Function at 0x641340
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x6c
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0
test edx, edx
je 0x641433
mov eax, dword [edx]
test eax, eax
je 0x641433
xor esi, esi
nop
add esi, 1
mov edi, dword [edx + esi*4]
lea ecx, [esi*4]
test edi, edi
jne 0x641370
lea eax, [ecx + 0x1e]
and eax, 0xfffffff0
call fcn.0069df40
xor edi, edi
sub esp, eax
lea eax, [esp + 0x37]
and eax, 0xfffffff0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], 0x6418b0
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_qsort
mov edx, dword [ebp - 0x38]
mov ecx, 1
mov dword [ebp - 0x28], ebx
mov ebx, ecx
lea esi, [esi]
mov eax, dword [edx + edi*4]
add edi, 1
mov dword [ebp - 0x38], edx
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp edi, esi
mov edx, dword [ebp - 0x38]
lea ebx, [ebx + eax + 1]
jl 0x6413e0
mov ecx, ebx
mov ebx, dword [ebp - 0x28]
xor edi, edi
mov dword [esp], ecx
call fcn.005c2e50
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov edx, dword [ebx + edi*4]
add edi, 1
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0065b130
add eax, 1
cmp edi, esi
jl 0x641414
mov ebx, dword [ebp - 0x28]
mov byte [eax], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 4], 0x2f
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x20], 0x76d2de
test eax, eax
je 0x64182a
mov ecx, dword [ebp - 0x20]
xor esi, esi
movzx eax, byte [ecx]
test al, al
je 0x6414aa
nop
xor edi, edi
cmp al, 0x3b
mov edx, ecx
jne 0x641484
jmp 0x641494
cmp al, 0x3b
je 0x64148e
add edx, 1
movzx eax, byte [edx]
test al, al
jne 0x641480
mov edi, edx
sub edi, ecx
mov ecx, edx
cmp esi, edi
cmovb esi, edi
cmp al, 0x3b
sete al
movzx eax, al
add ecx, eax
movzx eax, byte [ecx]
test al, al
jne 0x641470
mov edx, dword [ebp - 0x28]
lea eax, [esi + edx + 6]
mov dword [esp], eax
call fcn.005c2e50
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ebx
mov ebx, edx
mov esi, ebx
mov dword [ebp - 0x2c], eax
movzx eax, byte [edx]
test al, al
je 0x641822
cmp al, 0x3b
jne 0x6414e4
jmp 0x641822
cmp al, 0x3b
je 0x6414ee
add esi, 1
movzx eax, byte [esi]
test al, al
jne 0x6414e0
mov eax, dword [ebp - 0x2c]
mov edi, esi
sub edi, ebx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add edi, dword [ebp - 0x2c]
cmp esi, ebx
je 0x641512
mov byte [edi], 0x5c
add edi, 1
mov eax, dword [ebp - 0x24]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
xor eax, eax
mov edx, dword [ebp - 0x2c]
cmp byte [esi], 0x3b
sete al
mov ebx, edx
add esi, eax
movzx eax, byte [edx]
test al, al
jne 0x64154a
jmp 0x64155b
add ebx, 1
movzx eax, byte [ebx]
test al, al
je 0x64155b
cmp al, 0x2f
jne 0x641540
mov byte [ebx], 0x5c
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x64154a
mov dword [ebp - 0x20], esi
mov eax, str..com
mov esi, ebx
mov edi, 0x76d354
mov ebx, dword [ebp - 0x2c]
jmp 0x64157d
add edi, 4
mov eax, dword [edi]
test eax, eax
je 0x64180c
mov byte [esi], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x641570
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x1c], edx
call edx
mov ecx, dword [ebx]
xor eax, eax
sub esp, 4
test ecx, ecx
je 0x64166e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
movzx ebx, byte [ecx]
xor edx, edx
mov esi, 0xffffffff
test bl, bl
jne 0x64161a
jmp 0x641800
movzx ebx, byte [ecx + edx + 1]
lea edi, [edx + 1]
add esi, 1
mov dword [ebp - 0x20], edi
test bl, bl
je 0x641651
mov edx, edi
cmp bl, 0x22
jne 0x641606
cmp esi, 0xffffffff
mov ebx, esi
je 0x641641
cmp byte [ecx + esi], 0x5c
je 0x641636
jmp 0x641641
cmp byte [ecx + ebx], 0x5c
jne 0x641641
sub ebx, 1
add eax, 1
cmp ebx, 0xffffffff
jne 0x641630
add eax, 1
jmp 0x641606
sub edx, 1
add eax, 1
cmp edx, 0xffffffff
je 0x641657
cmp byte [ecx + edx], 0x5c
je 0x641646
add dword [ebp - 0x24], 4
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [edx]
lea eax, [ebx + eax + 3]
test ecx, ecx
jne 0x6415f3
mov ebx, dword [ebp - 0x28]
mov dword [esp], eax
call fcn.005c2e50
mov ecx, dword [ebx]
test ecx, ecx
mov dword [ebp - 0x30], eax
je 0x641765
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
lea esi, [esi]
mov byte [eax], 0x22
mov ecx, dword [ebx]
add eax, 1
movzx edx, byte [ecx]
test dl, dl
je 0x641746
mov edi, 0xffffffff
xor esi, esi
mov dword [ebp - 0x3c], ebx
jmp 0x6416cd
movzx edx, byte [ecx + esi]
lea esi, [edi + 2]
mov ebx, dword [ebp - 0x3c]
mov byte [eax], dl
add eax, 1
mov ecx, dword [ebx]
movzx edx, byte [ecx + edi + 2]
test dl, dl
je 0x641716
mov edi, dword [ebp - 0x20]
lea ebx, [edi + 1]
cmp dl, 0x22
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
jne 0x6416b0
cmp edi, 0xffffffff
mov edx, edi
je 0x641709
cmp byte [ecx + edi], 0x5c
jne 0x641709
mov ebx, dword [ebp - 0x3c]
jmp 0x6416f8
mov ecx, dword [ebx]
cmp byte [ecx + edx], 0x5c
jne 0x641706
sub edx, 1
mov byte [eax], 0x5c
add eax, 1
cmp edx, 0xffffffff
jne 0x6416f0
mov dword [ebp - 0x3c], ebx
mov edx, dword [ebp - 0x3c]
mov byte [eax], 0x5c
add eax, 1
mov ecx, dword [edx]
jmp 0x6416b0
cmp dword [ebp - 0x20], 0xffffffff
mov esi, dword [ebp - 0x24]
je 0x641746
mov edx, dword [ebp - 0x20]
cmp byte [ecx + edx], 0x5c
je 0x641738
jmp 0x641746
mov edx, dword [ebx]
cmp byte [edx + esi], 0x5c
jne 0x641746
sub esi, 1
mov byte [eax], 0x5c
add eax, 1
cmp esi, 0xffffffff
jne 0x641730
mov ebx, dword [ebp - 0x28]
add dword [ebp - 0x28], 4
mov edx, dword [ebp - 0x28]
mov byte [eax], 0x22
mov byte [eax + 1], 0x20
add eax, 2
mov edx, dword [edx - 4]
test edx, edx
jne 0x641690
mov byte [eax - 1], 0
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x641884
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
je 0x641884
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 4]
mov dword [esp], eax
call dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
sub esp, 4
mov dword [esp], eax
call fcn.006a4590
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.006a4590
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], 0
jmp 0x641657
mov esi, dword [ebp - 0x20]
movzx eax, byte [esi]
test al, al
je 0x641872
mov ebx, esi
test al, al
mov esi, ebx
jne 0x6414d1
mov edi, dword [ebp - 0x2c]
jmp 0x641512
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
jne 0x641463
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x641463
mov dword [esp], 0x76d2e4
call sub.msvcrt.dll_getenv
mov dword [ebp - 0x20], eax
test eax, eax
mov eax, 0x76d2de
cmovne eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x641463
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.006a4590
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.006a4590
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.006a4590
mov eax, 0xffffffff
jmp 0x6417f8