Function at 0x46d678
Capabilities:
Create process on windows
Execute command

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], edx
mov rax, qword [0x005d2ab0]
mov eax, dword [rax]
test eax, eax
jne 0x46df70
mov eax, dword [0x0072d8e8]
mov dword [0x00c6b698], eax
mov eax, dword [0x00c6b698]
test eax, eax
je 0x46d6d8
mov dword [0x00587618], 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x0072d8e8]
test eax, eax
je 0x46d6d8
jmp 0x46d6be
mov dword [0x00c6b6cc], 0
mov rax, qword [0x005d27f0]
mov eax, dword [rax]
test eax, eax
je 0x46d703
mov eax, dword [0x0058737c]
test eax, eax
je 0x46d703
mov dword [0x00c6b6cc], 1
mov rax, qword [0x00c6b6a0]
test rax, rax
jne 0x46d725
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6b6a0], rax
mov rax, qword [0x00c6b6a8]
test rax, rax
jne 0x46d747
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6b6a8], rax
mov rax, qword [0x00c6b6b0]
test rax, rax
jne 0x46d769
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6b6b0], rax
mov rax, qword [0x00c6b6b8]
test rax, rax
jne 0x46d78b
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6b6b8], rax
mov rax, qword [0x00c6b6c0]
test rax, rax
jne 0x46d7ad
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6b6c0], rax
cmp dword [rbp - 8], 0
je 0x46d7c5
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
test eax, eax
jne 0x46d7c5
mov dword [rbp - 8], 0
cmp dword [rbp - 8], 0
je 0x46dec2
mov eax, dword [0x00c6b6cc]
test eax, eax
je 0x46d833
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rcx, qword [rbp - 0x10]
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b6a0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x00c5817c], 0
jmp 0x46df40
call fcn.0046bb00
test eax, eax
setne al
test al, al
je 0x46dd69
mov rax, qword [0x00c6b6a8]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.004464b0
lea rcx, [0x0059acce]
call fcn.00445ffe
mov rdx, rax
mov rax, qword [0x00c6b6b8]
mov rcx, rax
call fcn.004464b0
mov rax, qword [0x00c6b6a8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46df33
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.0046bc13
test eax, eax
sete al
test al, al
je 0x46d987
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6b0]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6b780]
call sub.msvcrt.dll_memset
mov dword [0x00c6b780], 0x70
mov rax, qword [0x00c6b6b0]
mov rax, qword [rax]
mov qword [0x00c6b798], rax
mov qword [0x00c6b7a0], 0
mov dword [0x00c6b784], 0x440
mov dword [0x00c6b7b0], 5
lea rcx, [0x00c6b780]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46d987
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b7e8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6b7e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5817c], 0
jmp 0x46df40
mov dword [0x00c6b7f0], 0
mov dword [0x00c6b7f4], 0
mov rax, qword [0x00c6b6a8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6b7f0]
cmp edx, eax
jle 0x46da8a
mov rax, qword [0x00c6b6a8]
mov rdx, qword [rax]
mov eax, dword [0x00c6b7f0]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x46d9ef
mov eax, dword [0x00c6b7f4]
test eax, eax
jne 0x46d9e5
mov dword [0x00c6b7f4], 1
jmp 0x46d9ef
mov dword [0x00c6b7f4], 0
mov rax, qword [0x00c6b6a8]
mov rdx, qword [rax]
mov eax, dword [0x00c6b7f0]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x46da76
mov eax, dword [0x00c6b7f4]
test eax, eax
jne 0x46da76
mov rax, qword [0x00c6b6a8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6b7f0]
sub edx, eax
mov eax, edx
lea edx, [rax - 1]
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.004472bc
mov rdx, rax
mov rax, qword [0x00c6b6b8]
mov rcx, rax
call fcn.004464b0
mov edx, dword [0x00c6b7f0]
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.004471de
mov rdx, rax
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.004464b0
jmp 0x46da8b
mov eax, dword [0x00c6b7f0]
add eax, 1
mov dword [0x00c6b7f0], eax
jmp 0x46d99b
nop
mov rax, qword [0x00c6b6a8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46df36
mov rax, qword [0x00c6b6b8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46dbe9
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.0046bc13
test eax, eax
sete al
test al, al
je 0x46dbe9
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6b0]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6b8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6c0]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6b780]
call sub.msvcrt.dll_memset
mov dword [0x00c6b780], 0x70
mov rax, qword [0x00c6b6b0]
mov rax, qword [rax]
mov qword [0x00c6b798], rax
mov rax, qword [0x00c6b6c0]
mov rax, qword [rax]
mov qword [0x00c6b7a0], rax
mov dword [0x00c6b784], 0x440
mov dword [0x00c6b7b0], 5
lea rcx, [0x00c6b780]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46dbe9
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b7e8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6b7e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5817c], 0
jmp 0x46df40
mov rax, qword [0x00c6b6b8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46dc27
mov rbx, qword [0x00c6b6b8]
lea rcx, [0x005b4f36]
call fcn.00445ffe
mov rdx, rbx
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6b8]
mov rcx, rax
call fcn.004464b0
mov rdx, qword [0x00c6b6b8]
mov rax, qword [0x00c6b6a8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov rbx, qword [0x00c6b6a0]
lea rcx, str.__c
call fcn.00445ffe
mov rdx, rbx
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6b780]
call sub.msvcrt.dll_memset
mov dword [0x00c6b780], 0x70
lea rax, [0x00587820]
mov qword [0x00c6b798], rax
mov rax, qword [0x00c6b6a0]
mov rax, qword [rax]
mov qword [0x00c6b7a0], rax
mov dword [0x00c6b784], 0x440
mov dword [0x00c6b7b0], 5
lea rcx, [0x00c6b780]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46df39
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b7e8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6b7e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5817c], 0
jmp 0x46df40
lea rcx, str.command.com__c
call fcn.00445ffe
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x68
mov edx, 0
lea rcx, [0x00c6b6e0]
call sub.msvcrt.dll_memset
mov dword [0x00c6b6e0], 0x68
mov r8d, 0x18
mov edx, 0
lea rcx, [0x00c6b750]
call sub.msvcrt.dll_memset
mov rax, qword [0x00c6b6a0]
mov rax, qword [rax]
lea rdx, [0x00c6b750]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00c6b6e0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x46df3c
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b750]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6b750]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00c6b758]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5817c], 0
jmp 0x46df40
mov eax, dword [0x00c6b6cc]
test eax, eax
jne 0x46ded5
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 4
lea rcx, [0x005b52fe]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6b6a0]
mov rcx, rax
call fcn.004464b0
mov dword [0x00c5817c], 1
mov rax, qword [0x00c6b6a0]
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_system
mov dword [0x00c5817c], 0
mov eax, dword [0x00c6b6cc]
test eax, eax
jne 0x46df3f
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
jmp 0x46df3f
nop
jmp 0x46df40
nop
jmp 0x46df40
nop
jmp 0x46df40
nop
jmp 0x46df40
nop
mov eax, dword [0x00c6b698]
test eax, eax
je 0x46df71
mov eax, dword [0x00c6b698]
mov dword [0x00587618], eax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov eax, dword [0x0072d8e8]
test eax, eax
jne 0x46df71
jmp 0x46df56
nop
add rsp, 0x58
pop rbx
pop rbp
ret