Function at 0x46e868
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], edx
mov rax, qword [0x005d3b90]
mov eax, dword [rax]
test eax, eax
jne 0x46f004
mov eax, dword [rbp - 8]
and eax, 1
test eax, eax
je 0x46e8ae
mov eax, dword [rbp - 8]
and eax, 2
mov edx, eax
mov rcx, qword [rbp - 0x10]
call fcn.0046f6f7
jmp 0x46f00e
mov eax, dword [rbp - 8]
and eax, 2
test eax, eax
jne 0x46e8c7
mov ecx, 5
call fcn.0044516a
jmp 0x46f00e
mov rax, qword [0x00c6c818]
test rax, rax
jne 0x46e8e9
mov edx, 0
mov ecx, 0
call fcn.00446bd2
mov qword [0x00c6c818], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
test eax, eax
jne 0x46e903
mov ecx, 5
call fcn.0044516a
jmp 0x46f00e
mov rax, qword [0x00c6c828]
test rax, rax
jne 0x46e925
mov edx, 0
mov ecx, 0
call fcn.00446bd2
mov qword [0x00c6c828], rax
mov rax, qword [0x00c6c830]
test rax, rax
jne 0x46e947
mov edx, 0
mov ecx, 0
call fcn.00446bd2
mov qword [0x00c6c830], rax
mov rax, qword [0x00c6c838]
test rax, rax
jne 0x46e969
mov edx, 0
mov ecx, 0
call fcn.00446bd2
mov qword [0x00c6c838], rax
mov rax, qword [0x00c6c840]
test rax, rax
jne 0x46e98b
mov edx, 0
mov ecx, 0
call fcn.00446bd2
mov qword [0x00c6c840], rax
call fcn.0046c3f0
test eax, eax
setne al
test al, al
je 0x46eeaf
mov rax, qword [0x00c6c828]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00446da0
lea rcx, [0x0059bdae]
call fcn.004468ee
mov rdx, rax
mov rax, qword [0x00c6c830]
mov rcx, rax
call fcn.00446da0
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.0046c503
test eax, eax
sete al
test al, al
je 0x46eacd
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004469a9
mov rdx, rax
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c838]
mov rcx, rax
call fcn.00446da0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c900]
call sub.msvcrt.dll_memset
mov dword [0x00c6c900], 0x70
mov rax, qword [0x00c6c838]
mov rax, qword [rax]
mov qword [0x00c6c918], rax
mov qword [0x00c6c920], 0
mov dword [0x00c6c904], 0x440
mov dword [0x00c6c930], 0
lea rcx, [0x00c6c900]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46eacd
mov dword [0x00c5919c], 1
mov rax, qword [0x00c6c968]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c968]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5919c], 0
jmp 0x46f00e
mov dword [0x00c6c970], 0
mov dword [0x00c6c974], 0
mov rax, qword [0x00c6c828]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6c970]
cmp edx, eax
jle 0x46ebd0
mov rax, qword [0x00c6c828]
mov rdx, qword [rax]
mov eax, dword [0x00c6c970]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x46eb35
mov eax, dword [0x00c6c974]
test eax, eax
jne 0x46eb2b
mov dword [0x00c6c974], 1
jmp 0x46eb35
mov dword [0x00c6c974], 0
mov rax, qword [0x00c6c828]
mov rdx, qword [rax]
mov eax, dword [0x00c6c970]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x46ebbc
mov eax, dword [0x00c6c974]
test eax, eax
jne 0x46ebbc
mov rax, qword [0x00c6c828]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6c970]
sub edx, eax
mov eax, edx
lea edx, [rax - 1]
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.00447bac
mov rdx, rax
mov rax, qword [0x00c6c830]
mov rcx, rax
call fcn.00446da0
mov edx, dword [0x00c6c970]
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.00447ace
mov rdx, rax
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.00446da0
jmp 0x46ebd1
mov eax, dword [0x00c6c970]
add eax, 1
mov dword [0x00c6c970], eax
jmp 0x46eae1
nop
mov rax, qword [0x00c6c828]
mov eax, dword [rax + 8]
test eax, eax
je 0x46f007
mov rax, qword [0x00c6c830]
mov eax, dword [rax + 8]
test eax, eax
je 0x46ed2f
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.0046c503
test eax, eax
sete al
test al, al
je 0x46ed2f
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004469a9
mov rdx, rax
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c838]
mov rcx, rax
call fcn.00446da0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004469a9
mov rdx, rax
mov rax, qword [0x00c6c830]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c840]
mov rcx, rax
call fcn.00446da0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c900]
call sub.msvcrt.dll_memset
mov dword [0x00c6c900], 0x70
mov rax, qword [0x00c6c838]
mov rax, qword [rax]
mov qword [0x00c6c918], rax
mov rax, qword [0x00c6c840]
mov rax, qword [rax]
mov qword [0x00c6c920], rax
mov dword [0x00c6c904], 0x440
mov dword [0x00c6c930], 0
lea rcx, [0x00c6c900]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46ed2f
mov dword [0x00c5919c], 1
mov rax, qword [0x00c6c968]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c968]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5919c], 0
jmp 0x46f00e
mov rax, qword [0x00c6c830]
mov eax, dword [rax + 8]
test eax, eax
je 0x46ed6d
mov rbx, qword [0x00c6c830]
lea rcx, [0x005b6016]
call fcn.004468ee
mov rdx, rbx
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c830]
mov rcx, rax
call fcn.00446da0
mov rdx, qword [0x00c6c830]
mov rax, qword [0x00c6c828]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.00446da0
mov rbx, qword [0x00c6c818]
lea rcx, str.__c
call fcn.004468ee
mov rdx, rbx
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.00446da0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004469a9
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.00446da0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6c900]
call sub.msvcrt.dll_memset
mov dword [0x00c6c900], 0x70
lea rax, [0x00588830]
mov qword [0x00c6c918], rax
mov rax, qword [0x00c6c818]
mov rax, qword [rax]
mov qword [0x00c6c920], rax
mov dword [0x00c6c904], 0x440
mov dword [0x00c6c930], 0
lea rcx, [0x00c6c900]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
je 0x46f00a
mov dword [0x00c5919c], 1
mov rax, qword [0x00c6c968]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c968]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5919c], 0
jmp 0x46f00e
lea rcx, str.command.com__c
call fcn.004468ee
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.00446da0
mov edx, 1
lea rcx, [0x005b5d1c]
call fcn.004469a9
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.004476fd
mov rdx, rax
mov rax, qword [0x00c6c818]
mov rcx, rax
call fcn.00446da0
mov r8d, 0x68
mov edx, 0
lea rcx, [0x00c6c860]
call sub.msvcrt.dll_memset
mov dword [0x00c6c860], 0x68
mov r8d, 0x18
mov edx, 0
lea rcx, [0x00c6c8d0]
call sub.msvcrt.dll_memset
mov rax, qword [0x00c6c818]
mov rax, qword [rax]
lea rdx, [0x00c6c8d0]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00c6c860]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x46f00d
mov dword [0x00c5919c], 1
mov rax, qword [0x00c6c8d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6c8d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00c6c8d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x00c5919c], 0
jmp 0x46f00e
nop
jmp 0x46f00e
nop
jmp 0x46f00e
nop
jmp 0x46f00e
nop
add rsp, 0x58
pop rbx
pop rbp
ret