Function at 0x46bf20
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebefd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x542094]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movss xmm2, dword [0x54db64]
mov edi, dword [ebx + 8]
movd xmm1, edx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm2
movss dword [ebp - 0x54], xmm1
jb 0x46c28a
mov eax, dword [0x551e38]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c28a
movss xmm3, dword [0x54db68]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c28a
mov eax, dword [0x551e3c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c28a
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46c28a
mov eax, dword [0x5521f8]
cmp eax, 2
je 0x46c00b
mov dword [0x551e58], esi
cmp esi, 3
jne 0x46c27d
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0
movlpd qword [ebp - 0x34], xmm0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
mov dword [ebp - 4], 0
push 0x30
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
call fcn.004bf83f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x34], eax
push 0xf
push str..UISettings.ini
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00442d40
push str..UISettings.ini
lea ecx, [ebp - 0x4c]
call fcn.0045dda0
mov dword [ebp - 4], 2
mov edi, dword fs:[0x2c]
mov eax, dword [0x5d2908]
mov dword [ebp - 0x1c], 0xa1f0a0d
mov word [ebp - 0x18], 0xd0b
mov edi, dword [edi]
mov byte [ebp - 0x4d], 0x5e
cmp eax, dword [edi + 4]
jle 0x46c0ff
push 0x5d2908
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d2908], 0xffffffff
jne 0x46c0ff
mov eax, dword [ebp - 0x1c]
mov dword [0x5d2788], eax
mov ax, word [ebp - 0x18]
mov word [0x5d278c], ax
mov al, byte [ebp - 0x4d]
push 0x4edf60
mov byte [0x5d278e], al
call fcn.004bfaea
add esp, 4
push 0x5d2908
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d278e]
test al, al
je 0x46c139
xor byte [0x5d2788], 0x5e
xor byte [0x5d2789], 0x5e
xor byte [0x5d278a], 0x5e
xor byte [0x5d278b], 0x5e
xor byte [0x5d278c], 0x5e
xor byte [0x5d278d], 0x5e
xor al, 0x5e
mov byte [0x5d278e], al
mov eax, dword [0x5d2bbc]
mov dword [ebp - 0x1c], 0xa181719
mov byte [ebp - 0x4d], 0x5e
cmp eax, dword [edi + 4]
jle 0x46c191
push 0x5d2bbc
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d2bbc], 0xffffffff
jne 0x46c191
mov eax, dword [ebp - 0x1c]
mov dword [0x5d2fdc], eax
mov al, byte [ebp - 0x4d]
push 0x4edf80
mov byte [0x5d2fe0], al
call fcn.004bfaea
add esp, 4
push 0x5d2bbc
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d2fe0]
test al, al
je 0x46c1bd
xor byte [0x5d2fdc], 0x5e
xor byte [0x5d2fdd], 0x5e
xor byte [0x5d2fde], 0x5e
xor byte [0x5d2fdf], 0x5e
xor al, 0x5e
mov byte [0x5d2fe0], al
push 1
push 0x5d2788
push 0x5d2fdc
lea ecx, [ebp - 0x4c]
call fcn.0045e850
cmp dword [0x5521f8], 2
jne 0x46c208
mov ecx, dword [0x551fac]
cmp byte [ecx + 0x60], 0
je 0x46c208
mov dword [0x551e58], 1
mov dword [0x5521f8], 1
cmp eax, 1
jne 0x46caff
call fcn.0046b370
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
push dword [eax + 4]
lea eax, [ebp - 0x34]
push eax
mov ecx, eax
call fcn.0045f7f0
push 0x30
push dword [ebp - 0x34]
call fcn.004bf874
mov ecx, dword [ebp - 0x38]
add esp, 8
cmp ecx, 0x10
jb 0x46c261
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46c257
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46cafa
push ecx
push edx
call fcn.004bf874
add esp, 8
movss xmm1, dword [ebp - 0x54]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
jmp 0x46c2a3
cmp eax, 2
je 0x46c2a3
mov dword [0x5521f8], esi
jmp 0x46c2a3
mov dword [0x551e58], 0
cmp esi, 3
jne 0x46c2a3
mov dword [0x5521f8], 0
movss xmm2, dword [0x54dba0]
comiss xmm1, xmm2
jb 0x46c38d
mov eax, dword [0x551f58]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c38d
movss xmm3, dword [0x54dba4]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c38d
mov eax, dword [0x551f5c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c38d
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46c38d
mov eax, dword [0x552230]
cmp eax, 2
je 0x46c337
mov dword [0x551e5c], esi
cmp esi, 3
jne 0x46c380
cmp eax, 2
jne 0x46c3a6
cmp dword [0x54dc08], 0x10
mov eax, 0x54dbf4
push 5
cmovae eax, dword [0x54dbf4]
push 0
push 0
push eax
push 0
push 0
mov dword [0x551e5c], 1
mov dword [0x552230], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [ebp - 0x54]
jmp 0x46c3a6
cmp eax, 2
je 0x46c3a6
mov dword [0x552230], esi
jmp 0x46c3a6
mov dword [0x551e5c], 0
cmp esi, 3
jne 0x46c3a6
mov dword [0x552230], 0
movss xmm2, dword [0x54dc18]
comiss xmm1, xmm2
jb 0x46c6a8
mov eax, dword [0x551fe8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c6a8
movss xmm3, dword [0x54dc1c]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c6a8
mov eax, dword [0x551fec]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c6a8
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46c6a8
mov eax, dword [0x552208]
cmp eax, 2
je 0x46c442
mov dword [0x551e60], esi
cmp esi, 3
jne 0x46c69b
cmp eax, 2
jne 0x46c6c1
mov eax, dword fs:[0x2c]
mov dword [0x551e60], 1
mov dword [0x552208], 1
mov dword [ebp - 0x20], 0x372a2e11
mov edi, dword [eax]
mov eax, dword [0x5d30fc]
mov dword [ebp - 0x1c], 0x3b703031
mov word [ebp - 0x18], 0x3b26
mov byte [ebp - 0x4d], 0x5e
cmp eax, dword [edi + 4]
jle 0x46c4e4
push 0x5d30fc
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d30fc], 0xffffffff
jne 0x46c4e4
mov ax, word [ebp - 0x18]
movq xmm0, qword [ebp - 0x20]
mov word [0x5d2b70], ax
mov al, byte [ebp - 0x4d]
push 0x4edf40
movq qword [0x5d2b68], xmm0
mov byte [0x5d2b72], al
call fcn.004bfaea
add esp, 4
push 0x5d30fc
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d2b72], 0
je 0x46c4fd
xor eax, eax
nop
xor byte [eax + 0x5d2b68], 0x5e
inc eax
cmp eax, 0xb
jb 0x46c4f0
push 9
push 0
push 0
push 0x5d2b68
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x46c68c
mov eax, dword [0x5d305c]
mov dword [ebp - 0x20], 0x302b3f12
mov dword [ebp - 0x1c], 0x2c3b363d
mov byte [ebp - 0x4d], 0x5e
cmp eax, dword [edi + 4]
jle 0x46c57f
push 0x5d305c
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d305c], 0xffffffff
jne 0x46c57f
movq xmm0, qword [ebp - 0x20]
mov al, byte [ebp - 0x4d]
push 0x4edf00
movq qword [0x5d2c18], xmm0
mov byte [0x5d2c20], al
call fcn.004bfaea
add esp, 4
push 0x5d305c
call fcn.004bfb2a
add esp, 4
mov al, byte [0x5d2c20]
test al, al
je 0x46c5c7
xor byte [0x5d2c18], 0x5e
xor byte [0x5d2c19], 0x5e
xor byte [0x5d2c1a], 0x5e
xor byte [0x5d2c1b], 0x5e
xor byte [0x5d2c1c], 0x5e
xor byte [0x5d2c1d], 0x5e
xor byte [0x5d2c1e], 0x5e
xor byte [0x5d2c1f], 0x5e
xor al, 0x5e
mov byte [0x5d2c20], al
mov eax, dword [0x5d2d3c]
mov dword [ebp - 0x1c], 0x3a302b31
mov word [ebp - 0x18], 0x5e70
cmp eax, dword [edi + 4]
jle 0x46c631
push 0x5d2d3c
call fcn.004bfb7b
add esp, 4
cmp dword [0x5d2d3c], 0xffffffff
jne 0x46c631
mov eax, dword [ebp - 0x1c]
movaps xmm0, xmmword [0x53ba70]
mov dword [0x5d2e28], eax
mov ax, word [ebp - 0x18]
push 0x4edf20
movups xmmword [0x5d2e18], xmm0
mov word [0x5d2e2c], ax
call fcn.004bfaea
add esp, 4
push 0x5d2d3c
call fcn.004bfb2a
add esp, 4
cmp byte [0x5d2e2d], 0
je 0x46c66d
movups xmm0, xmmword [0x5d2e18]
mov eax, 0x10
movaps xmm1, xmmword [0x53bb90]
xorps xmm1, xmm0
movups xmmword [0x5d2e18], xmm1
nop word [eax + eax]
xor byte [eax + 0x5d2e18], 0x5e
inc eax
cmp eax, 0x16
jb 0x46c660
push 0x40
push 0x5d2c18
push 0x5d2e18
push dword [0x551e18]
call dword [sym.imp.USER32.dll_MessageBoxA]
movss xmm1, dword [ebp - 0x54]
jmp 0x46c6c1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
movss xmm1, dword [ebp - 0x54]
jmp 0x46c6c1
cmp eax, 2
je 0x46c6c1
mov dword [0x552208], esi
jmp 0x46c6c1
mov dword [0x551e60], 0
cmp esi, 3
jne 0x46c6c1
mov dword [0x552208], 0
movss xmm2, dword [0x54dbe8]
comiss xmm1, xmm2
mov edi, dword [ebx + 8]
jb 0x46c76b
mov eax, dword [0x551fa0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c76b
movss xmm3, dword [0x54dbec]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c76b
mov eax, dword [0x551fa4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c76b
mov eax, dword [0x552234]
cmp eax, 2
je 0x46c745
mov dword [0x551e64], esi
cmp esi, 3
jne 0x46c75e
cmp eax, 2
jne 0x46c784
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
movss xmm1, dword [ebp - 0x54]
jmp 0x46c784
cmp eax, 2
je 0x46c784
mov dword [0x552234], esi
jmp 0x46c784
mov dword [0x551e64], 0
cmp esi, 3
jne 0x46c784
mov dword [0x552234], 0
movss xmm2, dword [0x54db70]
comiss xmm1, xmm2
jb 0x46c8c2
mov eax, dword [0x551ef8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c8c2
movss xmm3, dword [0x54db74]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c8c2
mov eax, dword [0x551efc]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c8c2
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46c8c2
mov eax, dword [0x552228]
cmp eax, 2
je 0x46c820
mov dword [0x551e68], esi
cmp esi, 3
jne 0x46c8b5
cmp eax, 2
jne 0x46c8db
mov dword [0x551e68], 1
mov dword [0x552228], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.00449670
cmp dword [0x54dc4c], 0x10
mov eax, 0x54dc38
push 5
cmovae eax, dword [0x54dc38]
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
jb 0x46c8ae
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x46c8a4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46cb04
push ecx
push edx
call fcn.004bf874
add esp, 8
movss xmm1, dword [ebp - 0x54]
jmp 0x46c8db
cmp eax, 2
je 0x46c8db
mov dword [0x552228], esi
jmp 0x46c8db
mov dword [0x551e68], 0
cmp esi, 3
jne 0x46c8db
mov dword [0x552228], 0
movss xmm2, dword [0x54dbac]
comiss xmm1, xmm2
jb 0x46c9c5
mov eax, dword [0x551f80]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46c9c5
movss xmm3, dword [0x54dbb0]
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm3
jb 0x46c9c5
mov eax, dword [0x551f84]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm2
jb 0x46c9c5
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46c9c5
mov eax, dword [0x552204]
cmp eax, 2
je 0x46c96f
mov dword [0x551e6c], esi
cmp esi, 3
jne 0x46c9b8
cmp eax, 2
jne 0x46c9de
cmp dword [0x54dbe4], 0x10
mov eax, 0x54dbd0
push 5
cmovae eax, dword [0x54dbd0]
push 0
push 0
push eax
push 0
push 0
mov dword [0x551e6c], 1
mov dword [0x552204], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [ebp - 0x54]
jmp 0x46c9de
cmp eax, 2
je 0x46c9de
mov dword [0x552204], esi
jmp 0x46c9de
mov dword [0x551e6c], 0
cmp esi, 3
jne 0x46c9de
mov dword [0x552204], 0
movss xmm2, dword [0x54dc0c]
comiss xmm1, xmm2
jb 0x46cac3
mov eax, dword [0x551eb0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46cac3
movss xmm2, dword [0x54dc10]
movd xmm1, edi
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm2
jb 0x46cac3
mov eax, dword [0x551eb4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x53bb50]
cvtpd2ps xmm0, xmm0
addss xmm0, xmm2
comiss xmm0, xmm1
jb 0x46cac3
mov eax, dword [0x551fac]
cmp byte [eax + 0x60], 0
je 0x46cac3
mov eax, dword [0x552270]
cmp eax, 2
je 0x46ca72
mov dword [0x551e70], esi
cmp esi, 3
jne 0x46cab6
cmp eax, 2
jne 0x46cadc
cmp dword [0x54dbcc], 0x10
mov eax, 0x54dbb8
push 5
cmovae eax, dword [0x54dbb8]
push 0
push 0
push eax
push 0
push 0
mov dword [0x551e70], 1
mov dword [0x552270], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x46cadc
cmp eax, 2
je 0x46cadc
mov dword [0x552270], esi
jmp 0x46cadc
mov dword [0x551e70], 0
cmp esi, 3
jne 0x46cadc
mov dword [0x552270], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bf82c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004c7a60
call fcn.00449ea0
call fcn.004c7a60
int3