Function at 0x46df15
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x56d28c]
test eax, eax
jne 0x46e81f
mov eax, dword [0x67db4c]
test eax, eax
je 0x46df43
mov dword [esp], 0x106
call fcn.0044924c
jmp 0x46e820
mov eax, dword [0x69cec8]
mov dword [0xa2cc18], eax
mov eax, dword [0xa2cc18]
test eax, eax
je 0x46df7f
mov dword [0x521570], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x69cec8]
test eax, eax
setne al
test al, al
jne 0x46df60
mov dword [0xa2cc1c], 0
mov eax, dword [0x67dbd8]
test eax, eax
je 0x46dfa5
mov eax, dword [0x5212dc]
test eax, eax
je 0x46dfa5
mov dword [0xa2cc1c], 1
mov eax, dword [0xa2cc20]
test eax, eax
jne 0x46dfc7
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0044a966
mov dword [0xa2cc20], eax
mov eax, dword [0xa2cc24]
test eax, eax
jne 0x46dfe9
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0044a966
mov dword [0xa2cc24], eax
mov eax, dword [0xa2cc28]
test eax, eax
jne 0x46e00b
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0044a966
mov dword [0xa2cc28], eax
mov eax, dword [0xa2cc2c]
test eax, eax
jne 0x46e02d
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0044a966
mov dword [0xa2cc2c], eax
mov eax, dword [0xa2cc30]
test eax, eax
jne 0x46e04f
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.0044a966
mov dword [0xa2cc30], eax
cmp dword [ebp + 0xc], 0
je 0x46e066
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x46e066
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x46e772
mov eax, dword [0xa2cc1c]
test eax, eax
je 0x46e0d7
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [0xa181d0], 1
mov eax, dword [0xa2cc20]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa181d0], 0
jmp 0x46e7eb
call fcn.0046c209
test eax, eax
setne al
test al, al
je 0x46e60b
mov eax, dword [0xa2cc24]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp], 0x535ca6
call fcn.0044a752
mov edx, eax
mov eax, dword [0xa2cc2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov eax, dword [0xa2cc24]
mov eax, dword [eax + 4]
test eax, eax
je 0x46e7de
mov eax, dword [0xa2cc24]
mov dword [esp], eax
call fcn.0046c31c
test eax, eax
sete al
test al, al
je 0x46e22f
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc28]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa2cc40
call sub.msvcrt.dll_memset
mov dword [0xa2cc40], 0x3c
mov eax, dword [0xa2cc28]
mov eax, dword [eax]
mov dword [0xa2cc50], eax
mov dword [0xa2cc54], 0
mov dword [0xa2cc44], 0x440
mov dword [0xa2cc5c], 5
mov dword [esp], 0xa2cc40
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x46e22f
mov dword [0xa181d0], 1
mov eax, dword [0xa2cc78]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cc78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa181d0], 0
jmp 0x46e7eb
mov dword [0xa2cc7c], 0
mov dword [0xa2cc80], 0
jmp 0x46e30d
mov eax, dword [0xa2cc24]
mov edx, dword [eax]
mov eax, dword [0xa2cc7c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x46e27c
mov eax, dword [0xa2cc80]
test eax, eax
jne 0x46e272
mov dword [0xa2cc80], 1
jmp 0x46e27c
mov dword [0xa2cc80], 0
mov eax, dword [0xa2cc24]
mov edx, dword [eax]
mov eax, dword [0xa2cc7c]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x46e300
mov eax, dword [0xa2cc80]
test eax, eax
jne 0x46e300
mov eax, dword [0xa2cc24]
mov edx, dword [eax + 4]
mov eax, dword [0xa2cc7c]
mov ecx, edx
sub ecx, eax
mov eax, ecx
lea edx, [eax - 1]
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b6db
mov edx, eax
mov eax, dword [0xa2cc2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov edx, dword [0xa2cc7c]
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b613
mov edx, eax
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
jmp 0x46e327
mov eax, dword [0xa2cc7c]
add eax, 1
mov dword [0xa2cc7c], eax
mov eax, dword [0xa2cc24]
mov edx, dword [eax + 4]
mov eax, dword [0xa2cc7c]
cmp edx, eax
setg al
test al, al
jne 0x46e248
mov eax, dword [0xa2cc24]
mov eax, dword [eax + 4]
test eax, eax
je 0x46e7e1
mov eax, dword [0xa2cc2c]
mov eax, dword [eax + 4]
test eax, eax
je 0x46e486
mov eax, dword [0xa2cc24]
mov dword [esp], eax
call fcn.0046c31c
test eax, eax
sete al
test al, al
je 0x46e486
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc28]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa2cc40
call sub.msvcrt.dll_memset
mov dword [0xa2cc40], 0x3c
mov eax, dword [0xa2cc28]
mov eax, dword [eax]
mov dword [0xa2cc50], eax
mov eax, dword [0xa2cc30]
mov eax, dword [eax]
mov dword [0xa2cc54], eax
mov dword [0xa2cc44], 0x440
mov dword [0xa2cc5c], 5
mov dword [esp], 0xa2cc40
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x46e486
mov dword [0xa181d0], 1
mov eax, dword [0xa2cc78]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cc78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa181d0], 0
jmp 0x46e7eb
mov eax, dword [0xa2cc2c]
mov eax, dword [eax + 4]
test eax, eax
je 0x46e4c3
mov ebx, dword [0xa2cc2c]
mov dword [esp], 0x53d09a
call fcn.0044a752
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov edx, dword [0xa2cc2c]
mov eax, dword [0xa2cc24]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov ebx, dword [0xa2cc20]
mov dword [esp], str.__c
call fcn.0044a752
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa2cc40
call sub.msvcrt.dll_memset
mov dword [0xa2cc40], 0x3c
mov dword [0xa2cc50], 0x521936
mov eax, dword [0xa2cc20]
mov eax, dword [eax]
mov dword [0xa2cc54], eax
mov dword [0xa2cc44], 0x440
mov dword [0xa2cc5c], 5
mov dword [esp], 0xa2cc40
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x46e7e4
mov dword [0xa181d0], 1
mov eax, dword [0xa2cc78]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cc78]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa181d0], 0
jmp 0x46e7eb
mov dword [esp], str.command.com__c
call fcn.0044a752
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 4], 1
mov dword [esp], 0x53d027
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044b291
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa2cca0
call sub.msvcrt.dll_memset
mov dword [0xa2cca0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa2cce4
call sub.msvcrt.dll_memset
mov eax, dword [0xa2cc20]
mov eax, dword [eax]
mov dword [esp + 0x24], 0xa2cce4
mov dword [esp + 0x20], 0xa2cca0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x46e7e7
mov dword [0xa181d0], 1
mov eax, dword [0xa2cce4]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cce4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa2cce8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa181d0], 0
jmp 0x46e7eb
mov eax, dword [0xa2cc1c]
test eax, eax
jne 0x46e782
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 4
mov dword [esp], 0x53d3ec
call fcn.0044a7e3
mov edx, eax
mov eax, dword [0xa2cc20]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044aacd
mov dword [0xa181d0], 1
mov eax, dword [0xa2cc20]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa181d0], 0
mov eax, dword [0xa2cc1c]
test eax, eax
jne 0x46e7ea
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
jmp 0x46e7ea
nop
jmp 0x46e7eb
nop
jmp 0x46e7eb
nop
jmp 0x46e7eb
nop
jmp 0x46e7eb
nop
mov eax, dword [0xa2cc18]
test eax, eax
je 0x46e820
mov eax, dword [0xa2cc18]
mov dword [0x521570], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x69cec8]
test eax, eax
sete al
test al, al
jne 0x46e7fe
jmp 0x46e820
nop
mov ebx, dword [ebp - 4]
leave
ret