Function at 0x4306b3
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x25c
mov eax, 0x47937c
call fcn.00434c50
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
xor esi, esi
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], eax
mov bl, 1
je 0x430865
cmp ecx, esi
je 0x43084e
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x4306f1
sub eax, ebx
sar eax, 1
je 0x43084e
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea edi, [ebp - 0x21a]
stosb byte es:[edi], al
lea eax, [ebp - 0x21a]
push eax
push dword [ebp - 0x220]
lea ecx, [ebp - 0x234]
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const___class_std::allocator_unsigned_short_int__const__]
push esi
push 0x4023c0
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], esi
call dword [sym.imp.msvcp60.dll_public:_unsigned_int___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::find_unsigned_short_int_const___unsigned_int_const]
mov ebx, eax
mov eax, dword [sym.imp.msvcp60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp ebx, dword [eax]
je 0x430813
mov esi, 0x4023bc
xor eax, eax
lea edi, [ebp - 0x219]
stosb byte es:[edi], al
lea eax, [ebp - 0x219]
push eax
push esi
lea ecx, [ebp - 0x248]
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_unsigned_short_int_const___class_std::allocator_unsigned_short_int__const__]
push dword [ebp - 0x224]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
push eax
call sub.msvcp60.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____cdecl_std::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__
push esi
push eax
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 2
call sub.msvcp60.dll_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____cdecl_std::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const___unsigned_short_int_const__
add esp, 0x18
push eax
push 2
push ebx
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 3
call dword [sym.imp.msvcp60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::replace_unsigned_int__unsigned_int__class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 1
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
push ebx
push 0x4023c0
lea ecx, [ebp - 0x234]
call dword [sym.imp.msvcp60.dll_public:_unsigned_int___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::find_unsigned_short_int_const___unsigned_int_const]
mov ebx, eax
mov eax, dword [sym.imp.msvcp60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp ebx, dword [eax]
jne 0x430763
xor esi, esi
push 1
push esi
lea ecx, [ebp - 0x234]
call dword [sym.imp.msvcp60.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x4023b0
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call dword [sym.imp.msvcp60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
jmp 0x430865
push 3
push esi
push esi
push edi
push 0x4023b0
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
mov al, bl
call fcn.00434ce2
ret 0x10