Function at 0x46ea81
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4a2b31
call fcn.0049e6bc
mov eax, 0x5304
call fcn.00442250
push ebx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
cmp edx, 0xe17
jne 0x46eb6c
push str.resave_copydate
call fcn.00438690
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
lea eax, [ebp - 0x5310]
push 0x4e0d6c
push eax
call fcn.00420a57
add esp, 0x14
call fcn.0045de81
test al, al
jne 0x46eafb
push 0x4e0cec
lea ecx, [ebp - 0x48]
call fcn.0041ee3b
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.0041f358
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0041ee74
lea ecx, [ebp - 0x48]
call fcn.0045e1cb
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x46eb1c
mov eax, dword [eax]
push eax
push 0x4e0d00
call fcn.0045d883
add esp, 8
lea ecx, [ebp - 0x48]
push 0
push ebx
call fcn.0041f358
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0041ee74
push esi
lea ecx, [ebp - 0x78]
call fcn.0042b9f2
lea ecx, [ebp - 0x54]
call fcn.0042c15b
lea ecx, [ebp - 0x60]
call fcn.0042c15b
push 0
push ebx
lea ecx, [ebp - 0x78]
call fcn.0041f6b8
jmp 0x46f0e6
cmp edx, 0xe16
jne 0x46eb93
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46f0e6
push 0
push 0
push 0x84d
jmp 0x46edd9
cmp edx, 0xe15
jne 0x46ebf2
call fcn.0041e77e
push 0
push 0
push 0x855
mov ecx, dword [eax]
call fcn.00476edb
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x46ebc5
cmp byte [esi + 0x10], 0
jne 0x46f0c0
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0041ee74
push 0x320
push 0x280
push ebx
push dword [esi + 8]
xor edx, edx
call fcn.004852cb
add esp, 0x28
mov edi, eax
jmp 0x46f0e8
cmp edx, 0xe14
jne 0x46ed2b
cmp byte [esi + 0x36], 0
jne 0x46ec22
call fcn.0041e77e
push 0
push 0x52d
push 0x111
mov ecx, dword [eax]
call fcn.00476edb
push eax
jmp 0x46eddc
call fcn.0041e77e
push 0
push 0
push 0x855
mov ecx, dword [eax]
call fcn.00476edb
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
test eax, eax
je 0x46ed0f
mov ecx, esi
call fcn.0046e98f
call fcn.0041e77e
push 0
push 0
push 0x84b
mov ecx, dword [eax]
call fcn.00476edb
push eax
call edi
mov esi, eax
test esi, esi
jle 0x46f0e6
push 0x54
call fcn.004387c2
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
test eax, eax
je 0x46ec94
push ebx
push ebx
push esi
mov ecx, eax
call fcn.00477c9b
mov esi, eax
jmp 0x46ec96
xor esi, esi
mov byte [ebp - 4], 0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x34]
lea eax, [ebp + 0xc]
add ecx, 0x3c
cmp ecx, eax
je 0x46ecb4
push 0xffffffffffffffff
push 0
push eax
call fcn.0041ef03
mov eax, dword [esi + 0x10]
mov ecx, esi
mov byte [eax + 0x40], bl
mov eax, dword [esi + 0x10]
mov byte [eax + 0xa6], bl
call fcn.00477861
mov eax, dword [esi + 0x10]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, dword [eax + 4]
lea eax, [ebp + 0xc]
push eax
call fcn.0041ee74
mov byte [ebp - 4], 2
call fcn.0041e77e
mov esi, dword [esi + 0x10]
push 0x468
mov ecx, dword [eax]
call fcn.00476edb
mov byte [ebp - 4], 0
mov ecx, eax
mov edx, dword [esi + 4]
call fcn.0045e150
add esp, 0x1c
jmp 0x46f0e8
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push 3
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4e0d10
jmp 0x46f0b6
cmp edx, 0xe12
jne 0x46ed80
push ebx
push 0
push 0x81c
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0041ee74
mov byte [ebp - 4], 3
call fcn.0041e77e
push 0x468
mov ecx, dword [eax]
call fcn.00476edb
mov byte [ebp - 4], 0
mov ecx, eax
mov edx, dword [esi + 8]
call fcn.0045e150
add esp, 0x1c
jmp 0x46f0e6
cmp edx, 0xe18
jne 0x46ede7
cmp dword [ebp + 0x1c], 0
jbe 0x46f0e6
lea edi, [esi + 0x14]
lea eax, [ebp + 0xc]
cmp edi, eax
je 0x46eda8
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.0041ef03
push 0x4e0d1c
mov ecx, edi
call fcn.00420ac5
test eax, eax
je 0x46f0e6
push 0x4e0dd8
mov ecx, edi
call fcn.00420ac5
test eax, eax
je 0x46f0e6
push 0
push 0
push 0x887
push dword [esi + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46f0e6
cmp edx, 0xe13
jne 0x46f0c4
call fcn.0041e77e
push 0
push 0
push 0x855
mov ecx, dword [eax]
call fcn.00476edb
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x46f09f
mov ecx, esi
call fcn.0046e98f
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0041ee74
push ebx
lea ecx, [ebp - 0x1d0]
call fcn.00422883
and dword [ebp - 0x54], 0
xor eax, eax
and dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x4e0ddc
call fcn.0041eeaf
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
push 0x4e0de4
call fcn.0041eeaf
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.004710d3
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
push 0x4e0df0
call fcn.0041eeaf
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.004710d3
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
push 0x4e0d84
call fcn.0041eeaf
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.004710d3
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 7
push eax
push 0x4e0d94
mov word [ebp - 0x2c], ax
call fcn.0041fba8
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4e0d98
call fcn.0041eeaf
mov byte [ebp - 4], 0xa
call fcn.0041e77e
mov byte [ebp - 4], 9
mov ecx, dword [eax]
call fcn.0042af19
test al, al
je 0x46ef9c
and dword [ebp - 0x38], 0
xor eax, eax
mov edi, 0x4e0db8
mov dword [ebp - 0x34], 7
push edi
mov word [ebp - 0x48], ax
call fcn.00438238
pop ecx
push eax
push edi
lea ecx, [ebp - 0x48]
call fcn.0041fba8
mov byte [ebp - 4], 0xb
call fcn.0041e77e
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x90]
push ecx
mov ecx, dword [eax]
call fcn.00424808
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041eed4
push 0
push ebx
lea ecx, [ebp - 0x90]
call fcn.0041f6b8
push 0
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 9
call fcn.0041f6b8
push 0
push 0x4e0df8
push dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00420b14
test eax, eax
jne 0x46efec
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
lea eax, [ebp - 0x90]
push 0x4e0dfc
push eax
call fcn.0045da2b
add esp, 0xc
lea ecx, [ebp - 0x2c]
push eax
call fcn.0041eed4
push 0
push ebx
lea ecx, [ebp - 0x90]
call fcn.0041f6b8
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
push 0x4e0e04
call fcn.0041eeaf
push 0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.004710d3
sub esp, 0x18
lea ecx, [ebp - 0x64]
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
sub esp, 0x18
push esp
call fcn.004710b7
push ebx
lea ecx, [ebp - 0x310]
call fcn.00422883
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00422e60
mov byte [ebp - 4], 0xe
call fcn.0041e77e
push 0x4a1
mov ecx, dword [eax]
call fcn.00476edb
mov byte [ebp - 4], 0xd
mov ecx, eax
mov edx, dword [esi + 8]
call fcn.0045e150
add esp, 0x1c
lea ecx, [ebp - 0x310]
call fcn.00422db8
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00470ff8
lea ecx, [ebp - 0x1d0]
call fcn.00422db8
jmp 0x46f0e6
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push 3
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4e0e20
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
inc ebx
mov edi, ebx
jmp 0x46f0e8
cmp edx, 0xe19
jne 0x46f0e6
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x68]
mov dword [esi + 0x88], eax
mov byte [esi + 0x11], bl
call fcn.0045d156
mov byte [esi + 0x8c], bl
xor edi, edi
push 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret