Function at 0x4a7165
Capabilities:
Create process on windows
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x5a628c]
test eax, eax
jne 0x4a7a6f
mov eax, dword [0x6b6b4c]
test eax, eax
je 0x4a7193
mov dword [esp], 0x106
call fcn.0048249c
jmp 0x4a7a70
mov eax, dword [0x6d6928]
mov dword [0xa66678], eax
mov eax, dword [0xa66678]
test eax, eax
je 0x4a71cf
mov dword [0x55a570], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6d6928]
test eax, eax
setne al
test al, al
jne 0x4a71b0
mov dword [0xa6667c], 0
mov eax, dword [0x6b6cc8]
test eax, eax
je 0x4a71f5
mov eax, dword [0x55a2dc]
test eax, eax
je 0x4a71f5
mov dword [0xa6667c], 1
mov eax, dword [0xa66680]
test eax, eax
jne 0x4a7217
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00483bb6
mov dword [0xa66680], eax
mov eax, dword [0xa66684]
test eax, eax
jne 0x4a7239
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00483bb6
mov dword [0xa66684], eax
mov eax, dword [0xa66688]
test eax, eax
jne 0x4a725b
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00483bb6
mov dword [0xa66688], eax
mov eax, dword [0xa6668c]
test eax, eax
jne 0x4a727d
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00483bb6
mov dword [0xa6668c], eax
mov eax, dword [0xa66690]
test eax, eax
jne 0x4a729f
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00483bb6
mov dword [0xa66690], eax
cmp dword [ebp + 0xc], 0
je 0x4a72b6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4a72b6
mov dword [ebp + 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x4a79c2
mov eax, dword [0xa6667c]
test eax, eax
je 0x4a7327
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [0xa51c30], 1
mov eax, dword [0xa66680]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa51c30], 0
jmp 0x4a7a3b
call fcn.004a5459
test eax, eax
setne al
test al, al
je 0x4a785b
mov eax, dword [0xa66684]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp], 0x56f1a6
call fcn.004839a2
mov edx, eax
mov eax, dword [0xa6668c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov eax, dword [0xa66684]
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7a2e
mov eax, dword [0xa66684]
mov dword [esp], eax
call fcn.004a556c
test eax, eax
sete al
test al, al
je 0x4a747f
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66688]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa666a0
call sub.msvcrt.dll_memset
mov dword [0xa666a0], 0x3c
mov eax, dword [0xa66688]
mov eax, dword [eax]
mov dword [0xa666b0], eax
mov dword [0xa666b4], 0
mov dword [0xa666a4], 0x440
mov dword [0xa666bc], 5
mov dword [esp], 0xa666a0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4a747f
mov dword [0xa51c30], 1
mov eax, dword [0xa666d8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa666d8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa51c30], 0
jmp 0x4a7a3b
mov dword [0xa666dc], 0
mov dword [0xa666e0], 0
jmp 0x4a755d
mov eax, dword [0xa66684]
mov edx, dword [eax]
mov eax, dword [0xa666dc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x22
jne 0x4a74cc
mov eax, dword [0xa666e0]
test eax, eax
jne 0x4a74c2
mov dword [0xa666e0], 1
jmp 0x4a74cc
mov dword [0xa666e0], 0
mov eax, dword [0xa66684]
mov edx, dword [eax]
mov eax, dword [0xa666dc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x4a7550
mov eax, dword [0xa666e0]
test eax, eax
jne 0x4a7550
mov eax, dword [0xa66684]
mov edx, dword [eax + 4]
mov eax, dword [0xa666dc]
mov ecx, edx
sub ecx, eax
mov eax, ecx
lea edx, [eax - 1]
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0048492b
mov edx, eax
mov eax, dword [0xa6668c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov edx, dword [0xa666dc]
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00484863
mov edx, eax
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
jmp 0x4a7577
mov eax, dword [0xa666dc]
add eax, 1
mov dword [0xa666dc], eax
mov eax, dword [0xa66684]
mov edx, dword [eax + 4]
mov eax, dword [0xa666dc]
cmp edx, eax
setg al
test al, al
jne 0x4a7498
mov eax, dword [0xa66684]
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7a31
mov eax, dword [0xa6668c]
mov eax, dword [eax + 4]
test eax, eax
je 0x4a76d6
mov eax, dword [0xa66684]
mov dword [esp], eax
call fcn.004a556c
test eax, eax
sete al
test al, al
je 0x4a76d6
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66688]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa6668c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66690]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa666a0
call sub.msvcrt.dll_memset
mov dword [0xa666a0], 0x3c
mov eax, dword [0xa66688]
mov eax, dword [eax]
mov dword [0xa666b0], eax
mov eax, dword [0xa66690]
mov eax, dword [eax]
mov dword [0xa666b4], eax
mov dword [0xa666a4], 0x440
mov dword [0xa666bc], 5
mov dword [esp], 0xa666a0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4a76d6
mov dword [0xa51c30], 1
mov eax, dword [0xa666d8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa666d8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa51c30], 0
jmp 0x4a7a3b
mov eax, dword [0xa6668c]
mov eax, dword [eax + 4]
test eax, eax
je 0x4a7713
mov ebx, dword [0xa6668c]
mov dword [esp], 0x57659a
call fcn.004839a2
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa6668c]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov edx, dword [0xa6668c]
mov eax, dword [0xa66684]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov ebx, dword [0xa66680]
mov dword [esp], str.__c
call fcn.004839a2
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
mov dword [esp], 0xa666a0
call sub.msvcrt.dll_memset
mov dword [0xa666a0], 0x3c
mov dword [0xa666b0], 0x55a936
mov eax, dword [0xa66680]
mov eax, dword [eax]
mov dword [0xa666b4], eax
mov dword [0xa666a4], 0x440
mov dword [0xa666bc], 5
mov dword [esp], 0xa666a0
mov eax, dword [sym.imp.SHELL32.DLL_ShellExecuteExA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x4a7a34
mov dword [0xa51c30], 1
mov eax, dword [0xa666d8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa666d8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa51c30], 0
jmp 0x4a7a3b
mov dword [esp], str.command.com__c
call fcn.004839a2
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 4], 1
mov dword [esp], 0x576527
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004844e1
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa66700
call sub.msvcrt.dll_memset
mov dword [0xa66700], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa66744
call sub.msvcrt.dll_memset
mov eax, dword [0xa66680]
mov eax, dword [eax]
mov dword [esp + 0x24], 0xa66744
mov dword [esp + 0x20], 0xa66700
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x4a7a37
mov dword [0xa51c30], 1
mov eax, dword [0xa66744]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa66744]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa66748]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0xa51c30], 0
jmp 0x4a7a3b
mov eax, dword [0xa6667c]
test eax, eax
jne 0x4a79d2
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 4
mov dword [esp], 0x5768ec
call fcn.00483a33
mov edx, eax
mov eax, dword [0xa66680]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00483d1d
mov dword [0xa51c30], 1
mov eax, dword [0xa66680]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_system
mov dword [0xa51c30], 0
mov eax, dword [0xa6667c]
test eax, eax
jne 0x4a7a3a
mov eax, dword [sym.imp.KERNEL32.dll_FreeConsole]
call eax
jmp 0x4a7a3a
nop
jmp 0x4a7a3b
nop
jmp 0x4a7a3b
nop
jmp 0x4a7a3b
nop
jmp 0x4a7a3b
nop
mov eax, dword [0xa66678]
test eax, eax
je 0x4a7a70
mov eax, dword [0xa66678]
mov dword [0x55a570], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [0x6d6928]
test eax, eax
sete al
test al, al
jne 0x4a7a4e
jmp 0x4a7a70
nop
mov ebx, dword [ebp - 4]
leave
ret