Function at 0x46cc86
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x46cc8e
call fcn.005423e0
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.004fa000
push dword [esp]
mov edx, 0x61f062
pop ecx
call fcn.004fa4a0
je 0x46cd29
lea ebp, [0x72abe8]
mov ebx, dword [ebp + 0x5a]
mov ebp, dword [0x72b420]
imul ebx, ebx, 0x54
add ebp, ebx
mov edx, dword [ebp + 0x38]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov dword [esp + 0x10], 1
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push 1
push 4
call fcn.00537b06
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
jmp 0x46cfbb
push dword [esp]
mov edx, 0x622f3a
pop ecx
call fcn.004fa4a0
je 0x46ce4f
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, str.Original_files:
push eax
lea ebp, [0x72abe8]
mov ebx, dword [ebp + 0x5a]
mov ebp, dword [0x72b420]
imul ebx, ebx, 0x54
add ebp, ebx
push dword [ebp + 0x40]
call fcn.0053fb20
lea eax, [esp + 4]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, str.Original_file:
push eax
push dword [esp + 0xc]
call fcn.0053fb20
lea eax, [esp + 4]
push eax
call fcn.00542280
mov eax, 0x61f6be
push eax
push dword [esp + 4]
call fcn.0053f790
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x46cdc5
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x10]
dec ebx
mov eax, ebx
inc eax
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push eax
push 4
call fcn.00537b06
mov dword [esp + 0xc], 1
jmp 0x46cdf1
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
jl 0x46ce4a
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x61f6be
push eax
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.0053f490
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebx, dword [esp + 0x10]
dec ebx
mov ebp, dword [esp + 0x20]
shl ebx, 2
pop eax
mov dword [ebp + ebx], eax
inc dword [esp + 0xc]
jno 0x46cdf1
jmp 0x46cfbb
push dword [esp]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x46ce6b
jl 0x46ce67
cmp ebx, 0
ja 0x46ce6b
xor eax, eax
jmp 0x46ce70
mov eax, 1
or eax, eax
je 0x46cecd
mov dword [esp + 0x10], 1
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push 1
push 4
call fcn.00537b06
mov edx, dword [esp]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
jmp 0x46cfbb
push dword [esp]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x46cee3
cmp edi, 0xffffffff
je 0x46cee7
xor eax, eax
jmp 0x46ceec
mov eax, 1
or eax, eax
je 0x46cfbb
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x62263e
push eax
push dword [esp + 0x10]
call fcn.00540500
call fcn.00542370
push 0
call fcn.004fa482
add dword [esp + 4], edx
call sub.USER32.dll_FindWindowW
call fcn.004fa4e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x46cf5f
push 1
push dword [esp + 0xc]
call sub.USER32.dll_ShowWindow
push dword [esp + 8]
call sub.USER32.dll_SetForegroundWindow
jmp 0x46d057
push edx
call fcn.00542240
pop edx
push eax
mov edx, str._open___
push edx
call fcn.00542310
mov edx, dword [esp + 4]
push edx
call fcn.00542310
mov edx, 0x6203b6
push edx
call fcn.00542310
lea eax, [esp + 8]
push eax
call fcn.00542280
push 5
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, str.explorer.exe
push eax
mov eax, str.open
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
jmp 0x46d057
mov ebx, dword [esp + 0x10]
and ebx, ebx
jle 0x46d055
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x20]
call fcn.00522f23
lea eax, [esp + 0x18]
push eax
call fcn.00542280
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [esp + 0x14]
push eax
call sub.SHELL32.dll_ILCreateFromPath
mov dword [esp + 0x24], eax
push 0
mov ebp, dword [esp + 0x20]
lea eax, [ebp]
push eax
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [0x72a68c]
push dword [esp + 0x24]
call sub.SHELL32.dll_ILFree
mov dword [esp + 0xc], 0
jmp 0x46d030
mov ebx, dword [esp + 0x10]
dec ebx
cmp ebx, dword [esp + 0xc]
jl 0x46d055
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x1c]
shl ebx, 2
push dword [ebp + ebx]
call sub.SHELL32.dll_ILFree
inc dword [esp + 0xc]
jno 0x46d030
xor eax, eax
push dword [esp + 4]
call fcn.00542440
push dword [esp]
call fcn.00542440
push dword [esp + 0x14]
call fcn.00542440
push dword [esp + 0x18]
call fcn.00542440
push eax
push dword [esp + 0x20]
call fcn.00537c59
pop eax
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4