Function at 0x44c1e0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
test ebx, ebx
je 0x44c74e
mov eax, dword [ebx]
test eax, eax
je 0x44c74e
xor edi, edi
lea esi, [esi]
add edi, 1
mov eax, dword [ebx + edi*4]
lea esi, [edi*4]
test eax, eax
jne 0x44c210
lea eax, [esi + 0x1e]
shr eax, 4
shl eax, 4
call fcn.0046a050
sub esp, eax
lea eax, [esp + 0x37]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
and eax, 0xfffffff0
mov dword [esp], eax
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], edi
mov edi, 1
mov dword [esp + 0xc], 0x44c160
mov dword [esp + 8], 4
mov dword [esp], eax
call sub.msvcrt.dll_qsort
lea eax, [ebx + esi]
mov dword [ebp - 0x24], esi
mov esi, eax
mov esi, esi
lea edi, [edi]
mov eax, dword [ebx]
add ebx, 4
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp ebx, esi
lea edi, [edi + eax + 1]
jne 0x44c280
mov dword [esp], edi
mov esi, dword [ebp - 0x24]
call fcn.00444470
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov edx, eax
add esi, edi
lea esi, [esi]
mov eax, dword [edi]
mov dword [esp], edx
add edi, 4
mov dword [esp + 4], eax
call fcn.0044de20
cmp edi, esi
lea edx, [eax + 1]
jne 0x44c2b0
mov byte [eax + 1], 0
mov esi, dword [ebp - 0x1c]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x2f
mov dword [esp], esi
mov dword [ebp - 0x20], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x44c75a
mov esi, 0x4bea7e
mov ecx, esi
xor edi, edi
movzx edx, byte [ecx]
test dl, dl
je 0x44c33a
cmp dl, 0x3b
mov eax, ecx
jne 0x44c314
jmp 0x44c5fd
test dl, dl
je 0x44c31f
add eax, 1
movzx edx, byte [eax]
cmp dl, 0x3b
jne 0x44c310
mov ebx, eax
sub ebx, ecx
cmp edi, ebx
cmovb edi, ebx
cmp dl, 0x3b
je 0x44c5fd
mov ecx, eax
movzx edx, byte [ecx]
test dl, dl
jne 0x44c302
mov eax, dword [ebp - 0x20]
mov ebx, esi
lea eax, [edi + eax + 6]
mov dword [esp], eax
call fcn.00444470
mov edi, eax
mov dword [ebp - 0x28], eax
movzx eax, byte [esi]
cmp al, 0x3b
je 0x44c735
test al, al
mov esi, ebx
jne 0x44c374
jmp 0x44c735
test al, al
je 0x44c37e
add esi, 1
movzx eax, byte [esi]
cmp al, 0x3b
jne 0x44c370
mov ecx, esi
mov dword [esp + 4], ebx
mov dword [esp], edi
sub ecx, ebx
mov dword [esp + 8], ecx
mov dword [ebp - 0x20], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x20]
add ecx, edi
cmp esi, ebx
mov eax, ecx
je 0x44c3a6
add eax, 1
mov byte [ecx], 0x5c
mov ecx, dword [ebp - 0x1c]
mov dword [esp], eax
mov ebx, edi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [esi], 0x3b
sete al
add esi, eax
movzx eax, byte [edi]
test al, al
jne 0x44c3da
jmp 0x44c3eb
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x44c3eb
cmp al, 0x2f
jne 0x44c3d0
mov byte [ebx], 0x5c
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x44c3da
mov ecx, 0x4beab4
mov dword [ebp - 0x20], esi
mov eax, str..com
mov esi, ecx
jmp 0x44c40d
add esi, 4
mov eax, dword [esi]
test eax, eax
je 0x44c721
mov byte [ebx], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], edi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x44c400
mov dword [esp], eax
xor edi, edi
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0x20], eax
test ecx, ecx
je 0x44c52e
lea esi, [esi]
movzx edx, byte [ecx]
xor eax, eax
mov dword [ebp - 0x1c], 0
test dl, dl
jne 0x44c4a5
jmp 0x44c73e
movzx edx, byte [ecx + eax + 1]
lea ebx, [eax + 1]
mov esi, ebx
test dl, dl
je 0x44c4f4
mov eax, ebx
mov ebx, edx
and ebx, 0xfffffffd
cmp bl, 0x20
je 0x44c610
cmp dl, 9
je 0x44c610
cmp dl, 0x22
jne 0x44c495
lea edx, [eax - 1]
cmp edx, 0xffffffff
je 0x44c4e3
cmp byte [ecx + eax - 1], 0x5c
je 0x44c4d8
jmp 0x44c4e3
cmp byte [ecx + edx], 0x5c
jne 0x44c4e3
sub edx, 1
add edi, 1
cmp edx, 0xffffffff
jne 0x44c4d2
movzx edx, byte [ecx + eax + 1]
lea ebx, [eax + 1]
add edi, 1
mov esi, ebx
test dl, dl
jne 0x44c4a3
mov ebx, dword [ebp - 0x1c]
xor edx, edx
test ebx, ebx
jne 0x44c50b
jmp 0x44c516
sub eax, 1
add edi, 1
cmp eax, 0xffffffff
je 0x44c511
cmp byte [ecx + eax], 0x5c
je 0x44c500
mov edx, 2
add dword [ebp - 0x20], 4
lea edi, [edi + esi + 1]
mov eax, dword [ebp - 0x20]
add edi, edx
mov ecx, dword [eax - 4]
test ecx, ecx
jne 0x44c480
mov dword [esp], edi
call fcn.00444470
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov edx, dword [edi]
lea esi, [edi + 4]
mov dword [ebp - 0x1c], esi
mov esi, eax
test edx, edx
je 0x44c673
nop
movzx ebx, byte [edx]
test bl, bl
je 0x44c747
mov eax, ebx
and eax, 0xfffffffd
cmp al, 0x20
je 0x44c704
cmp bl, 9
je 0x44c704
lea ecx, [edx + 1]
mov edi, ebx
jmp 0x44c599
mov ebx, eax
add ecx, 1
and ebx, 0xfffffffd
cmp bl, 0x20
je 0x44c704
cmp al, 9
je 0x44c704
movzx eax, byte [ecx]
test al, al
jne 0x44c580
mov ebx, edi
mov eax, esi
xor edi, edi
mov ecx, 0xffffffff
jmp 0x44c5c9
movzx ebx, byte [edx + ecx + 1]
lea eax, [esi + 1]
mov byte [esi], bl
lea esi, [ecx + 2]
add ecx, 1
movzx ebx, byte [edx + ecx + 1]
test bl, bl
je 0x44c620
cmp bl, 0x22
mov esi, eax
jne 0x44c5b0
cmp ecx, 0xffffffff
mov ebx, ecx
je 0x44c5f5
cmp byte [edx + ecx], 0x5c
je 0x44c5e6
jmp 0x44c5f5
cmp byte [edx + ebx], 0x5c
jne 0x44c5f5
sub ebx, 1
add eax, 1
mov byte [eax - 1], 0x5c
cmp ebx, 0xffffffff
jne 0x44c5e0
lea esi, [eax + 1]
mov byte [eax], 0x5c
jmp 0x44c5b0
add eax, 1
mov ecx, eax
jmp 0x44c333
mov dword [ebp - 0x1c], 1
jmp 0x44c4bc
test edi, edi
je 0x44c65b
lea ecx, [esi - 1]
cmp ecx, 0xffffffff
je 0x44c71a
cmp byte [edx + esi - 1], 0x5c
mov ebx, eax
je 0x44c646
jmp 0x44c655
cmp byte [edx + ecx], 0x5c
jne 0x44c655
sub ecx, 1
add ebx, 1
mov byte [ebx - 1], 0x5c
cmp ecx, 0xffffffff
jne 0x44c640
lea eax, [ebx + 1]
mov byte [ebx], 0x22
add dword [ebp - 0x1c], 4
lea esi, [eax + 1]
mov byte [eax], 0x20
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax - 4]
test edx, edx
jne 0x44c550
mov eax, dword [ebp + 0x14]
mov byte [esi - 1], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x44c7c0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x28]
sub esp, 4
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [esi], 0x22
movzx ebx, byte [edx]
lea eax, [esi + 1]
mov edi, 1
test bl, bl
jne 0x44c5a6
mov ebx, eax
jmp 0x44c655
mov esi, dword [ebp - 0x20]
movzx eax, byte [esi]
test al, al
je 0x44c7a0
cmp al, 0x3b
mov ebx, esi
jne 0x44c35b
mov esi, ebx
mov eax, edi
jmp 0x44c3a6
xor edx, edx
xor esi, esi
jmp 0x44c516
mov eax, esi
jmp 0x44c65b
mov dword [ebp - 0x24], 0
jmp 0x44c2cc
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x44c2f2
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x44c2f2
mov dword [esp], str.PATH
call sub.msvcrt.dll_getenv
test eax, eax
mov esi, eax
jne 0x44c2f7
jmp 0x44c2f2
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x44c6fc
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x44c6fc