Function at 0x46f1a0
Capabilities:
Copy file
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494c9a
mov eax, dword fs:[0]
push eax
sub esp, 0x6ac
mov eax, dword [0x4ad1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x66c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004760a0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push esi
push eax
call fcn.004760a0
add esp, 0xc
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f21f
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 1
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f24f
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x668], eax
mov byte [ebp - 4], 2
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f27f
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x670], eax
push 0x4a85e0
lea eax, [ebp - 0x664]
mov byte [ebp - 4], 3
push 0x4a80e8
push eax
call fcn.00405910
add esp, 0xc
lea eax, [ebp - 0x668]
push str.hpcbwcmd.exe
push 0x4a80e8
push eax
call fcn.00405910
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0x4a39e4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, dword [ebp - 0x668]
test eax, eax
je 0x46f438
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x420]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x21a], ax
test ax, ax
jne 0x46f2f0
push str.PCBackupWizardSetup.zip
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [ebp - 0x644], 7
mov dword [ebp - 0x648], 0
mov word [ebp - 0x658], ax
cmp word [ebp - 0x218], ax
jne 0x46f344
xor ecx, ecx
jmp 0x46f35f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46f350
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x658]
call fcn.00403bd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x640]
push 6
xor eax, eax
mov dword [ebp - 0x62c], 7
push 0x4a865c
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00403bd0
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 5
push eax
lea edx, [ebp - 0x640]
call fcn.00406e50
add esp, 4
test eax, eax
mov eax, dword [ebp - 0x62c]
setg byte [ebp - 0x65d]
cmp eax, 8
jb 0x46f3e5
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00404ac0
xor eax, eax
mov byte [ebp - 4], 3
mov word [ebp - 0x640], ax
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], 0
cmp eax, 8
jb 0x46f424
inc eax
lea ecx, [ebp - 0x658]
push eax
push dword [ebp - 0x658]
call fcn.00404ac0
cmp byte [ebp - 0x65d], 0
je 0x46f438
mov edi, dword [ebp - 0x664]
jmp 0x46f768
push 0
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x674], esp
mov dword [ebp - 0x65c], esi
mov edi, dword [ebp - 0x664]
lea ecx, [edi - 0x10]
call fcn.004049a0
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 7
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x65c], esp
push eax
call fcn.004028e0
push ecx
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 8
mov ecx, esp
push eax
call fcn.004028e0
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 3
call fcn.0046e910
test eax, eax
je 0x46f762
push 0
push 0
push ecx
mov esi, esp
mov dword [ebp - 0x678], esp
lea ecx, [ebx - 0x10]
mov dword [ebp - 0x674], esi
call fcn.004049a0
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x674], esp
push eax
call fcn.004028e0
push ecx
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xb
mov ecx, esp
push eax
call fcn.004028e0
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 3
call fcn.0046e910
test eax, eax
je 0x46f762
lea ecx, [ebp - 0x218]
call fcn.004059b0
cmp dword [edi - 4], 1
jle 0x46f529
push dword [edi - 0xc]
lea ecx, [ebp - 0x664]
call fcn.00403a80
mov edi, dword [ebp - 0x664]
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x670]
push str._s_s
push eax
call fcn.00405910
add esp, 0x10
lea eax, [ebp - 0x670]
lea ecx, [ebp - 0x664]
push eax
call fcn.00403b60
push ecx
mov esi, esp
mov dword [ebp - 0x678], esi
mov edi, dword [ebp - 0x664]
lea ecx, [edi - 0x10]
call fcn.004049a0
add eax, 0x10
mov dword [esi], eax
call fcn.00406660
add esp, 4
lea eax, [ebp - 0x6b4]
push 0x3c
push 0
push eax
call fcn.004760a0
add esp, 0xc
mov dword [ebp - 0x6b4], 0x3c
lea eax, [ebp - 0x6b4]
mov dword [ebp - 0x6a8], str.open
mov dword [ebp - 0x6b0], 0x40
mov dword [ebp - 0x6a4], edi
push eax
mov dword [ebp - 0x698], 5
mov dword [ebp - 0x6a0], 0x4a8678
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x46f762
push 0xffffffffffffffff
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x46f5f7
mov ecx, edi
call fcn.004059b0
cmp dword [ebx - 4], 1
jle 0x46f611
push dword [ebx - 0xc]
lea ecx, [ebp - 0x668]
call fcn.00403a80
mov ebx, dword [ebp - 0x668]
push ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x670]
push str._s_s
push eax
call fcn.00405910
add esp, 0x10
lea eax, [ebp - 0x670]
lea ecx, [ebp - 0x668]
push eax
call fcn.00403b60
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f65b
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov dword [ebp - 0x674], eax
add eax, 0x10
mov dword [ebp - 0x678], eax
mov byte [ebp - 4], 0xe
call fcn.00402550
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f691
push 0x80004005
call fcn.00402240
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x65c], eax
push 0x208
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 0xf
push 0
push eax
call fcn.004760a0
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push str.hpcbwcmd.exe
push str.PCBackupWizard
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x65c]
push 0x4a3930
push eax
call fcn.00405910
mov esi, dword [ebp - 0x65c]
add esp, 0x14
mov ebx, dword [ebp - 0x668]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, ebx
call fcn.004059b0
lea edx, [esi - 0x10]
mov dword [ebp - 0x65c], 1
or esi, 0xffffffff
mov byte [ebp - 4], 0xe
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46f73c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x674]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46f75a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x66c]
jmp 0x46f772
mov esi, dword [ebp - 0x66c]
mov dword [ebp - 0x65c], 0
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x670]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46f794
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [ebx - 0x10]
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46f7b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x46f7cb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0x10
test esi, esi
je 0x46f7ee
cmp dword [esi], 2
mov ecx, esi
sete al
test al, al
je 0x46f7e9
call fcn.0046e850
jmp 0x46f7ee
call fcn.0046df40
mov eax, dword [ebp - 0x65c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047137e
mov esp, ebp
pop ebp
ret