Function at 0x46ce40
Capabilities:
Create directory
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a3e90
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push str._binSnapShot.exe
lea eax, [esp + 0x10]
push 0x63c670
push eax
call fcn.00401ba0
add esp, 0xc
test esi, esi
mov dword [esp + 0x28], 0
jne 0x46ce9a
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x46cefa
push str.TencentTTPlugins1SnapShotSnapShot.exe
lea ecx, [esp + 0x14]
push 0x63c274
push ecx
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00402330
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46cee5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
jne 0x46cf17
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0044adc0
add esp, 4
test eax, eax
je 0x46cf17
mov edx, dword [esp + 0xc]
push 5
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x46d0df
mov eax, dword [0x63c684]
push eax
mov esi, eax
call fcn.0044adc0
add esp, 4
test eax, eax
jne 0x46cf46
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46cf46
push 0x63c270
mov ecx, 0x63c684
call fcn.00402330
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x46cf60
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push str._screen1.bmp
lea ecx, [esp + 0x18]
push 0x63c684
push ecx
mov byte [esp + 0x34], 2
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.00402330
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46cfc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
push esi
call fcn.00456560
add esp, 4
cmp eax, 0xffffffff
jne 0x46cfe5
push 0
push 0
push 0x5da074
call fcn.0055e834
jmp 0x46d0be
cmp eax, 0xfffffffe
jne 0x46cffd
push 0
push 0
push 0x5edf14
call fcn.0055e834
jmp 0x46d0be
push 0x5e9da8
lea ecx, [esp + 0x20]
call fcn.004023b0
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x34], 4
call fcn.00401ae0
add esp, 0xc
push 0x5e9da8
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x34], 5
call fcn.00401ba0
mov eax, dword [eax]
add esp, 0xc
push 5
push 0
push eax
push str.mspaint.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46d074
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46d099
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x28], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46d0be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46d0df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46d107
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret