Function at 0x7d221d34
Capabilities:
Create process on windows
Query environment variable

Disassembly:
jmp 0x7d2322a0
sub esp, 0xe4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push edi
mov edi, dword [esp + 0xf4]
push 0
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x7d2322d1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xe4
ret 4
push ebp
lea eax, [esi*2 + 0x10]
push eax
call fcn.7d221505
mov ebp, eax
push esi
push ebp
push edi
mov dword [esp + 0x24], ebp
call ebx
xor eax, eax
push 0x4000
mov word [ebp + esi*2], ax
call fcn.7d221505
mov ebp, eax
mov eax, dword [esp + 0x18]
push 0x25
push eax
mov dword [esp + 0x1c], ebp
mov ebx, eax
mov edi, ebp
call sub.ntdll.dll_wcschr
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
je 0x7d232417
lea ecx, [esi + 2]
push 0x25
push ecx
call sub.ntdll.dll_wcschr
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x7d232413
cmp esi, ebx
je 0x7d232358
mov ecx, esi
sub ecx, ebx
sar ecx, 1
lea esi, [ecx + ecx]
push esi
push ebx
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
add edi, esi
mov esi, dword [esp + 0x10]
lea ebx, [ebp + 2]
sub ebp, esi
sar ebp, 1
inc ebp
lea eax, [ebp*2]
mov dword [esp + 0x10], eax
cmp ebp, 0x40
ja 0x7d2323e8
push eax
lea eax, [esp + 0x74]
push esi
push eax
call sub.ntdll.dll_memcpy
xor eax, eax
add esp, 0xc
mov word [esp + ebp*2 + 0x70], ax
mov ecx, edi
sub ecx, dword [esp + 0x14]
mov eax, 0x2000
sar ecx, 1
sub eax, ecx
add eax, eax
push eax
push edi
push 0x80000000
lea eax, [esp + 0x7c]
push eax
push 0
call sym.SbieDll.dll_SbieApi_QueryConf
test eax, eax
js 0x7d2323e4
push 8
push str.Device_
push edi
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7d2323c8
push edi
call sym.SbieDll.dll_SbieDll_TranslateNtToDosPath
mov eax, edi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7d2323d0
sub eax, edx
sar eax, 1
lea ebp, [eax + eax]
jmp 0x7d2323f8
mov eax, dword [esp + 0x10]
push eax
push esi
push edi
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ebp, 0x8000
push 0x25
push ebx
call sub.ntdll.dll_wcschr
mov esi, eax
add esp, 8
add edi, ebp
mov dword [esp + 0x10], esi
test esi, esi
jne 0x7d232322
mov ebp, dword [esp + 0x14]
sub edi, ebx
nop dword [eax]
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [edi + ebx - 2], ax
test ax, ax
jne 0x7d232420
push dword [esp + 0x18]
call fcn.7d221537
xor eax, eax
mov dword [esp + 0x2c], 0x44
mov word [esp + 0x6e], ax
xorps xmm0, xmm0
mov word [esp + 0x5c], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
movlpd qword [esp + 0x34], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
movlpd qword [esp + 0x86], xmm0
movlpd qword [esp + 0x8e], xmm0
mov dword [esp + 0x80], 0x81
movups xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ebp
mov edi, eax
call fcn.7d221537
pop ebp
test edi, edi
je 0x7d2324df
push 0x2710
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x18]
call esi
test edi, edi
pop edi
pop esi
setne al
pop ebx
add esp, 0xe4
ret 4