Function at 0x443d60
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4a8adf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1e8]
mov dword [esp + 0x128], 0
test eax, eax
je 0x443df2
push ecx
lea eax, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0048f3b6
mov ecx, edi
call fcn.0043d5d0
test eax, eax
je 0x443df2
push 0
push ecx
lea edx, [esp + 0x138]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0048f3b6
mov ecx, edi
call fcn.0043d2b0
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048f641
mov eax, 1
jmp 0x44427c
mov eax, dword [edi + 0x1e0]
test eax, eax
je 0x443f00
lea eax, [esp + 0xc]
push 6
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x128], 1
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443e4a
test cl, cl
je 0x443e46
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443e4a
add eax, 2
add esi, 2
test cl, cl
jne 0x443e22
xor eax, eax
jmp 0x443e4f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x443eac
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443e95
test cl, cl
je 0x443e91
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443e95
add eax, 2
add esi, 2
test cl, cl
jne 0x443e6d
xor eax, eax
jmp 0x443e9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
je 0x443eae
mov bl, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048f641
test bl, bl
je 0x443f00
push ecx
lea eax, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0048f3b6
call fcn.00411ef0
add esp, 4
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048f641
mov eax, 1
jmp 0x44427c
mov eax, dword [esp + 0x130]
cmp byte [eax], 0x25
jne 0x443f2e
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x130]
push edx
call fcn.0048f7ca
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, 0x4d447c
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x443f70
test cl, cl
je 0x443f6c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x443f70
add eax, 2
add esi, 2
test cl, cl
jne 0x443f48
xor eax, eax
jmp 0x443f75
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048f641
test bl, bl
je 0x443ffd
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.0048794a
push eax
lea ecx, [esp + 0x134]
mov byte [esp + 0x12c], 2
call fcn.0048f77a
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048f641
lea ecx, [esp + 0x130]
lea edx, [esp + 0xc]
push ecx
push 0x4decc0
push edx
call fcn.0048f870
push eax
lea ecx, [esp + 0x134]
mov byte [esp + 0x12c], 3
call fcn.0048f77a
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048f641
mov eax, dword [edi + 0x1c8]
test eax, eax
je 0x444263
push 0x5c
lea ecx, [esp + 0x134]
call fcn.00487af7
push 0x2e
lea ecx, [esp + 0x134]
mov esi, eax
call fcn.00487af7
cmp eax, esi
jle 0x4440d9
push 0x2f
lea ecx, [esp + 0x134]
call fcn.00487af7
push 0x2e
lea ecx, [esp + 0x134]
mov esi, eax
call fcn.00487af7
cmp eax, esi
jle 0x4440d9
push 1
push 0x2e
lea ecx, [esp + 0x18]
call fcn.00487639
lea eax, [esp + 0xc]
push 1
push eax
lea ecx, [esp + 0x138]
mov byte [esp + 0x130], 4
call fcn.00487a03
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4440ad
test cl, cl
je 0x4440a9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4440ad
add eax, 2
add esi, 2
test cl, cl
jne 0x444085
xor eax, eax
jmp 0x4440b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048f641
lea ecx, [esp + 0x10]
mov byte [esp + 0x128], 0
call fcn.0048f641
test bl, bl
je 0x444263
lea eax, [esp + 0x14]
push 5
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov byte [esp + 0x128], 5
mov esi, str.file:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444123
test cl, cl
je 0x44411f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444123
add eax, 2
add esi, 2
test cl, cl
jne 0x4440fb
xor eax, eax
jmp 0x444128
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444210
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, 0x4d4fd8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444172
test cl, cl
je 0x44416e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444172
add eax, 2
add esi, 2
test cl, cl
jne 0x44414a
xor eax, eax
jmp 0x444177
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048f641
test bl, bl
jne 0x444210
lea eax, [esp + 0x10]
push 6
push eax
lea ecx, [esp + 0x138]
call fcn.00487a7f
mov eax, dword [eax]
mov esi, str.shell:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4441cf
test cl, cl
je 0x4441cb
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4441cf
add eax, 2
add esi, 2
test cl, cl
jne 0x4441a7
xor eax, eax
jmp 0x4441d4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048f641
test bl, bl
jne 0x444210
mov eax, dword [esp + 0x130]
cmp byte [eax + 1], 0x3a
jne 0x44420c
mov al, byte [eax + 2]
cmp al, 0x5c
je 0x444210
cmp al, 0x2f
sete cl
test cl, cl
jne 0x444210
test al, al
sete al
test al, al
jne 0x444210
xor bl, bl
jmp 0x444212
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 0
call fcn.0048f641
test bl, bl
je 0x444263
mov eax, dword [esp + 0x130]
push 5
push 0
push 0x4dc430
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048f641
mov eax, 1
jmp 0x44427c
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048f641
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x120
ret 4