Function at 0x100046d0
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, 0x1000
push esi
push edi
mov eax, 0x1000a210
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100046f0
movsx eax, word [ebx]
test eax, eax
je 0x10004740
cmp eax, 0x1000
ja 0x1000471a
push eax
push ebx
push 0x1000a210
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x10004740
push 0x1000
push 0
push 0x1000a210
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
movzx eax, word [ebx + 4]
mov edx, 0xd1d
cmp ax, dx
jne 0x10004776
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49a477
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49a477], 0xff00cd00
jmp 0x100047b4
mov ecx, 0xd1e
cmp ax, cx
jne 0x100047c9
mov word [ebx + 4], dx
mov edi, dword [0x1000a278]
test edi, edi
je 0x10004909
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49a477
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49a477], edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push 0x49a477
call esi
jmp 0x10004909
mov ecx, 0xaf1
cmp ax, cx
jne 0x10004834
mov esi, dword [ebx + 0xa4]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49099b], esi
mov eax, dword [0x684bb0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10009024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call edi
jmp 0x10004909
mov ecx, 0x666
cmp ax, cx
jne 0x10004879
movups xmm0, xmmword [ebx + 0xc]
movups xmmword [0x10009c40], xmm0
movups xmm0, xmmword [ebx + 0x1c]
movups xmmword [0x10009c50], xmm0
movups xmm0, xmmword [ebx + 0x2c]
movups xmmword [0x10009c60], xmm0
movq xmm0, qword [ebx + 0x3c]
movq qword [0x10009c70], xmm0
mov eax, dword [ebx + 0x44]
mov dword [0x10009c78], eax
jmp 0x10004909
mov ecx, 0xafa
cmp ax, cx
jne 0x100048ba
cwde
push eax
push str.PACKET_SUCESSO_Type:__d
call fcn.100046a0
movzx eax, word [ebx + 4]
add esp, 8
cmp ax, 1
jne 0x100048a4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp ax, 2
jne 0x10004909
push str.shutdown__s__t_2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
jmp 0x10004909
mov ecx, 0x10a
cmp ax, cx
jne 0x10004909
xor eax, eax
push 0x100068d4
mov word [0x1000978c], ax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str.UI_acc.bin
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x10004909
push eax
push 2
push 1
push 0x1000978c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004b43
mov esp, ebp
pop ebp
ret 8