Function at 0x46f0fc
Capabilities:
Create process on windows
Self delete
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46f52c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x84]
mov ecx, 0x46f544
mov edx, dword [0x474c94]
call fcn.0040473c
mov eax, dword [ebp - 0x84]
call fcn.00408a34
test al, al
jne 0x46f190
push 0x40030
mov ecx, 0x46f554
mov edx, 0x46f568
mov eax, dword [0x4738e8]
mov eax, dword [eax]
call fcn.00456880
mov eax, ebx
call fcn.004530bc
jmp 0x46f501
lea eax, [ebp - 0x88]
mov ecx, 0x46f544
mov edx, dword [0x474c94]
call fcn.0040473c
mov ecx, dword [ebp - 0x88]
mov dl, 1
mov eax, dword [0x46bbdc]
call fcn.0046bc8c
mov esi, eax
mov dl, 1
mov eax, dword [0x413db0]
call fcn.0040369c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x413db0]
call fcn.0040369c
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov edx, 0x46f58c
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x48]
mov ecx, dword [ebp - 0x10]
mov edx, 0x46f598
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x48]
mov eax, esi
call fcn.004036cc
mov edx, 0x46f5a8
mov eax, dword [ebx + 0x380]
call fcn.00436ed4
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.004072dc
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x74], 0xc
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x80], 0xc
xor eax, eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], 0xffffffff
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0x4000000
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x8c]
mov ecx, 0x46f5c4
mov edx, dword [0x474c94]
call fcn.0040473c
mov eax, dword [ebp - 0x8c]
call fcn.004048e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x46f2cc
push 0x40030
mov ecx, 0x46f554
mov edx, 0x46f5d8
mov eax, dword [0x4738e8]
mov eax, dword [eax]
call fcn.00456880
mov eax, dword [ebp - 0xc]
call fcn.004036cc
mov eax, dword [ebp - 0x10]
call fcn.004036cc
mov eax, ebx
call fcn.004530bc
jmp 0x46f501
push 0x2710
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_WaitForSingleObject
push 0x3e8
call sub.kernel32.dll_Sleep_1
push 0x80
mov eax, dword [0x474c98]
call fcn.004048e8
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
test esi, esi
jne 0x46f33e
push 0x40030
mov ecx, 0x46f554
mov edx, 0x46f5fc
mov eax, dword [0x4738e8]
mov eax, dword [eax]
call fcn.00456880
mov eax, dword [ebp - 0xc]
call fcn.004036cc
mov eax, dword [ebp - 0x10]
call fcn.004036cc
mov eax, ebx
call fcn.004530bc
jmp 0x46f501
xor edx, edx
mov eax, dword [ebx + 0x384]
call fcn.0046b8cc
mov edi, esi
dec edi
mov edx, edi
mov eax, dword [ebx + 0x384]
call fcn.0046b97c
test edi, edi
jl 0x46f40d
inc edi
mov dword [ebp - 0x14], edi
xor esi, esi
mov eax, dword [0x4738e8]
mov eax, dword [eax]
call fcn.00456544
lea ecx, [ebp - 8]
mov edx, esi
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x46f620
call fcn.00404a2c
mov edi, eax
inc edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004046f0
mov ecx, eax
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00404948
lea ecx, [ebp - 0x90]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046e830
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 8]
call fcn.004044d0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x380]
call fcn.00436ed4
mov eax, dword [ebp - 8]
call fcn.004048e8
mov edx, eax
lea eax, [ebp - 0x94]
call fcn.00404628
mov eax, dword [ebp - 0x94]
call fcn.00408b4c
mov edx, esi
mov eax, dword [ebx + 0x34c]
call fcn.0046ba2c
inc esi
dec dword [ebp - 0x14]
jne 0x46f369
mov edx, 0x46f62c
mov eax, dword [ebx + 0x380]
call fcn.00436ed4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x46f491
inc eax
mov dword [ebp - 0x14], eax
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 4]
mov eax, 0x46f620
call fcn.00404a2c
mov edi, eax
inc edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.004046f0
mov ecx, eax
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00404948
lea ecx, [ebp - 0x98]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046e830
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 4]
call fcn.004044d0
mov eax, dword [ebp - 4]
call fcn.00402ab8
inc esi
dec dword [ebp - 0x14]
jne 0x46f430
mov eax, dword [0x474c98]
call fcn.00402ab8
mov dl, 1
mov eax, dword [0x46ce6c]
call fcn.0046cf6c
mov esi, eax
mov edx, 0x80000000
mov eax, esi
call fcn.0046d00c
xor ecx, ecx
mov edx, 0x46f648
mov eax, esi
call fcn.0046d070
test al, al
je 0x46f4d3
mov edx, 0x46f658
mov eax, esi
call fcn.0046d194
mov eax, esi
call fcn.0046cfdc
mov eax, esi
call fcn.004036cc
mov eax, dword [ebp - 0xc]
call fcn.004036cc
mov eax, dword [ebp - 0x10]
call fcn.004036cc
mov edx, 0x46f668
mov eax, dword [ebx + 0x2f4]
call fcn.00430760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f533
lea eax, [ebp - 0x98]
mov edx, 6
call fcn.0040445c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040445c
ret