Function at 0x46deb8
Capabilities:
Create process on windows
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], edx
mov rax, qword [0x005d3b90]
mov eax, dword [rax]
test eax, eax
jne 0x46e7b0
mov eax, dword [0x0072e928]
mov dword [0x00c6c6d8], eax
mov eax, dword [0x00c6c6d8]
test eax, eax
je 0x46df18
mov dword [0x00588618], 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x0072e928]
test eax, eax
je 0x46df18
jmp 0x46defe
mov dword [0x00c6c70c], 0
mov rax, qword [0x005d38d0]
mov eax, dword [rax]
test eax, eax
je 0x46df43
mov eax, dword [0x0058837c]
test eax, eax
je 0x46df43
mov dword [0x00c6c70c], 1
mov rax, qword [0x00c6c6e0]
test rax, rax
jne 0x46df65
mov edx, 0
mov ecx, 0
call fcn.00446b22
mov qword [0x00c6c6e0], rax
mov rax, qword [0x00c6c6e8]
test rax, rax
jne 0x46df87
mov edx, 0
mov ecx, 0
call fcn.00446b22
mov qword [0x00c6c6e8], rax
mov rax, qword [0x00c6c6f0]
test rax, rax
jne 0x46dfa9
mov edx, 0
mov ecx, 0
call fcn.00446b22
mov qword [0x00c6c6f0], rax
mov rax, qword [0x00c6c6f8]
test rax, rax
jne 0x46dfcb
mov edx, 0
mov ecx, 0
call fcn.00446b22
mov qword [0x00c6c6f8], rax
mov rax, qword [0x00c6c700]
test rax, rax
jne 0x46dfed
mov edx, 0
mov ecx, 0
call fcn.00446b22
mov qword [0x00c6c700], rax
cmp dword [rbp - 8], 0
je 0x46e005
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
test eax, eax
jne 0x46e005
mov dword [rbp - 8], 0
cmp dword [rbp - 8], 0
je 0x46e702
mov eax, dword [0x00c6c70c]
test eax, eax
je 0x46e073
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c6e0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x00c591bc], 0
jmp 0x46e780
call fcn.0046c340
test eax, eax
setne al
test al, al
je 0x46e5a9
mov rax, qword [0x00c6c6e8]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00446cf0
lea rcx, [0x0059bdae]
call fcn.0044683e
mov rdx, rax
mov rax, qword [0x00c6c6f8]
mov rcx, rax
call fcn.00446cf0
mov rax, qword [0x00c6c6e8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46e773
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.0046c453
test eax, eax
sete al
test al, al
je 0x46e1c7
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6f0]
mov rcx, rax
call fcn.00446cf0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c7c0]
call sub.msvcrt.dll_memset
mov dword [0x00c6c7c0], 0x70
mov rax, qword [0x00c6c6f0]
mov rax, qword [rax]
mov qword [0x00c6c7d8], rax
mov qword [0x00c6c7e0], 0
mov dword [0x00c6c7c4], 0x440
mov dword [0x00c6c7f0], 5
lea rcx, [0x00c6c7c0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46e1c7
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c828]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c828]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c591bc], 0
jmp 0x46e780
mov dword [0x00c6c830], 0
mov dword [0x00c6c834], 0
mov rax, qword [0x00c6c6e8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6c830]
cmp edx, eax
jle 0x46e2ca
mov rax, qword [0x00c6c6e8]
mov rdx, qword [rax]
mov eax, dword [0x00c6c830]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x46e22f
mov eax, dword [0x00c6c834]
test eax, eax
jne 0x46e225
mov dword [0x00c6c834], 1
jmp 0x46e22f
mov dword [0x00c6c834], 0
mov rax, qword [0x00c6c6e8]
mov rdx, qword [rax]
mov eax, dword [0x00c6c830]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x46e2b6
mov eax, dword [0x00c6c834]
test eax, eax
jne 0x46e2b6
mov rax, qword [0x00c6c6e8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6c830]
sub edx, eax
mov eax, edx
lea edx, [rax - 1]
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.00447afc
mov rdx, rax
mov rax, qword [0x00c6c6f8]
mov rcx, rax
call fcn.00446cf0
mov edx, dword [0x00c6c830]
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.00447a1e
mov rdx, rax
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.00446cf0
jmp 0x46e2cb
mov eax, dword [0x00c6c830]
add eax, 1
mov dword [0x00c6c830], eax
jmp 0x46e1db
nop
mov rax, qword [0x00c6c6e8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46e776
mov rax, qword [0x00c6c6f8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46e429
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.0046c453
test eax, eax
sete al
test al, al
je 0x46e429
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6f0]
mov rcx, rax
call fcn.00446cf0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6f8]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c700]
mov rcx, rax
call fcn.00446cf0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c7c0]
call sub.msvcrt.dll_memset
mov dword [0x00c6c7c0], 0x70
mov rax, qword [0x00c6c6f0]
mov rax, qword [rax]
mov qword [0x00c6c7d8], rax
mov rax, qword [0x00c6c700]
mov rax, qword [rax]
mov qword [0x00c6c7e0], rax
mov dword [0x00c6c7c4], 0x440
mov dword [0x00c6c7f0], 5
lea rcx, [0x00c6c7c0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46e429
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c828]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c828]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c591bc], 0
jmp 0x46e780
mov rax, qword [0x00c6c6f8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46e467
mov rbx, qword [0x00c6c6f8]
lea rcx, [0x005b6016]
call fcn.0044683e
mov rdx, rbx
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6f8]
mov rcx, rax
call fcn.00446cf0
mov rdx, qword [0x00c6c6f8]
mov rax, qword [0x00c6c6e8]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov rbx, qword [0x00c6c6e0]
lea rcx, str.__c
call fcn.0044683e
mov rdx, rbx
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c7c0]
call sub.msvcrt.dll_memset
mov dword [0x00c6c7c0], 0x70
lea rax, [0x00588820]
mov qword [0x00c6c7d8], rax
mov rax, qword [0x00c6c6e0]
mov rax, qword [rax]
mov qword [0x00c6c7e0], rax
mov dword [0x00c6c7c4], 0x440
mov dword [0x00c6c7f0], 5
lea rcx, [0x00c6c7c0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46e779
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c828]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c828]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c591bc], 0
jmp 0x46e780
lea rcx, str.command.com__c
call fcn.0044683e
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.0044764d
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov r8d, 0x68
mov edx, 0
lea rcx, [0x00c6c720]
call sub.msvcrt.dll_memset
mov dword [0x00c6c720], 0x68
mov r8d, 0x18
mov edx, 0
lea rcx, [0x00c6c790]
call sub.msvcrt.dll_memset
mov rax, qword [0x00c6c6e0]
mov rax, qword [rax]
lea rdx, [0x00c6c790]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00c6c720]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x46e77c
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c790]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c790]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00c6c798]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c591bc], 0
jmp 0x46e780
mov eax, dword [0x00c6c70c]
test eax, eax
jne 0x46e715
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 4
lea rcx, [0x005b63de]
call fcn.004468f9
mov rdx, rax
mov rax, qword [0x00c6c6e0]
mov rcx, rax
call fcn.00446cf0
mov dword [0x00c591bc], 1
mov rax, qword [0x00c6c6e0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x00c591bc], 0
mov eax, dword [0x00c6c70c]
test eax, eax
jne 0x46e77f
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
jmp 0x46e77f
nop
jmp 0x46e780
nop
jmp 0x46e780
nop
jmp 0x46e780
nop
jmp 0x46e780
nop
mov eax, dword [0x00c6c6d8]
test eax, eax
je 0x46e7b1
mov eax, dword [0x00c6c6d8]
mov dword [0x00588618], eax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x0072e928]
test eax, eax
jne 0x46e7b1
jmp 0x46e796
nop
add rsp, 0x58
pop rbx
pop rbp
ret