Function at 0x496e19
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x59728c]
test eax, eax
jne 0x497723
mov eax, dword [0x6a7b4c]
test eax, eax
je 0x496e47
mov dword [esp], 0x106
call fcn.00472150
jmp 0x497724
mov eax, dword [0x6c7948]
mov dword [0xa57698], eax
mov eax, dword [0xa57698]
test eax, eax
je 0x496e83
mov dword [0x54a570], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6c7948]
test eax, eax
setne al
test al, al
jne 0x496e64
mov dword [0xa5769c], 0
mov eax, dword [0x6a7c78]
test eax, eax
je 0x496ea9
mov eax, dword [0x54a2dc]
test eax, eax
je 0x496ea9
mov dword [0xa5769c], 1
mov eax, dword [0xa576a0]
test eax, eax
jne 0x496ecb
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047386a
mov dword [0xa576a0], eax
mov eax, dword [0xa576a4]
test eax, eax
jne 0x496eed
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047386a
mov dword [0xa576a4], eax
mov eax, dword [0xa576a8]
test eax, eax
jne 0x496f0f
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047386a
mov dword [0xa576a8], eax
mov eax, dword [0xa576ac]
test eax, eax
jne 0x496f31
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047386a
mov dword [0xa576ac], eax
mov eax, dword [0xa576b0]
test eax, eax
jne 0x496f53
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0047386a
mov dword [0xa576b0], eax
cmp dword [ebp + 0xc], 0
je 0x496f6a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x496f6a
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x497676
mov eax, dword [0xa5769c]
test eax, eax
je 0x496fdb
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [0xa42c50], 1
mov eax, dword [0xa576a0]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa42c50], 0
jmp 0x4976ef
call fcn.0049510d
test eax, eax
setne al
test al, al
je 0x49750f
mov eax, dword [0xa576a4]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp], 0x55f506
call fcn.00473656
mov edx, eax
mov eax, dword [0xa576ac]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov eax, dword [0xa576a4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4976e2
mov eax, dword [0xa576a4]
mov dword [esp], eax
call fcn.00495220
test eax, eax
sete al
test al, al
je 0x497133
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa576c0
call sub.msvcrt.dll_memset
mov dword [0xa576c0], 0x3c
mov eax, dword [0xa576a8]
mov eax, dword [eax]
mov dword [0xa576d0], eax
mov dword [0xa576d4], 0
mov dword [0xa576c4], 0x440
mov dword [0xa576dc], 5
mov dword [esp], 0xa576c0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x497133
mov dword [0xa42c50], 1
mov eax, dword [0xa576f8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa576f8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa42c50], 0
jmp 0x4976ef
mov dword [0xa576fc], 0
mov dword [0xa57700], 0
jmp 0x497211
mov eax, dword [0xa576a4]
mov edx, dword [eax]
mov eax, dword [0xa576fc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x497180
mov eax, dword [0xa57700]
test eax, eax
jne 0x497176
mov dword [0xa57700], 1
jmp 0x497180
mov dword [0xa57700], 0
mov eax, dword [0xa576a4]
mov edx, dword [eax]
mov eax, dword [0xa576fc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x497204
mov eax, dword [0xa57700]
test eax, eax
jne 0x497204
mov eax, dword [0xa576a4]
mov edx, dword [eax + 4]
mov eax, dword [0xa576fc]
mov ecx, edx
sub ecx, eax
mov eax, ecx
lea edx, [eax - 1]
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004745df
mov edx, eax
mov eax, dword [0xa576ac]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov edx, dword [0xa576fc]
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474517
mov edx, eax
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
jmp 0x49722b
mov eax, dword [0xa576fc]
add eax, 1
mov dword [0xa576fc], eax
mov eax, dword [0xa576a4]
mov edx, dword [eax + 4]
mov eax, dword [0xa576fc]
cmp edx, eax
setg al
test al, al
jne 0x49714c
mov eax, dword [0xa576a4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4976e5
mov eax, dword [0xa576ac]
mov eax, dword [eax + 4]
test eax, eax
je 0x49738a
mov eax, dword [0xa576a4]
mov dword [esp], eax
call fcn.00495220
test eax, eax
sete al
test al, al
je 0x49738a
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576ac]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa576c0
call sub.msvcrt.dll_memset
mov dword [0xa576c0], 0x3c
mov eax, dword [0xa576a8]
mov eax, dword [eax]
mov dword [0xa576d0], eax
mov eax, dword [0xa576b0]
mov eax, dword [eax]
mov dword [0xa576d4], eax
mov dword [0xa576c4], 0x440
mov dword [0xa576dc], 5
mov dword [esp], 0xa576c0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x49738a
mov dword [0xa42c50], 1
mov eax, dword [0xa576f8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa576f8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa42c50], 0
jmp 0x4976ef
mov eax, dword [0xa576ac]
mov eax, dword [eax + 4]
test eax, eax
je 0x4973c7
mov ebx, dword [0xa576ac]
mov dword [esp], 0x5668fa
call fcn.00473656
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576ac]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov edx, dword [0xa576ac]
mov eax, dword [0xa576a4]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov ebx, dword [0xa576a0]
mov dword [esp], str.__c
call fcn.00473656
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa576c0
call sub.msvcrt.dll_memset
mov dword [0xa576c0], 0x3c
mov dword [0xa576d0], 0x54a936
mov eax, dword [0xa576a0]
mov eax, dword [eax]
mov dword [0xa576d4], eax
mov dword [0xa576c4], 0x440
mov dword [0xa576dc], 5
mov dword [esp], 0xa576c0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4976e8
mov dword [0xa42c50], 1
mov eax, dword [0xa576f8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa576f8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa42c50], 0
jmp 0x4976ef
mov dword [esp], str.command.com__c
call fcn.00473656
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 4], 1
mov dword [esp], 0x566887
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00474195
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa57720
call sub.msvcrt.dll_memset
mov dword [0xa57720], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa57764
call sub.msvcrt.dll_memset
mov eax, dword [0xa576a0]
mov eax, dword [eax]
mov dword [esp + 0x24], 0xa57764
mov dword [esp + 0x20], 0xa57720
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x4976eb
mov dword [0xa42c50], 1
mov eax, dword [0xa57764]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa57764]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa57768]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa42c50], 0
jmp 0x4976ef
mov eax, dword [0xa5769c]
test eax, eax
jne 0x497686
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 4
mov dword [esp], 0x566c4c
call fcn.004736e7
mov edx, eax
mov eax, dword [0xa576a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004739d1
mov dword [0xa42c50], 1
mov eax, dword [0xa576a0]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa42c50], 0
mov eax, dword [0xa5769c]
test eax, eax
jne 0x4976ee
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
jmp 0x4976ee
nop
jmp 0x4976ef
nop
jmp 0x4976ef
nop
jmp 0x4976ef
nop
jmp 0x4976ef
nop
mov eax, dword [0xa57698]
test eax, eax
je 0x497724
mov eax, dword [0xa57698]
mov dword [0x54a570], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6c7948]
test eax, eax
sete al
test al, al
jne 0x497702
jmp 0x497724
nop
mov ebx, dword [ebp - 4]
leave
ret