Function at 0x4a3ad0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
test ebx, ebx
je 0x4a3ffc
mov eax, dword [ebx]
test eax, eax
je 0x4a3ffc
xor edi, edi
lea esi, [esi]
add edi, 1
mov eax, dword [ebx + edi*4]
lea esi, [edi*4]
test eax, eax
jne 0x4a3b00
lea eax, [esi + 0x1e]
shr eax, 4
shl eax, 4
call fcn.004b3a40
sub esp, eax
lea eax, [esp + 0x37]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
and eax, 0xfffffff0
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call fcn.004bc590
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], edi
mov edi, 1
mov dword [esp + 0xc], 0x4a3a50
mov dword [esp + 8], 4
mov dword [esp], eax
call sub.msvcrt.dll_qsort
lea eax, [ebx + esi]
mov dword [ebp - 0x24], esi
mov esi, eax
mov esi, esi
lea edi, [edi]
mov eax, dword [ebx]
add ebx, 4
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp esi, ebx
lea edi, [edi + eax + 1]
jne 0x4a3b70
mov dword [esp], edi
mov esi, dword [ebp - 0x24]
call fcn.004a4e90
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov edx, eax
add esi, edi
lea esi, [esi]
mov eax, dword [edi]
mov dword [esp], edx
add edi, 4
mov dword [esp + 4], eax
call fcn.004a5370
cmp esi, edi
lea edx, [eax + 1]
jne 0x4a3ba0
mov byte [eax + 1], 0
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x2f
mov dword [esp], esi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4a4011
mov esi, 0x4eaabe
xor edi, edi
mov eax, dword [ebp - 0x20]
mov ebx, esi
lea eax, [edi + eax + 6]
mov dword [esp], eax
call fcn.004a4e90
mov edi, eax
mov dword [ebp - 0x28], eax
movzx eax, byte [esi]
cmp al, 0x3b
je 0x4a4008
test al, al
mov esi, ebx
jne 0x4a3c19
jmp 0x4a4008
test al, al
je 0x4a3c23
add esi, 1
movzx eax, byte [esi]
cmp al, 0x3b
jne 0x4a3c15
mov ecx, esi
mov dword [esp + 4], ebx
mov dword [esp], edi
sub ecx, ebx
mov dword [esp + 8], ecx
mov dword [ebp - 0x20], ecx
call fcn.004bc590
mov ecx, dword [ebp - 0x20]
add ecx, edi
cmp esi, ebx
mov eax, ecx
je 0x4a3c4b
add eax, 1
mov byte [ecx], 0x5c
mov ebx, dword [ebp - 0x1c]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov ebx, edi
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [esi], 0x3b
sete al
add esi, eax
movzx eax, byte [edi]
test al, al
jne 0x4a3c7a
jmp 0x4a3c8b
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x4a3c8b
cmp al, 0x2f
jne 0x4a3c70
mov byte [ebx], 0x5c
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x4a3c7a
mov ecx, 0x4eaaf4
mov dword [ebp - 0x20], esi
mov eax, str..com
mov esi, ecx
jmp 0x4a3cad
add esi, 4
mov eax, dword [esi]
test eax, eax
je 0x4a3fc0
mov byte [ebx], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x4a3ca0
mov dword [esp], eax
xor edi, edi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x4a3db9
lea esi, [esi]
movzx edx, byte [ecx]
xor eax, eax
mov dword [ebp - 0x1c], 0
test dl, dl
jne 0x4a3d45
jmp 0x4a3ff0
movzx edx, byte [ecx + eax + 1]
lea ebx, [eax + 1]
mov esi, ebx
test dl, dl
je 0x4a3d94
mov eax, ebx
mov ebx, edx
and ebx, 0xfffffffd
cmp bl, 0x20
je 0x4a3e82
cmp dl, 9
je 0x4a3e82
cmp dl, 0x22
jne 0x4a3d35
lea edx, [eax - 1]
cmp edx, 0xffffffff
je 0x4a3d83
cmp byte [ecx + eax - 1], 0x5c
je 0x4a3d78
jmp 0x4a3d83
cmp byte [ecx + edx], 0x5c
jne 0x4a3d83
sub edx, 1
add edi, 1
cmp edx, 0xffffffff
jne 0x4a3d72
movzx edx, byte [ecx + eax + 1]
lea ebx, [eax + 1]
add edi, 1
mov esi, ebx
test dl, dl
jne 0x4a3d43
mov ebx, dword [ebp - 0x1c]
xor edx, edx
test ebx, ebx
jne 0x4a3e9b
add dword [ebp - 0x20], 4
lea edi, [esi + edi + 1]
mov eax, dword [ebp - 0x20]
add edi, edx
mov ecx, dword [eax - 4]
test ecx, ecx
jne 0x4a3d20
mov dword [esp], edi
call fcn.004a4e90
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov edx, dword [edi]
lea esi, [edi + 4]
mov dword [ebp - 0x1c], esi
mov esi, eax
test edx, edx
je 0x4a3eee
lea esi, [esi]
movzx ecx, byte [edx]
test cl, 0xdf
je 0x4a3eb0
cmp cl, 9
je 0x4a3eb0
cmp cl, 0x22
je 0x4a3eb0
xor ebx, ebx
mov edi, ecx
jmp 0x4a3e1a
mov ecx, eax
and ecx, 0xfffffffd
cmp cl, 0x20
je 0x4a3eb0
cmp al, 9
je 0x4a3eb0
add ebx, 1
movzx eax, byte [edx + ebx]
test al, al
jne 0x4a3e04
mov ecx, edi
mov eax, esi
xor edi, edi
mov ebx, 0xffffffff
jmp 0x4a3e4f
movzx ecx, byte [edx + ebx + 1]
lea eax, [esi + 1]
mov byte [esi], cl
lea esi, [ebx + 2]
add ebx, 1
movzx ecx, byte [edx + ebx + 1]
test cl, cl
je 0x4a3f80
cmp cl, 0x22
mov esi, eax
jne 0x4a3e32
cmp ebx, 0xffffffff
mov ecx, ebx
je 0x4a3e7a
cmp byte [edx + ebx], 0x5c
je 0x4a3e6b
jmp 0x4a3e7a
cmp byte [edx + ecx], 0x5c
jne 0x4a3e7a
sub ecx, 1
add eax, 1
mov byte [eax - 1], 0x5c
cmp ecx, 0xffffffff
jne 0x4a3e65
lea esi, [eax + 1]
mov byte [eax], 0x5c
jmp 0x4a3e32
mov dword [ebp - 0x1c], 1
jmp 0x4a3d5c
sub eax, 1
add edi, 1
cmp eax, 0xffffffff
je 0x4a3ea1
cmp byte [ecx + eax], 0x5c
je 0x4a3e90
mov edx, 2
jmp 0x4a3da1
mov byte [esi], 0x22
movzx ecx, byte [edx]
lea eax, [esi + 1]
mov edi, 1
test cl, cl
jne 0x4a3e2b
lea esi, [esi]
lea edi, [edi]
lea ecx, [eax + 1]
mov byte [eax], 0x22
add dword [ebp - 0x1c], 4
lea esi, [ecx + 1]
mov byte [ecx], 0x20
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax - 4]
test edx, edx
jne 0x4a3de0
mov eax, dword [ebp + 0x14]
mov byte [esi - 1], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x4a4097
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test edi, edi
mov ecx, eax
je 0x4a3ed6
lea ecx, [esi - 1]
cmp ecx, 0xffffffff
je 0x4a3ed0
cmp byte [edx + esi - 1], 0x5c
je 0x4a3fac
jmp 0x4a3ed0
cmp byte [edx + ecx], 0x5c
jne 0x4a3ed0
sub ecx, 1
add eax, 1
mov byte [eax - 1], 0x5c
cmp ecx, 0xffffffff
jne 0x4a3fa2
jmp 0x4a3ed0
mov esi, dword [ebp - 0x20]
movzx eax, byte [esi]
mov ebx, esi
test al, al
jne 0x4a3c02
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x4a3f77
mov edx, 2
xor esi, esi
jmp 0x4a3da1
mov dword [ebp - 0x24], 0
jmp 0x4a3bbc
mov eax, edi
mov esi, ebx
jmp 0x4a3c4b
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x4a3be2
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4a3be2
mov dword [esp], str.PATH
call sub.msvcrt.dll_getenv
test eax, eax
mov esi, eax
je 0x4a3be2
mov ecx, eax
xor edi, edi
nop
movzx edx, byte [ecx]
test dl, dl
je 0x4a3be9
cmp dl, 0x3b
mov eax, ecx
jne 0x4a4068
jmp 0x4a4090
test dl, dl
je 0x4a4073
add eax, 1
movzx edx, byte [eax]
cmp dl, 0x3b
jne 0x4a4064
mov ebx, eax
sub ebx, ecx
cmp edi, ebx
jae 0x4a407d
mov edi, ebx
cmp dl, 0x3b
je 0x4a4090
mov ecx, eax
jmp 0x4a4050
add eax, 1
mov ecx, eax
jmp 0x4a4050
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x4a3f77