Function at 0x444aa0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4a922f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1e8]
mov dword [esp + 0x128], 0
test eax, eax
je 0x444b32
push ecx
lea eax, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0048f8e6
mov ecx, edi
call fcn.0043e340
test eax, eax
je 0x444b32
push 0
push ecx
lea edx, [esp + 0x138]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0048f8e6
mov ecx, edi
call fcn.0043e020
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048fb71
mov eax, 1
jmp 0x444fbc
mov eax, dword [edi + 0x1e0]
test eax, eax
je 0x444c40
lea eax, [esp + 0xc]
push 6
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x128], 1
mov esi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444b8a
test cl, cl
je 0x444b86
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444b8a
add eax, 2
add esi, 2
test cl, cl
jne 0x444b62
xor eax, eax
jmp 0x444b8f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444bec
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.ftp.
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444bd5
test cl, cl
je 0x444bd1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444bd5
add eax, 2
add esi, 2
test cl, cl
jne 0x444bad
xor eax, eax
jmp 0x444bda
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
je 0x444bee
mov bl, 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048fb71
test bl, bl
je 0x444c40
push ecx
lea eax, [esp + 0x134]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0048f8e6
call fcn.00412d20
add esp, 4
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048fb71
mov eax, 1
jmp 0x444fbc
mov eax, dword [esp + 0x130]
cmp byte [eax], 0x25
jne 0x444c6e
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x130]
push edx
call fcn.0048fcfa
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d55b8
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444cb0
test cl, cl
je 0x444cac
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444cb0
add eax, 2
add esi, 2
test cl, cl
jne 0x444c88
xor eax, eax
jmp 0x444cb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048fb71
test bl, bl
je 0x444d3d
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.00487eea
push eax
lea ecx, [esp + 0x134]
mov byte [esp + 0x12c], 2
call fcn.0048fcaa
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048fb71
lea ecx, [esp + 0x130]
lea edx, [esp + 0xc]
push ecx
push 0x4ddfc4
push edx
call fcn.0048fda0
push eax
lea ecx, [esp + 0x134]
mov byte [esp + 0x12c], 3
call fcn.0048fcaa
lea ecx, [esp + 0xc]
mov byte [esp + 0x128], 0
call fcn.0048fb71
mov eax, dword [edi + 0x1c8]
test eax, eax
je 0x444fa3
push 0x5c
lea ecx, [esp + 0x134]
call fcn.00488097
push 0x2e
lea ecx, [esp + 0x134]
mov esi, eax
call fcn.00488097
cmp eax, esi
jle 0x444e19
push 0x2f
lea ecx, [esp + 0x134]
call fcn.00488097
push 0x2e
lea ecx, [esp + 0x134]
mov esi, eax
call fcn.00488097
cmp eax, esi
jle 0x444e19
push 1
push 0x2e
lea ecx, [esp + 0x18]
call fcn.00487bd9
lea eax, [esp + 0xc]
push 1
push eax
lea ecx, [esp + 0x138]
mov byte [esp + 0x130], 4
call fcn.00487fa3
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444ded
test cl, cl
je 0x444de9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444ded
add eax, 2
add esi, 2
test cl, cl
jne 0x444dc5
xor eax, eax
jmp 0x444df2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048fb71
lea ecx, [esp + 0x10]
mov byte [esp + 0x128], 0
call fcn.0048fb71
test bl, bl
je 0x444fa3
lea eax, [esp + 0x14]
push 5
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov byte [esp + 0x128], 5
mov esi, 0x4d6180
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444e63
test cl, cl
je 0x444e5f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444e63
add eax, 2
add esi, 2
test cl, cl
jne 0x444e3b
xor eax, eax
jmp 0x444e68
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x444f50
lea eax, [esp + 0xc]
push 2
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov esi, 0x4d6188
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444eb2
test cl, cl
je 0x444eae
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444eb2
add eax, 2
add esi, 2
test cl, cl
jne 0x444e8a
xor eax, eax
jmp 0x444eb7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x444f50
lea eax, [esp + 0x10]
push 6
push eax
lea ecx, [esp + 0x138]
call fcn.0048801f
mov eax, dword [eax]
mov esi, str.shell:
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x444f0f
test cl, cl
je 0x444f0b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x444f0f
add eax, 2
add esi, 2
test cl, cl
jne 0x444ee7
xor eax, eax
jmp 0x444f14
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.0048fb71
test bl, bl
jne 0x444f50
mov eax, dword [esp + 0x130]
cmp byte [eax + 1], 0x3a
jne 0x444f4c
mov al, byte [eax + 2]
cmp al, 0x5c
je 0x444f50
cmp al, 0x2f
sete cl
test cl, cl
jne 0x444f50
test al, al
sete al
test al, al
jne 0x444f50
xor bl, bl
jmp 0x444f52
mov bl, 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x128], 0
call fcn.0048fb71
test bl, bl
je 0x444fa3
mov eax, dword [esp + 0x130]
push 5
push 0
push 0x4db730
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048fb71
mov eax, 1
jmp 0x444fbc
lea ecx, [esp + 0x130]
mov dword [esp + 0x128], 0xffffffff
call fcn.0048fb71
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x120
ret 4