Function at 0x46f500
Capabilities:
Create process on windows
Hide graphical window
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0da0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x50d4cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor esi, esi
movzx eax, ax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, 0x906
cmp word [ebp + 8], ax
jne 0x46f5d0
mov eax, dword [edi + 0x708]
cmp dword [eax + 0x24], 1
je 0x46f5d0
mov ecx, dword [edi + 0x608]
push esi
push esi
mov ecx, dword [ecx + 0x170]
call fcn.0045d020
mov eax, dword [edi + 0x7f8]
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x608]
push esi
mov eax, dword [ecx]
call dword [eax + 0xb4]
push ecx
mov ecx, dword [edi + 0x604]
push 2
mov byte [edi + 0x815], 1
call fcn.00426dd0
cmp byte [edi + 0x80e], 0
mov ecx, dword [edi + 0x600]
je 0x46f5bf
push dword [edi + 0x810]
call fcn.0044e370
jmp 0x46fa24
lea eax, [edi + 0x634]
push eax
call fcn.0044de80
jmp 0x46fa24
lea ebx, [edi + 0x720]
push 0x4df3d0
push dword [ebx]
call fcn.0048ccf3
add esp, 8
test eax, eax
sete al
test al, al
je 0x46f6db
xor esi, esi
mov ecx, edi
cmp word [ebp - 0x18], 1
cmove esi, dword [ebp - 0x20]
push esi
push ebx
call fcn.004253a0
mov dword [ebp - 0x18], eax
mov eax, 0x902
cmp word [ebp + 8], ax
push esi
sete cl
movzx ecx, cl
push ecx
push ebx
mov ecx, edi
call fcn.00425490
mov esi, eax
cmp esi, 0xa0000001
jne 0x46f64f
lea ecx, [edi + 0x490]
call fcn.00415450
push 0x30
push 0x4e1480
push 0x4e71d4
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x46fa24
cmp esi, 0xa0000010
jne 0x46f67a
lea ecx, [edi + 0x490]
call fcn.00415450
push 0x30
push 0x4e1480
push 0x4e71b8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x46fa24
cmp esi, 1
jne 0x46f8c3
cmp dword [ebp - 0x18], 0
mov ecx, ebx
jne 0x46f69a
push 0x4df3d0
call fcn.00406650
jmp 0x46fa24
mov edx, 0x4df3d0
call fcn.00406d80
test al, al
jne 0x46fa24
push 0x4df3d0
mov ecx, ebx
call fcn.00406650
lea ecx, [edi + 0x490]
call fcn.00415450
push 0x30
push 0x4e1480
push 0x4e7220
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x46fa24
mov ax, word [ebp + 8]
mov ecx, 0x902
cmp ax, cx
jne 0x46f92c
mov edx, dword [edi + 0x708]
push ecx
push 1
mov dword [ebp - 0x1c], esi
mov edx, dword [edx + 0x20]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00476ed0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x46f717
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406580
mov byte [ebp - 4], 2
cmp dword [ebp - 0x30], 0x10
jb 0x46f735
push dword [ebp - 0x44]
call fcn.0048b08b
add esp, 4
push 0x4df3d0
push dword [ebp - 0x1c]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x44], 0
call fcn.0048ccf3
add esp, 8
test eax, eax
setne al
test al, al
je 0x46f894
push dword [ebx]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x46f894
lea ecx, [edi + 0x638]
call fcn.00424ad0
mov edx, dword [edi + 0x708]
mov dword [ebp - 0x18], eax
mov ecx, dword [edx + 0x20]
cmp ecx, 3
je 0x46f8da
cmp ecx, 4
je 0x46f8da
cmp dword [edx + 0x24], 1
je 0x46f8da
cmp eax, 1
jle 0x46f8da
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00407b40
lea esi, [eax + 0x10]
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 3
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
lea ecx, [ebp - 0x20]
call fcn.00406580
mov byte [ebp - 4], 4
cmp dword [esi - 4], 1
jle 0x46f7f9
push dword [esi - 0xc]
lea ecx, [ebp - 0x24]
call fcn.004075f0
mov esi, dword [ebp - 0x24]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.00406e30
cmp dword [ebp - 0x18], 0
jle 0x46f87e
lea ecx, [esi - 0x10]
xor esi, esi
mov dword [ebp - 0x2c], ecx
xor ebx, ebx
lea ebx, [ebx]
call fcn.00407b40
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
push dword [ebp - 0x20]
inc ebx
push ebx
push str.__d__s
push eax
call fcn.004315f0
mov eax, dword [edi + 0x728]
add esp, 0x10
add eax, esi
cmp dword [eax + 0x14], 0x10
jb 0x46f855
mov eax, dword [eax]
push 1
push dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00406630
mov ecx, dword [ebp - 0x2c]
add esi, 0x18
cmp ebx, dword [ebp - 0x18]
jl 0x46f820
lea ebx, [edi + 0x720]
lea ecx, [ebp - 0x20]
xor esi, esi
call fcn.00406630
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00406630
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.00407500
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46f8c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jns 0x46f928
push esi
push 0x4e71fc
call fcn.00424d30
add esp, 8
jmp 0x46f9c5
push 1
push dword [ebp - 0x1c]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x46f894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x46f902
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x46f894
push 0x4df3d0
push dword [ebp - 0x1c]
call fcn.0048ccf3
add esp, 8
mov ecx, 1
test eax, eax
sete al
test al, al
cmovne esi, ecx
jmp 0x46f89f
mov ax, word [ebp + 8]
mov ecx, 0x907
cmp ax, cx
jne 0x46f9bc
call fcn.00401910
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x46f956
push 0x80004005
call fcn.00401330
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 6
lea eax, [ebp - 0x18]
push dword [edi + 0x724]
push str._select___s
push eax
call fcn.00408450
mov esi, dword [ebp - 0x18]
add esp, 0xc
push 1
push 0
push esi
push str.explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46f9bc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
mov ecx, edi
call fcn.00425bd0
mov eax, dword [edi + 0x7f8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x608]
push 0
mov eax, dword [ecx]
call dword [eax + 0xb4]
lea ecx, [edi + 0x638]
call fcn.00424970
push ecx
mov ecx, dword [edi + 0x604]
push 0
mov dword [edi + 0x804], 0
mov dword [edi + 0x810], 0
mov dword [edi + 0x808], 0
mov byte [edi + 0x80e], 0
call fcn.00426dd0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048b090
mov esp, ebp
pop ebp
ret 0xc