Function at 0x46725d
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x56628c]
test eax, eax
jne 0x467b67
mov eax, dword [0x676b4c]
test eax, eax
je 0x46728b
mov dword [esp], 0x106
call fcn.00442594
jmp 0x467b68
mov eax, dword [0x695e08]
mov dword [0xa25b58], eax
mov eax, dword [0xa25b58]
test eax, eax
je 0x4672c7
mov dword [0x51a570], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x695e08]
test eax, eax
setne al
test al, al
jne 0x4672a8
mov dword [0xa25b5c], 0
mov eax, dword [0x676b74]
test eax, eax
je 0x4672ed
mov eax, dword [0x51a2dc]
test eax, eax
je 0x4672ed
mov dword [0xa25b5c], 1
mov eax, dword [0xa25b60]
test eax, eax
jne 0x46730f
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00443cae
mov dword [0xa25b60], eax
mov eax, dword [0xa25b64]
test eax, eax
jne 0x467331
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00443cae
mov dword [0xa25b64], eax
mov eax, dword [0xa25b68]
test eax, eax
jne 0x467353
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00443cae
mov dword [0xa25b68], eax
mov eax, dword [0xa25b6c]
test eax, eax
jne 0x467375
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00443cae
mov dword [0xa25b6c], eax
mov eax, dword [0xa25b70]
test eax, eax
jne 0x467397
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00443cae
mov dword [0xa25b70], eax
cmp dword [ebp + 0xc], 0
je 0x4673ae
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4673ae
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x467aba
mov eax, dword [0xa25b5c]
test eax, eax
je 0x46741f
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [0xa11110], 1
mov eax, dword [0xa25b60]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa11110], 0
jmp 0x467b33
call fcn.00465551
test eax, eax
setne al
test al, al
je 0x467953
mov eax, dword [0xa25b64]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp], 0x52ef86
call fcn.00443a9a
mov edx, eax
mov eax, dword [0xa25b6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov eax, dword [0xa25b64]
mov eax, dword [eax + 4]
test eax, eax
je 0x467b26
mov eax, dword [0xa25b64]
mov dword [esp], eax
call fcn.00465664
test eax, eax
sete al
test al, al
je 0x467577
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b68]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa25b80
call sub.msvcrt.dll_memset
mov dword [0xa25b80], 0x3c
mov eax, dword [0xa25b68]
mov eax, dword [eax]
mov dword [0xa25b90], eax
mov dword [0xa25b94], 0
mov dword [0xa25b84], 0x440
mov dword [0xa25b9c], 5
mov dword [esp], 0xa25b80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x467577
mov dword [0xa11110], 1
mov eax, dword [0xa25bb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa25bb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa11110], 0
jmp 0x467b33
mov dword [0xa25bbc], 0
mov dword [0xa25bc0], 0
jmp 0x467655
mov eax, dword [0xa25b64]
mov edx, dword [eax]
mov eax, dword [0xa25bbc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x4675c4
mov eax, dword [0xa25bc0]
test eax, eax
jne 0x4675ba
mov dword [0xa25bc0], 1
jmp 0x4675c4
mov dword [0xa25bc0], 0
mov eax, dword [0xa25b64]
mov edx, dword [eax]
mov eax, dword [0xa25bbc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x467648
mov eax, dword [0xa25bc0]
test eax, eax
jne 0x467648
mov eax, dword [0xa25b64]
mov edx, dword [eax + 4]
mov eax, dword [0xa25bbc]
mov ecx, edx
sub ecx, eax
mov eax, ecx
lea edx, [eax - 1]
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00444a23
mov edx, eax
mov eax, dword [0xa25b6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov edx, dword [0xa25bbc]
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044495b
mov edx, eax
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
jmp 0x46766f
mov eax, dword [0xa25bbc]
add eax, 1
mov dword [0xa25bbc], eax
mov eax, dword [0xa25b64]
mov edx, dword [eax + 4]
mov eax, dword [0xa25bbc]
cmp edx, eax
setg al
test al, al
jne 0x467590
mov eax, dword [0xa25b64]
mov eax, dword [eax + 4]
test eax, eax
je 0x467b29
mov eax, dword [0xa25b6c]
mov eax, dword [eax + 4]
test eax, eax
je 0x4677ce
mov eax, dword [0xa25b64]
mov dword [esp], eax
call fcn.00465664
test eax, eax
sete al
test al, al
je 0x4677ce
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b68]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b70]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa25b80
call sub.msvcrt.dll_memset
mov dword [0xa25b80], 0x3c
mov eax, dword [0xa25b68]
mov eax, dword [eax]
mov dword [0xa25b90], eax
mov eax, dword [0xa25b70]
mov eax, dword [eax]
mov dword [0xa25b94], eax
mov dword [0xa25b84], 0x440
mov dword [0xa25b9c], 5
mov dword [esp], 0xa25b80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4677ce
mov dword [0xa11110], 1
mov eax, dword [0xa25bb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa25bb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa11110], 0
jmp 0x467b33
mov eax, dword [0xa25b6c]
mov eax, dword [eax + 4]
test eax, eax
je 0x46780b
mov ebx, dword [0xa25b6c]
mov dword [esp], 0x53637a
call fcn.00443a9a
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov edx, dword [0xa25b6c]
mov eax, dword [0xa25b64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov ebx, dword [0xa25b60]
mov dword [esp], str.__c
call fcn.00443a9a
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa25b80
call sub.msvcrt.dll_memset
mov dword [0xa25b80], 0x3c
mov dword [0xa25b90], 0x51a936
mov eax, dword [0xa25b60]
mov eax, dword [eax]
mov dword [0xa25b94], eax
mov dword [0xa25b84], 0x440
mov dword [0xa25b9c], 5
mov dword [esp], 0xa25b80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x467b2c
mov dword [0xa11110], 1
mov eax, dword [0xa25bb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa25bb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa11110], 0
jmp 0x467b33
mov dword [esp], str.command.com__c
call fcn.00443a9a
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 4], 1
mov dword [esp], 0x536307
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004445d9
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa25be0
call sub.msvcrt.dll_memset
mov dword [0xa25be0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa25c24
call sub.msvcrt.dll_memset
mov eax, dword [0xa25b60]
mov eax, dword [eax]
mov dword [esp + 0x24], 0xa25c24
mov dword [esp + 0x20], 0xa25be0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x467b2f
mov dword [0xa11110], 1
mov eax, dword [0xa25c24]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa25c24]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa25c28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa11110], 0
jmp 0x467b33
mov eax, dword [0xa25b5c]
test eax, eax
jne 0x467aca
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 4
mov dword [esp], 0x5366cc
call fcn.00443b2b
mov edx, eax
mov eax, dword [0xa25b60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00443e15
mov dword [0xa11110], 1
mov eax, dword [0xa25b60]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa11110], 0
mov eax, dword [0xa25b5c]
test eax, eax
jne 0x467b32
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
jmp 0x467b32
nop
jmp 0x467b33
nop
jmp 0x467b33
nop
jmp 0x467b33
nop
jmp 0x467b33
nop
mov eax, dword [0xa25b58]
test eax, eax
je 0x467b68
mov eax, dword [0xa25b58]
mov dword [0x51a570], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x695e08]
test eax, eax
sete al
test al, al
jne 0x467b46
jmp 0x467b68
nop
mov ebx, dword [ebp - 4]
leave
ret