Function at 0x47b690
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4e684d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
mov esi, dword [esp + 0x134]
push edi
mov ebp, ecx
lea eax, [esp + 0x10]
push 0xb
push eax
mov ecx, esi
call fcn.004bd709
mov ecx, dword [eax]
push 0x51c184
push ecx
mov dword [esp + 0x138], 0
call fcn.004ad810
add esp, 8
test eax, eax
je 0x47b715
lea edx, [esp + 0x18]
push 9
push edx
mov ecx, esi
call fcn.004bd709
mov eax, dword [eax]
push str.vbscript:
push eax
call fcn.004ad810
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.004c5787
test bl, bl
je 0x47b717
mov bl, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
test bl, bl
je 0x47b74d
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004c54fc
mov ecx, ebp
call fcn.0047ed70
mov eax, 1
jmp 0x47bc17
mov eax, dword [ebp + 0x278]
test eax, eax
je 0x47b799
mov eax, dword [ebp + 0x27c]
test eax, eax
je 0x47b799
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004c54fc
mov ecx, ebp
call fcn.00473c80
test eax, eax
je 0x47b799
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push esi
call fcn.004c54fc
mov ecx, ebp
call fcn.00473960
mov eax, 1
jmp 0x47bc17
mov eax, dword [ebp + 0x270]
test eax, eax
je 0x47b885
lea ecx, [esp + 0x18]
push 6
push ecx
mov ecx, esi
call fcn.004bd709
mov eax, dword [eax]
mov dword [esp + 0x130], 1
mov edi, str.ftp:__
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x47b7ef
test cl, cl
je 0x47b7eb
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x47b7ef
add eax, 2
add edi, 2
test cl, cl
jne 0x47b7c7
xor eax, eax
jmp 0x47b7f4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47b84c
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, esi
call fcn.004bd709
mov eax, dword [eax]
mov edi, str.ftp.
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x47b835
test cl, cl
je 0x47b831
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x47b835
add eax, 2
add edi, 2
test cl, cl
jne 0x47b80d
xor eax, eax
jmp 0x47b83a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.004c5787
test bl, bl
je 0x47b84e
mov bl, 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
test bl, bl
je 0x47b885
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004c54fc
call fcn.00419560
add esp, 4
mov eax, 1
jmp 0x47bc17
mov eax, dword [esi]
cmp byte [eax], 0x25
jne 0x47b8a9
lea ecx, [esp + 0x24]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.004c5910
push esi
call fcn.00416ac0
mov eax, dword [ebp + 0x220]
add esp, 4
test eax, eax
je 0x47ba5f
push 0x5c
mov ecx, esi
call fcn.004bd781
push 0x2e
mov ecx, esi
mov edi, eax
call fcn.004bd781
cmp eax, edi
jle 0x47b97b
push 0x2f
mov ecx, esi
call fcn.004bd781
push 0x2e
mov ecx, esi
mov edi, eax
call fcn.004bd781
cmp eax, edi
jle 0x47b97b
push 1
push 0x2e
lea ecx, [esp + 0x20]
call fcn.004bd113
lea eax, [esp + 0x10]
push 1
push eax
mov ecx, esi
mov dword [esp + 0x138], 2
call fcn.004bd68d
mov edi, dword [esp + 0x18]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x47b94c
test cl, cl
je 0x47b948
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x47b94c
add eax, 2
add edi, 2
test cl, cl
jne 0x47b924
xor eax, eax
jmp 0x47b951
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.004c5787
lea ecx, [esp + 0x18]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
test bl, bl
je 0x47ba5f
lea eax, [esp + 0x18]
push 5
push eax
mov ecx, esi
call fcn.004bd709
mov eax, dword [eax]
mov dword [esp + 0x130], 3
mov edi, 0x51d7e4
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x47b9c3
test cl, cl
je 0x47b9bf
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x47b9c3
add eax, 2
add edi, 2
test cl, cl
jne 0x47b99b
xor eax, eax
jmp 0x47b9c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47ba45
mov eax, dword [esi]
cmp byte [eax], 0x5c
sete al
test al, al
jne 0x47ba45
lea ecx, [esp + 0x10]
push 6
push ecx
mov ecx, esi
call fcn.004bd709
mov eax, dword [eax]
mov edi, str.shell:
mov dl, byte [eax]
mov bl, byte [edi]
mov cl, dl
cmp dl, bl
jne 0x47ba15
test cl, cl
je 0x47ba11
mov dl, byte [eax + 1]
mov bl, byte [edi + 1]
mov cl, dl
cmp dl, bl
jne 0x47ba15
add eax, 2
add edi, 2
test cl, cl
jne 0x47b9ed
xor eax, eax
jmp 0x47ba1a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
sete bl
call fcn.004c5787
test bl, bl
jne 0x47ba45
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push esi
call fcn.004c54fc
call fcn.0041bfa0
add esp, 4
test eax, eax
je 0x47ba47
mov bl, 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
test bl, bl
jne 0x47ba8f
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, esi
call fcn.004bd68d
mov ecx, dword [eax]
push str..lnk
push ecx
call fcn.004ad810
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
call fcn.004c5787
test bl, bl
je 0x47bac1
mov eax, dword [0x51e084]
test eax, eax
mov eax, str.explore
jne 0x47baa2
mov eax, str.open
mov edx, dword [esi]
push 5
push 0
push 0x5269d8
push edx
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, 1
jmp 0x47bc17
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x47bc15
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.004c54fc
call fcn.0041bfa0
add esp, 4
test eax, eax
je 0x47bc15
push esi
lea ecx, [esp + 0x18]
call fcn.004c54fc
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 4
call fcn.004c5cbb
push 0x521968
lea ecx, [esp + 0x18]
call fcn.004bd7a3
test eax, eax
jle 0x47bc01
lea edi, [eax + 4]
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x1c]
call fcn.004bd709
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 5
call fcn.004c58c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 4
call fcn.004c5787
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.004c54fc
call fcn.004156a0
add esp, 4
test eax, eax
je 0x47bc01
lea eax, [esp + 0x1c]
push edi
push eax
mov ecx, esi
call fcn.004bd709
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], 6
call fcn.004c58c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x130], 4
call fcn.004c5787
mov ecx, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx - 8]
mov edi, dword [edx - 8]
sub eax, edi
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004bd68d
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push 5
push 0
push ecx
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x20]
call fcn.004c5787
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
mov eax, 1
jmp 0x47bc17
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], 0xffffffff
call fcn.004c5787
xor eax, eax
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x124
ret 8