Function at 0x46cb60
Capabilities:
Create directory
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a3e90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.0055c225
push str._binSnapShot.exe
lea eax, [esp + 0x10]
push 0x63c670
push eax
call fcn.00401ba0
add esp, 0xc
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x46cc15
push str.TencentTTPlugins1SnapShotSnapShot.exe
lea ecx, [esp + 0x14]
push 0x63c274
push ecx
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00402330
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46cc04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044adc0
add esp, 4
test eax, eax
je 0x46cc32
mov edx, dword [esp + 0xc]
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x46cdfa
mov eax, dword [0x63c684]
push eax
mov esi, eax
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x46cc61
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46cc61
push 0x63c270
mov ecx, 0x63c684
call fcn.00402330
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x46cc7b
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str._screen1.bmp
lea ecx, [esp + 0x18]
push 0x63c684
push ecx
mov byte [esp + 0x34], 2
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.00402330
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46ccdb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push esi
call fcn.00456560
add esp, 4
cmp eax, 0xffffffff
jne 0x46cd00
push 0
push 0
push 0x5da074
call fcn.0055e834
jmp 0x46cdd9
cmp eax, 0xfffffffe
jne 0x46cd18
push 0
push 0
push 0x5edf14
call fcn.0055e834
jmp 0x46cdd9
push 0x5e9da8
lea ecx, [esp + 0x20]
call fcn.004023b0
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x34], 4
call fcn.00401ae0
add esp, 0xc
push 0x5e9da8
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x34], 5
call fcn.00401ba0
mov eax, dword [eax]
add esp, 0xc
push 5
push 0
push eax
push str.mspaint.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46cd8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46cdb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46cdd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46cdfa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ce22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret