Function at 0x46ee07
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], edx
mov eax, dword [rbp - 8]
and eax, 2
test eax, eax
jne 0x46ee35
mov ecx, 5
call fcn.0044487a
jmp 0x46f48b
mov rax, qword [0x00c6bac8]
test rax, rax
jne 0x46ee57
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6bac8], rax
mov rax, qword [0x00c6bad0]
test rax, rax
jne 0x46ee79
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6bad0], rax
mov rax, qword [0x00c6bad8]
test rax, rax
jne 0x46ee9b
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6bad8], rax
mov rax, qword [0x00c6bae0]
test rax, rax
jne 0x46eebd
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6bae0], rax
mov rax, qword [0x00c6bab8]
test rax, rax
jne 0x46eedf
mov edx, 0
mov ecx, 0
call fcn.004462e2
mov qword [0x00c6bab8], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 8]
test eax, eax
jne 0x46eef9
mov ecx, 5
call fcn.0044487a
jmp 0x46f48b
call fcn.0046bb00
test eax, eax
setne al
test al, al
je 0x46f358
mov rax, qword [0x00c6bac8]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.004464b0
lea rcx, [0x0059acce]
call fcn.00445ffe
mov rdx, rax
mov rax, qword [0x00c6bad0]
mov rcx, rax
call fcn.004464b0
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.0046bc13
test eax, eax
sete al
test al, al
je 0x46effb
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bad8]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6bba0]
call sub.msvcrt.dll_memset
mov dword [0x00c6bba0], 0x70
mov rax, qword [0x00c6bad8]
mov rax, qword [rax]
mov qword [0x00c6bbb8], rax
mov qword [0x00c6bbc0], 0
mov dword [0x00c6bba4], 0x400
mov dword [0x00c6bbd0], 0
lea rcx, [0x00c6bba0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jne 0x46f481
mov dword [0x00c6bc10], 0
mov dword [0x00c6bc14], 0
mov rax, qword [0x00c6bac8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6bc10]
cmp edx, eax
jle 0x46f0fe
mov rax, qword [0x00c6bac8]
mov rdx, qword [rax]
mov eax, dword [0x00c6bc10]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x22
jne 0x46f063
mov eax, dword [0x00c6bc14]
test eax, eax
jne 0x46f059
mov dword [0x00c6bc14], 1
jmp 0x46f063
mov dword [0x00c6bc14], 0
mov rax, qword [0x00c6bac8]
mov rdx, qword [rax]
mov eax, dword [0x00c6bc10]
cdqe
add rax, rdx
movzx eax, byte [rax]
cmp al, 0x20
jne 0x46f0ea
mov eax, dword [0x00c6bc14]
test eax, eax
jne 0x46f0ea
mov rax, qword [0x00c6bac8]
mov edx, dword [rax + 8]
mov eax, dword [0x00c6bc10]
sub edx, eax
mov eax, edx
lea edx, [rax - 1]
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.004472bc
mov rdx, rax
mov rax, qword [0x00c6bad0]
mov rcx, rax
call fcn.004464b0
mov edx, dword [0x00c6bc10]
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.004471de
mov rdx, rax
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.004464b0
jmp 0x46f0ff
mov eax, dword [0x00c6bc10]
add eax, 1
mov dword [0x00c6bc10], eax
jmp 0x46f00f
nop
mov rax, qword [0x00c6bac8]
mov eax, dword [rax + 8]
test eax, eax
je 0x46f484
mov rax, qword [0x00c6bad0]
mov eax, dword [rax + 8]
test eax, eax
je 0x46f21d
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.0046bc13
test eax, eax
sete al
test al, al
je 0x46f21d
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bad8]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6bad0]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bae0]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6bba0]
call sub.msvcrt.dll_memset
mov dword [0x00c6bba0], 0x70
mov rax, qword [0x00c6bad8]
mov rax, qword [rax]
mov qword [0x00c6bbb8], rax
mov rax, qword [0x00c6bae0]
mov rax, qword [rax]
mov qword [0x00c6bbc0], rax
mov dword [0x00c6bba4], 0x400
mov dword [0x00c6bbd0], 0
lea rcx, [0x00c6bba0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jne 0x46f487
mov rax, qword [0x00c6bad0]
mov eax, dword [rax + 8]
test eax, eax
je 0x46f25b
mov rbx, qword [0x00c6bad0]
lea rcx, [0x005b4f36]
call fcn.00445ffe
mov rdx, rbx
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bad0]
mov rcx, rax
call fcn.004464b0
mov rdx, qword [0x00c6bad0]
mov rax, qword [0x00c6bac8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.004464b0
mov rbx, qword [0x00c6bab8]
lea rcx, str.__c
call fcn.00445ffe
mov rdx, rbx
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x70
mov edx, 0
lea rcx, [0x00c6bba0]
call sub.msvcrt.dll_memset
mov dword [0x00c6bba0], 0x70
lea rax, [0x00587850]
mov qword [0x00c6bbb8], rax
mov rax, qword [0x00c6bab8]
mov rax, qword [rax]
mov qword [0x00c6bbc0], rax
mov dword [0x00c6bba4], 0x400
mov dword [0x00c6bbd0], 0
lea rcx, [0x00c6bba0]
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
setne al
test al, al
jmp 0x46f48b
lea rcx, str.command.com__c
call fcn.00445ffe
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.004464b0
mov edx, 1
lea rcx, [0x005b4c3c]
call fcn.004460b9
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.00446e0d
mov rdx, rax
mov rax, qword [0x00c6bab8]
mov rcx, rax
call fcn.004464b0
mov r8d, 0x68
mov edx, 0
lea rcx, [0x00c6bb00]
call sub.msvcrt.dll_memset
mov dword [0x00c6bb00], 0x68
mov r8d, 0x18
mov edx, 0
lea rcx, [0x00c6bb70]
call sub.msvcrt.dll_memset
mov rax, qword [0x00c6bab8]
mov rax, qword [rax]
lea rdx, [0x00c6bb70]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00c6bb00]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x46f48a
mov rax, qword [0x00c6bb70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00c6bb78]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x46f48b
nop
jmp 0x46f48b
nop
jmp 0x46f48b
nop
jmp 0x46f48b
nop
add rsp, 0x58
pop rbx
pop rbp
ret