Function at 0x47b369
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x57b28c]
test eax, eax
jne 0x47bc73
mov eax, dword [0x68bb4c]
test eax, eax
je 0x47b397
mov dword [esp], 0x106
call fcn.004566a0
jmp 0x47bc74
mov eax, dword [0x6ab008]
mov dword [0xa3ad58], eax
mov eax, dword [0xa3ad58]
test eax, eax
je 0x47b3d3
mov dword [0x52f570], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6ab008]
test eax, eax
setne al
test al, al
jne 0x47b3b4
mov dword [0xa3ad5c], 0
mov eax, dword [0x68bd14]
test eax, eax
je 0x47b3f9
mov eax, dword [0x52f2dc]
test eax, eax
je 0x47b3f9
mov dword [0xa3ad5c], 1
mov eax, dword [0xa3ad60]
test eax, eax
jne 0x47b41b
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00457dba
mov dword [0xa3ad60], eax
mov eax, dword [0xa3ad64]
test eax, eax
jne 0x47b43d
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00457dba
mov dword [0xa3ad64], eax
mov eax, dword [0xa3ad68]
test eax, eax
jne 0x47b45f
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00457dba
mov dword [0xa3ad68], eax
mov eax, dword [0xa3ad6c]
test eax, eax
jne 0x47b481
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00457dba
mov dword [0xa3ad6c], eax
mov eax, dword [0xa3ad70]
test eax, eax
jne 0x47b4a3
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00457dba
mov dword [0xa3ad70], eax
cmp dword [ebp + 0xc], 0
je 0x47b4ba
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x47b4ba
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x47bbc6
mov eax, dword [0xa3ad5c]
test eax, eax
je 0x47b52b
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [0xa26310], 1
mov eax, dword [0xa3ad60]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa26310], 0
jmp 0x47bc3f
call fcn.0047965d
test eax, eax
setne al
test al, al
je 0x47ba5f
mov eax, dword [0xa3ad64]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp], 0x544126
call fcn.00457ba6
mov edx, eax
mov eax, dword [0xa3ad6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov eax, dword [0xa3ad64]
mov eax, dword [eax + 4]
test eax, eax
je 0x47bc32
mov eax, dword [0xa3ad64]
mov dword [esp], eax
call fcn.00479770
test eax, eax
sete al
test al, al
je 0x47b683
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad68]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa3ad80
call sub.msvcrt.dll_memset
mov dword [0xa3ad80], 0x3c
mov eax, dword [0xa3ad68]
mov eax, dword [eax]
mov dword [0xa3ad90], eax
mov dword [0xa3ad94], 0
mov dword [0xa3ad84], 0x440
mov dword [0xa3ad9c], 5
mov dword [esp], 0xa3ad80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x47b683
mov dword [0xa26310], 1
mov eax, dword [0xa3adb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa3adb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa26310], 0
jmp 0x47bc3f
mov dword [0xa3adbc], 0
mov dword [0xa3adc0], 0
jmp 0x47b761
mov eax, dword [0xa3ad64]
mov edx, dword [eax]
mov eax, dword [0xa3adbc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x47b6d0
mov eax, dword [0xa3adc0]
test eax, eax
jne 0x47b6c6
mov dword [0xa3adc0], 1
jmp 0x47b6d0
mov dword [0xa3adc0], 0
mov eax, dword [0xa3ad64]
mov edx, dword [eax]
mov eax, dword [0xa3adbc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x47b754
mov eax, dword [0xa3adc0]
test eax, eax
jne 0x47b754
mov eax, dword [0xa3ad64]
mov edx, dword [eax + 4]
mov eax, dword [0xa3adbc]
mov ecx, edx
sub ecx, eax
mov eax, ecx
lea edx, [eax - 1]
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00458b2f
mov edx, eax
mov eax, dword [0xa3ad6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov edx, dword [0xa3adbc]
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00458a67
mov edx, eax
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
jmp 0x47b77b
mov eax, dword [0xa3adbc]
add eax, 1
mov dword [0xa3adbc], eax
mov eax, dword [0xa3ad64]
mov edx, dword [eax + 4]
mov eax, dword [0xa3adbc]
cmp edx, eax
setg al
test al, al
jne 0x47b69c
mov eax, dword [0xa3ad64]
mov eax, dword [eax + 4]
test eax, eax
je 0x47bc35
mov eax, dword [0xa3ad6c]
mov eax, dword [eax + 4]
test eax, eax
je 0x47b8da
mov eax, dword [0xa3ad64]
mov dword [esp], eax
call fcn.00479770
test eax, eax
sete al
test al, al
je 0x47b8da
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad68]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad70]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa3ad80
call sub.msvcrt.dll_memset
mov dword [0xa3ad80], 0x3c
mov eax, dword [0xa3ad68]
mov eax, dword [eax]
mov dword [0xa3ad90], eax
mov eax, dword [0xa3ad70]
mov eax, dword [eax]
mov dword [0xa3ad94], eax
mov dword [0xa3ad84], 0x440
mov dword [0xa3ad9c], 5
mov dword [esp], 0xa3ad80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x47b8da
mov dword [0xa26310], 1
mov eax, dword [0xa3adb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa3adb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa26310], 0
jmp 0x47bc3f
mov eax, dword [0xa3ad6c]
mov eax, dword [eax + 4]
test eax, eax
je 0x47b917
mov ebx, dword [0xa3ad6c]
mov dword [esp], 0x54b51a
call fcn.00457ba6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad6c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov edx, dword [0xa3ad6c]
mov eax, dword [0xa3ad64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov ebx, dword [0xa3ad60]
mov dword [esp], str.__c
call fcn.00457ba6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa3ad80
call sub.msvcrt.dll_memset
mov dword [0xa3ad80], 0x3c
mov dword [0xa3ad90], 0x52f936
mov eax, dword [0xa3ad60]
mov eax, dword [eax]
mov dword [0xa3ad94], eax
mov dword [0xa3ad84], 0x440
mov dword [0xa3ad9c], 5
mov dword [esp], 0xa3ad80
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x47bc38
mov dword [0xa26310], 1
mov eax, dword [0xa3adb8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa3adb8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa26310], 0
jmp 0x47bc3f
mov dword [esp], str.command.com__c
call fcn.00457ba6
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 4], 1
mov dword [esp], 0x54b4a7
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004586e5
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa3ade0
call sub.msvcrt.dll_memset
mov dword [0xa3ade0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa3ae24
call sub.msvcrt.dll_memset
mov eax, dword [0xa3ad60]
mov eax, dword [eax]
mov dword [esp + 0x24], 0xa3ae24
mov dword [esp + 0x20], 0xa3ade0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x47bc3b
mov dword [0xa26310], 1
mov eax, dword [0xa3ae24]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa3ae24]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa3ae28]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa26310], 0
jmp 0x47bc3f
mov eax, dword [0xa3ad5c]
test eax, eax
jne 0x47bbd6
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 4
mov dword [esp], 0x54b86c
call fcn.00457c37
mov edx, eax
mov eax, dword [0xa3ad60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00457f21
mov dword [0xa26310], 1
mov eax, dword [0xa3ad60]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa26310], 0
mov eax, dword [0xa3ad5c]
test eax, eax
jne 0x47bc3e
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
jmp 0x47bc3e
nop
jmp 0x47bc3f
nop
jmp 0x47bc3f
nop
jmp 0x47bc3f
nop
jmp 0x47bc3f
nop
mov eax, dword [0xa3ad58]
test eax, eax
je 0x47bc74
mov eax, dword [0xa3ad58]
mov dword [0x52f570], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6ab008]
test eax, eax
sete al
test al, al
jne 0x47bc52
jmp 0x47bc74
nop
mov ebx, dword [ebp - 4]
leave
ret