Function at 0x46997a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad1ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x137c
call sub.ntdll.dll__chkstk
push edi
mov dword [ebp - 0x1388], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1370], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x136c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov cl, byte [0x562610]
mov byte [ebp - 0x1020], cl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x101f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str._tracert
mov ecx, dword [ebp + 0xc]
call fcn.00409440
lea edx, [ebp - 0x1124]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea eax, [ebp - 0x132c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cmd.exe__c_tracert.exe
lea ecx, [ebp - 0x132c]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea ecx, [ebp + 8]
call fcn.0047e220
push eax
lea edx, [ebp - 0x132c]
push edx
call sub.ntdll.dll_strcat
add esp, 8
push 0x524840
lea eax, [ebp - 0x132c]
push eax
call sub.ntdll.dll_strcat
add esp, 8
push str.360xxtracert.txt
lea ecx, [ebp - 0x1124]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea ecx, [ebp + 8]
call fcn.0047e220
push eax
lea edx, [ebp - 0x1124]
push edx
call sub.ntdll.dll_strcat
add esp, 8
lea eax, [ebp - 0x1124]
push eax
lea ecx, [ebp - 0x132c]
push ecx
call sub.ntdll.dll_strcat
add esp, 8
lea edx, [ebp - 0x1124]
push edx
call dword [0x54b4b8]
lea eax, [ebp - 0x1370]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 0x1370], 0x44
mov word [ebp - 0x1340], 0
mov ecx, dword [ebp - 0x1344]
or ecx, 1
mov dword [ebp - 0x1344], ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x1370]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x132c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x1378], eax
cmp dword [ebp - 0x1378], 0
jne 0x469b44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x137c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004095f0
mov eax, dword [ebp - 0x137c]
jmp 0x469c47
push 0xffffffffffffffff
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x1124]
push ecx
call dword [0x54b4dc]
mov dword [ebp - 0x1374], eax
cmp dword [ebp - 0x1374], 0xffffffff
jne 0x469bac
mov dword [ebp - 0x1380], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004095f0
mov eax, dword [ebp - 0x1380]
jmp 0x469c47
push 0
lea edx, [ebp - 0x10]
push edx
push 0x1000
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x1374]
push ecx
call dword [0x54b4c4]
test eax, eax
je 0x469c01
lea edx, [ebp - 0x1020]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00409470
cmp dword [ebp - 0x10], 0x1000
jae 0x469be9
jmp 0x469c01
push 0x1000
push 0
lea eax, [ebp - 0x1020]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
jmp 0x469bac
mov ecx, dword [ebp - 0x1374]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x1124]
push edx
call dword [0x54b4b8]
push 0x524858
mov ecx, dword [ebp + 0xc]
call fcn.00409470
mov dword [ebp - 0x1384], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004095f0
mov eax, dword [ebp - 0x1384]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 8