Function at 0x46e0b0
Capabilities:
Accept command line arguments
Get hostname

Disassembly:
sub esp, 0x32c
lea eax, [esp + 4]
push eax
call fcn.0046e600
add esp, 4
test eax, eax
jne 0x46e47b
push str.ASLMFNET
mov byte [0x4b5a84], 2
mov byte [0x4b5a85], 1
call fcn.00441140
add esp, 4
test eax, eax
je 0x46e0fb
mov eax, 1
mov dword [0x4b62d8], eax
mov byte [0x4b5a86], al
jmp 0x46e107
xor eax, eax
mov dword [0x4b62d8], eax
mov byte [0x4b5a86], al
test eax, eax
mov byte [0x4b5a87], 0
je 0x46e13d
push 0x4b5a88
call fcn.0046e7a0
add esp, 4
test eax, eax
je 0x46e158
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, 0x41
add esp, 0x32c
ret
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x10]
push 0x4b5a88
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp]
mov dword [0x4b5a90], eax
push ecx
push 0x4b5a98
mov dword [0x4b5a94], 0
mov dword [esp + 8], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x46e194
mov edx, dword [esp]
inc edx
mov dword [esp + 0xc], edx
jmp 0x46e1a3
mov byte [0x4b5a98], 0
mov dword [esp + 0xc], 1
lea eax, [esp + 0x124]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46e1d0
mov cx, word [0x4a372c]
mov eax, 1
mov word [esp + 0x124], cx
dec eax
mov dword [esp], eax
js 0x46e1e8
cmp byte [esp + eax + 0x124], 0x5c
je 0x46e1e4
dec eax
jns 0x46e1d7
mov dword [esp], eax
push ebx
push esi
lea eax, [esp + eax + 0x12d]
push edi
mov edi, str.RUN.EXE
mov esi, eax
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
mov edi, str.RUNM.EXE
mov esi, eax
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
mov edi, str.RUNMW.EXE
mov esi, eax
mov ecx, 0xa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
mov edi, str.RUNS.EXE
mov esi, eax
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
mov edi, str.RUNSW.EXE
mov esi, eax
mov ecx, 0xa
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
mov edi, str.RUNW.EXE
mov esi, eax
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x46e26c
lea edx, [esp + 0x234]
mov edi, eax
jmp 0x46e3c1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov bl, 0x20
mov eax, ecx
mov esi, edi
mov edi, edx
xor edx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x2c], 0x22
jne 0x46e2a7
mov edx, 1
mov bl, 0x22
mov al, byte [esp + edx + 0x2c]
test al, al
je 0x46e2bc
cmp al, bl
je 0x46e2bc
mov al, byte [esp + edx + 0x2d]
inc edx
test al, al
jne 0x46e2af
mov al, byte [esp + edx + 0x2c]
push ebp
mov ebp, dword [esp + 0x10]
test al, al
jne 0x46e2fa
lea edi, [esp + ebp + 0x135]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x238]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x18], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp bl, 0x22
jne 0x46e300
inc edx
mov al, byte [esp + edx + 0x30]
test al, al
je 0x46e315
cmp al, 0x20
jne 0x46e315
mov al, byte [esp + edx + 0x31]
inc edx
test al, al
jne 0x46e308
mov bl, byte [esp + edx + 0x30]
test bl, bl
jne 0x46e34e
lea edi, [esp + ebp + 0x135]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x238]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x18], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp bl, 0x22
mov cl, 0x20
jne 0x46e358
inc edx
mov cl, bl
mov al, byte [esp + edx + 0x30]
mov ebx, edx
test al, al
je 0x46e373
cmp al, cl
je 0x46e36f
mov al, byte [esp + edx + 0x31]
inc edx
test al, al
jne 0x46e362
cmp edx, ebx
jg 0x46e39e
lea edi, [esp + ebp + 0x135]
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x238]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, ebx
mov byte [esp + edx + 0x30], 0
mov eax, edx
pop ebp
jl 0x46e3b6
cmp byte [esp + eax + 0x2c], 0x5c
je 0x46e3b6
dec eax
cmp eax, ebx
jge 0x46e3aa
lea edi, [esp + eax + 0x2d]
lea edx, [esp + 0x234]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea ebx, [edx + 0x4b5a98]
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x234]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x234]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 1]
mov ecx, dword [esp + 0x10]
mov byte [eax + 0x4b5a98], 0
add eax, 0x19
push eax
push 0x4b5a80
push ecx
mov dword [0x4b5a80], eax
call dword [sym.imp.MSVCRT.dll__write]
mov ecx, dword [0x4b5a80]
add esp, 0xc
cmp eax, ecx
pop edi
pop esi
pop ebx
je 0x46e46b
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, 0x41
add esp, 0x32c
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
xor eax, eax
add esp, 0x32c
ret