8]
mov rdx, qword [rbp + 0x378]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0xc8]
call fcn.00411320
mov rcx, rax
lea rdx, [rbp + 0x166]
mov r8d, 0x104
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0x166]
xor r8, r8
call fcn.00410cf0
lea rcx, [rbp + 0x378]
mov rdx, qword [rbp + 0xc0]
call fcn.00411f60
cmp qword [rbp + 0x378], 0
je 0x4ca2e4
lea rcx, [rbp + 0xd8]
mov rdx, qword [rbp + 0x68]
call fcn.00410750
lea rcx, [rbp + 0xd8]
call fcn.004c7f90
lea rcx, [0x004ca4c0]
mov rdx, qword [rbp + 0x378]
mov r8d, 1
mov r9d, 0x7fffffff
mov rax, qword [0x00bb70a8]
call qword [rax]
test eax, eax
jle 0x4c9fa8
lea rcx, [rbp + 0xd8]
lea rdx, [0x004ca4dc]
lea r8, [0x004ca4ec]
xor r9, r9
mov rax, qword [0x00bb7ab8]
call qword [rax]
lea rcx, [rbp + 0xb0]
mov rdx, qword [rbp + 0xd8]
call fcn.00427ef0
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0xb0]
lea r8, [0x00b30a78]
mov r9b, 0x25
call fcn.004c9c40
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0xb8]
call fcn.00411f60
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x58]
call fcn.00427ef0
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
lea r8, [0x00b30a78]
mov r9b, 0x25
call fcn.004c9c40
lea rcx, [rbp + 0x90]
mov rdx, qword [rbp + 0xa0]
call fcn.00411f60
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0x50]
call fcn.00427ef0
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
lea r8, [0x00b30a78]
mov r9b, 0x25
call fcn.004c9c40
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x88]
call fcn.00411f60
lea rcx, [rbp + 0x370]
mov edx, 6
lea r8, [0x004ca4fc]
mov r9, qword [rbp + 0xa8]
lea rax, [0x004ca518]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [0x004ca538]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], rax
call fcn.00412390
lea rcx, [rbp + 0x378]
lea rdx, [0x004ca554]
mov r8, qword [rbp + 0x370]
xor r9, r9
mov rax, qword [0x00bb7ab8]
call qword [rax]
test al, al
jne 0x4ca139
mov rcx, qword [rbp + 0x378]
call fcn.004108a0
mov rcx, qword [rbp + 0x378]
movsxd rax, eax
cmp word [rcx + rax*2 - 2], 0x20
je 0x4ca126
lea rcx, [rbp + 0x378]
mov edx, 3
mov r8, qword [rbp + 0x378]
lea r9, [0x004ca568]
mov rax, qword [rbp + 0x370]
mov qword [rsp + 0x20], rax
call fcn.00412390
jmp 0x4ca139
lea rcx, [rbp + 0x378]
mov rdx, qword [rbp + 0x370]
call fcn.00412180
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4ca1b6
mov rcx, qword [rbp + 0x378]
call fcn.004108a0
cmp eax, 0x7ffe
jle 0x4ca1b6
mov rax, qword [rbp + 0x378]
cmp word [rax + 0xfffa], 0x25
jne 0x4ca17f
lea rcx, [rbp + 0x378]
mov edx, 0x7ffd
call fcn.004120a0
jmp 0x4ca1b6
mov rax, qword [rbp + 0x378]
cmp word [rax + 0xfff8], 0x25
jne 0x4ca1a4
lea rcx, [rbp + 0x378]
mov edx, 0x7ffc
call fcn.004120a0
jmp 0x4ca1b6
lea rcx, [rbp + 0x378]
mov edx, 0x7ffe
call fcn.004120a0
lea rcx, [rbp + 0xf8]
mov edx, 0x68
call fcn.00421ad0
mov dword [rbp + 0xf8], 0x68
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x4ca240
mov rcx, qword [rbp + 0x378]
call fcn.00411e10
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
mov byte [rbp + 0x67], al
jmp 0x4ca2af
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x378]
xor r8, r8
call fcn.00411660
mov rcx, qword [rbp + 0x70]
call fcn.00411320
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessA
test eax, eax
setne al
mov byte [rbp + 0x67], al
movzx rax, byte [rbp + 0x67]
test al, al
je 0x4ca2e4
cmp qword [rbp + 0xe8], 0
je 0x4ca2ce
mov rcx, qword [rbp + 0xe8]
call sub.kernel32.dll_CloseHandle
cmp qword [rbp + 0xe0], 0
je 0x4ca2e4
mov rcx, qword [rbp + 0xe0]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x70]
call fcn.004100d0
lea rcx, [rbp + 0x78]
call fcn.00410080
lea rcx, [rbp + 0x80]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0x90]
call fcn.00410080
lea rcx, [rbp + 0x98]
mov edx, 2
call fcn.00410190
lea rcx, [rbp + 0xa8]
call fcn.00410080
lea rcx, [rbp + 0xb0]
mov edx, 4
call fcn.00410190
lea rcx, [rbp + 0xd8]
call fcn.00410080
lea rcx, [rbp + 0x370]
mov edx, 2
call fcn.00410160
movzx rax, byte [rbp + 0x67]
lea rsp, [rbp + 0x380]
pop rbp
ret