Function at 0x4026d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor esi, esi
test r9, r9
mov r14, rcx
mov r12d, edx
mov rdi, r8
mov r15, r9
je 0x4027c9
mov rsi, qword [r9]
test rsi, rsi
je 0x4027c9
mov eax, 1
mov rsi, rax
add rax, 1
cmp qword [r15 + rax*8 - 8], 0
jne 0x40270d
lea r8, [rsi*8]
lea rax, [r8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.00405d00
lea r13d, [rsi - 1]
sub rsp, rax
mov rdx, r15
lea rbx, [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov r8d, 8
mov rcx, rbx
lea r9, [0x00402650]
call sub.msvcrt.dll_qsort
lea rax, [r13*8]
mov r13d, 1
mov qword [rbp - 8], rax
lea rsi, [r15 + rax + 8]
nop word [rax + rax]
mov rcx, qword [r15]
add r15, 8
call sub.msvcrt.dll_strlen
cmp r15, rsi
lea r13d, [r13 + rax + 1]
jne 0x402780
movsxd rcx, r13d
call fcn.00403760
mov rsi, rax
mov rax, qword [rbp - 8]
mov rcx, rsi
lea r13, [rax + rbx + 8]
nop dword [rax]
mov rdx, qword [rbx]
add rbx, 8
call fcn.00403860
cmp r13, rbx
lea rcx, [rax + 1]
jne 0x4027b0
mov byte [rax + 1], 0
mov rcx, r14
call sub.msvcrt.dll_strlen
mov edx, 0x2f
mov rcx, r14
mov rbx, rax
call sub.msvcrt.dll_strchr
test rax, rax
je 0x402d01
lea r12, [0x0040d294]
xor r8d, r8d
lea rcx, [r8 + rbx + 6]
call fcn.00403760
mov qword [rbp + 0x60], rdi
mov rdi, r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 8], rsi
mov rbx, rax
movzx eax, byte [r12]
mov rsi, rdi
lea r15, str..com
cmp al, 0x3b
je 0x402cbf
test al, al
je 0x402cbf
nop word [rax + rax]
movzx eax, byte [rsi + 1]
add rsi, 1
cmp al, 0x3b
je 0x402848
test al, al
jne 0x402838
mov r12, rsi
mov rcx, rbx
mov rdx, rdi
sub r12, rdi
mov r8, r12
call sub.msvcrt.dll_memcpy
lea r8, [rbx + r12]
cmp rsi, rdi
mov rcx, r8
je 0x402870
add rcx, 1
mov byte [r8], 0x5c
mov rdx, r14
mov r12, rbx
call sub.msvcrt.dll_strcpy
xor eax, eax
cmp byte [rsi], 0x3b
sete al
add rsi, rax
movzx eax, byte [rbx]
test al, al
je 0x4028a7
nop dword [rax]
cmp al, 0x2f
jne 0x402899
mov byte [r12], 0x5c
movzx eax, byte [r12 + 1]
add r12, 1
test al, al
jne 0x402890
lea rdi, str..com
mov rdx, r15
jmp 0x4028c9
mov rdx, qword [rdi + 8]
add rdi, 8
test rdx, rdx
je 0x402ca6
mov rcx, rbx
mov byte [r12], 0
call sub.msvcrt.dll_strcat
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
cmp rax, 0xffffffffffffffff
je 0x4028b8
mov rdi, qword [rbp + 0x60]
mov rcx, rax
mov rsi, qword [rbp - 8]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
call r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x402da7
lea rax, [rdi + 8]
xor r8d, r8d
mov qword [rbp - 0x10], rsi
mov rdx, rbx
movabs r13, 0x500000200
mov r14d, 2
nop dword [rax + rax]
movzx r10d, byte [rcx]
lea r11, [rcx - 1]
xor esi, esi
mov r9d, 0xffffffff
test r10b, r10b
je 0x402c56
mov qword [rbp - 8], rax
jmp 0x402981
movzx r10d, byte [r11 + 2]
lea rax, [r11 + 1]
test r10b, r10b
je 0x4029f8
mov r11, rax
mov r15d, r9d
add r9d, 1
cmp r10b, 0x22
ja 0x402970
bt r13, r10
jae 0x402970
cmp r10b, 0x22
mov esi, 1
jne 0x402970
cmp r15d, 0xffffffff
je 0x402ce0
lea rax, [r8 + 1]
mov ebx, r15d
mov r10, r11
add rbx, rax
jmp 0x4029d1
sub r10, 1
cmp rbx, rax
je 0x402c10
add rax, 1
cmp byte [r10], 0x5c
mov rsi, r8
mov r8, rax
je 0x4029c0
lea r8, [rsi + 1]
mov esi, 1
movzx r10d, byte [r11 + 2]
lea rax, [r11 + 1]
test r10b, r10b
jne 0x40297e
nop dword [rax]
mov r10, r14
mov rax, qword [rbp - 8]
sub r10, rcx
add r10, r11
test esi, esi
jne 0x402c28
add r8, r10
mov ecx, 1
add rax, 8
add r8, rcx
mov rcx, qword [rax - 8]
test rcx, rcx
jne 0x402950
mov rsi, qword [rbp - 0x10]
mov rbx, rdx
mov rcx, r8
call fcn.00403760
mov r11, qword [rdi]
mov rdx, rax
test r11, r11
je 0x402daf
lea r13, [rdi + 8]
mov r9, rax
movabs rdi, 0x500000200
nop dword [rax + rax]
movzx r8d, byte [r11]
mov ecx, 1
test r8b, r8b
mov eax, r8d
jne 0x402a8a
jmp 0x402a94
add rcx, 1
movzx eax, byte [r11 + rcx - 1]
test al, al
je 0x402c60
cmp al, 0x22
ja 0x402a78
bt rdi, rax
jae 0x402a78
mov byte [r9], 0x22
movzx r8d, byte [r11]
lea rax, [r9 + 1]
test r8b, r8b
je 0x402d97
mov r14d, 1
lea rcx, [r11 - 1]
mov r10d, 0xffffffff
jmp 0x402ada
movzx r8d, byte [rcx + 1]
lea rax, [r15 + 1]
add rcx, 1
mov byte [r15], r8b
movzx r8d, byte [rcx + 1]
test r8b, r8b
je 0x402b30
mov r9d, r10d
add r10d, 1
cmp r8b, 0x22
mov r15, rax
jne 0x402ac0
cmp r9d, 0xffffffff
je 0x402cf1
lea r15, [rax + r9 + 1]
mov r8, rcx
jmp 0x402b11
sub r8, 1
cmp r15, rax
mov byte [rax - 1], 0x5c
je 0x402bf8
cmp byte [r8], 0x5c
mov r9, rax
lea rax, [rax + 1]
je 0x402b00
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x402ac0
test r14d, r14d
jne 0x402c70
mov r11, qword [r13]
lea r9, [rax + 1]
add r13, 8
mov byte [rax], 0x20
test r11, r11
jne 0x402a60
mov rax, qword [rbp + 0x80]
mov byte [r9 - 1], 0
xor r8d, r8d
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rax
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], eax
mov qword [rbp - 8], rdx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbp - 8]
test eax, eax
je 0x402dd9
mov rax, qword [rbp + 0x80]
mov rcx, qword [rax + 8]
call r12
mov rax, qword [rbp + 0x80]
mov rdx, qword [rbp - 8]
mov rdi, qword [rax]
mov rcx, rsi
mov qword [rbp - 8], rdx
call sub.msvcrt.dll_free
mov rcx, qword [rbp - 8]
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov rax, rdi
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r9, r15
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x402ac0
mov rsi, rbx
lea r8, [rsi + 1]
mov esi, 1
jmp 0x4029e6
movsxd r9, r9d
add r9, rcx
lea ecx, [r15 + 2]
add rcx, r8
jmp 0x402c4d
add r8, 1
sub r9, 1
cmp r8, rcx
je 0x402c53
cmp byte [r9], 0x5c
je 0x402c40
add r8, r10
mov ecx, 3
jmp 0x402a15
mov rax, r9
xor r14d, r14d
jmp 0x402aaf
movsxd rcx, r10d
mov r10d, r10d
lea r9, [rax + r10 + 1]
add rcx, r11
jmp 0x402c8d
sub rcx, 1
cmp r9, rax
mov byte [rax - 1], 0x5c
je 0x402cd0
cmp byte [rcx], 0x5c
mov r8, rax
lea rax, [rax + 1]
je 0x402c80
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x402b39
movzx eax, byte [rsi]
test al, al
je 0x402db7
mov rdi, rsi
cmp al, 0x3b
mov rsi, rdi
jne 0x40282a
mov rcx, rbx
jmp 0x402870
mov r8, r9
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x402b39
mov rsi, r8
lea r8, [rsi + 1]
mov esi, 1
jmp 0x4029e6
mov r9, rax
lea r15, [r9 + 1]
mov byte [r9], 0x5c
jmp 0x402ac0
mov edx, 0x5c
mov rcx, r14
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x4027ea
and r12d, 1
je 0x4027ea
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
test rax, rax
mov r12, rax
je 0x4027ea
movzx edx, byte [rax]
test dl, dl
je 0x4027f1
mov rcx, rax
xor r8d, r8d
cmp dl, 0x3b
mov rax, rcx
je 0x402d91
nop word [rax + rax]
movzx edx, byte [rax + 1]
add rax, 1
cmp dl, 0x3b
je 0x402d69
test dl, dl
jne 0x402d58
mov r9, rax
sub r9, rcx
mov rcx, rax
cmp r8, r9
cmovb r8, r9
cmp dl, 0x3b
je 0x402d91
movzx edx, byte [rcx]
test dl, dl
je 0x4027f4
cmp dl, 0x3b
mov rax, rcx
jne 0x402d58
lea rcx, [rax + 1]
jmp 0x402d7e
mov r8, rax
lea rax, [r8 + 1]
mov byte [r8], 0x22
jmp 0x402b39
xor r8d, r8d
jmp 0x402a30
mov r9, rax
jmp 0x402b51
mov rcx, rbx
mov qword [rbp - 0x10], rdx
mov rsi, qword [rbp - 8]
xor ebx, ebx
call sub.msvcrt.dll_free
mov rdi, 0xffffffffffffffff
mov rdx, qword [rbp - 0x10]
jmp 0x402bc3
mov rdi, 0xffffffffffffffff
jmp 0x402bc3