Function at 0x46ccd1
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x46ccd9
call fcn.005423e0
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.004fa000
push dword [esp]
mov edx, 0x61f062
pop ecx
call fcn.004fa4a0
je 0x46cd74
lea ebp, [0x72abf8]
mov ebx, dword [ebp + 0x5a]
mov ebp, dword [0x72b430]
imul ebx, ebx, 0x54
add ebp, ebx
mov edx, dword [ebp + 0x38]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov dword [esp + 0x10], 1
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push 1
push 4
call fcn.00537b06
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
jmp 0x46d006
push dword [esp]
mov edx, 0x622f70
pop ecx
call fcn.004fa4a0
je 0x46ce9a
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, str.Original_files:
push eax
lea ebp, [0x72abf8]
mov ebx, dword [ebp + 0x5a]
mov ebp, dword [0x72b430]
imul ebx, ebx, 0x54
add ebp, ebx
push dword [ebp + 0x40]
call fcn.0053fb20
lea eax, [esp + 4]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x62e028
push eax
push dword [esp + 0xc]
call fcn.0053fb20
lea eax, [esp + 4]
push eax
call fcn.00542280
mov eax, 0x61f6f4
push eax
push dword [esp + 4]
call fcn.0053f790
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x46ce10
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x10]
dec ebx
mov eax, ebx
inc eax
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push eax
push 4
call fcn.00537b06
mov dword [esp + 0xc], 1
jmp 0x46ce3c
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0xc]
jl 0x46ce95
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x61f6f4
push eax
push dword [esp + 0x18]
push dword [esp + 0x10]
call fcn.0053f490
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebx, dword [esp + 0x10]
dec ebx
mov ebp, dword [esp + 0x20]
shl ebx, 2
pop eax
mov dword [ebp + ebx], eax
inc dword [esp + 0xc]
jno 0x46ce3c
jmp 0x46d006
push dword [esp]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x46ceb6
jl 0x46ceb2
cmp ebx, 0
ja 0x46ceb6
xor eax, eax
jmp 0x46cebb
mov eax, 1
or eax, eax
je 0x46cf18
mov dword [esp + 0x10], 1
lea edx, [esp + 0x1c]
push edx
push 0
push 0x15
push 1
push 4
call fcn.00537b06
mov edx, dword [esp]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x1c]
push eax
call fcn.00542280
mov eax, dword [esp + 0x18]
push eax
call sub.SHELL32.dll_ILCreateFromPath
push eax
mov ebp, dword [esp + 0x20]
pop eax
mov dword [ebp], eax
jmp 0x46d006
push dword [esp]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x46cf2e
cmp edi, 0xffffffff
je 0x46cf32
xor eax, eax
jmp 0x46cf37
mov eax, 1
or eax, eax
je 0x46d006
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x622674
push eax
push dword [esp + 0x10]
call fcn.00540500
call fcn.00542370
push 0
call fcn.004fa482
add dword [esp + 4], edx
call sub.USER32.dll_FindWindowW
call fcn.004fa4e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x46cfaa
push 1
push dword [esp + 0xc]
call sub.USER32.dll_ShowWindow
push dword [esp + 8]
call sub.USER32.dll_SetForegroundWindow
jmp 0x46d0a2
push edx
call fcn.00542240
pop edx
push eax
mov edx, str._open___
push edx
call fcn.00542310
mov edx, dword [esp + 4]
push edx
call fcn.00542310
mov edx, 0x6203ec
push edx
call fcn.00542310
lea eax, [esp + 8]
push eax
call fcn.00542280
push 5
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, str.explorer.exe
push eax
mov eax, 0x623e60
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
jmp 0x46d0a2
mov ebx, dword [esp + 0x10]
and ebx, ebx
jle 0x46d0a0
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x20]
call fcn.00522f23
lea eax, [esp + 0x18]
push eax
call fcn.00542280
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [esp + 0x14]
push eax
call sub.SHELL32.dll_ILCreateFromPath
mov dword [esp + 0x24], eax
push 0
mov ebp, dword [esp + 0x20]
lea eax, [ebp]
push eax
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [0x72a69c]
push dword [esp + 0x24]
call sub.SHELL32.dll_ILFree
mov dword [esp + 0xc], 0
jmp 0x46d07b
mov ebx, dword [esp + 0x10]
dec ebx
cmp ebx, dword [esp + 0xc]
jl 0x46d0a0
mov ebx, dword [esp + 0xc]
mov ebp, dword [esp + 0x1c]
shl ebx, 2
push dword [ebp + ebx]
call sub.SHELL32.dll_ILFree
inc dword [esp + 0xc]
jno 0x46d07b
xor eax, eax
push dword [esp + 4]
call fcn.00542440
push dword [esp]
call fcn.00542440
push dword [esp + 0x14]
call fcn.00542440
push dword [esp + 0x18]
call fcn.00542440
push eax
push dword [esp + 0x20]
call fcn.00537c59
pop eax
add esp, 0x28
pop edi
pop ebx
pop ebp
ret 4