Function at 0x4613e0
Capabilities:
Create process on windows
Download url
Receive data
Schedule task via schtasks
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e03eb
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x15
lea edi, [ebp - 0x330]
mov esi, str.https:__upload.symcir.com_react_update.exe
lea eax, [ebp - 0x2da]
rep movsd dword es:[edi], dword [esi]
push 0x1b2
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.004c13c0
add esp, 0xc
push 0x1000
push 0x54ed60
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [eax*2 - 0x12]
cmp eax, 0x2000
jae 0x461763
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
push 0x54ed60
mov word [eax + 0x54ed60], cx
lea eax, [ebp - 0x538]
push str._s_react_update.exe
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x538]
push 0
push 0
push eax
lea eax, [ebp - 0x330]
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x46171a
mov ecx, 0x44
lea eax, [ebp - 0x628]
lea ecx, [ecx]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4614b0
mov dword [ebp - 0x628], 0x44
lea eax, [ebp - 0x638]
mov ecx, 0x10
mov edi, edi
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x4614d0
or dword [ebp - 0x5fc], 0x100
lea eax, [ebp - 0x128]
push 0x54ed60
push str._Sreact_update.bat
push 0x104
push eax
call fcn.004bb4d3
push 0xa8
lea eax, [ebp - 0x5e0]
push 0
push eax
call fcn.004c13c0
add esp, 0x10
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x5e0]
push eax
call fcn.0046f200
mov edx, str.taskkill__im_react.exe__F
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5e0]
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5e0]
mov edx, str.timeout__t_10__nobreak___NUL
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5e0]
mov edx, str.del__dp0_react.exe
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5e0]
mov edx, str.ren__dp0_react_update.exe_react.exe
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5e0]
mov edx, str.schtasks__Delete__TN_REACT_UPDATE__F
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5e0]
mov edx, str._goto__2_nul__del__f0__cmd__c_exit__b_10
call fcn.004717e0
push eax
call fcn.00471ab0
add esp, 4
lea ecx, [ebp - 0x5dc]
call fcn.0046fec0
test eax, eax
jne 0x461604
mov eax, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5e0]
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x4615f2
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x461604
push 0
call fcn.00453490
push 0x10
call fcn.004bb090
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esi + 0xa]
lea eax, [ebp - 0x1c]
push ecx
movzx ecx, word [esi + 8]
push ecx
push str._02d:_02d
push eax
call edi
push esi
call fcn.004bae6f
add esp, 0x14
mov ecx, str.AMD64
mov eax, 0x560e08
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x461666
test dx, dx
je 0x461662
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x461666
add eax, 4
add ecx, 4
test dx, dx
jne 0x461640
xor eax, eax
jmp 0x46166b
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x128]
push eax
jne 0x461681
push str.c:WindowsSysnativecmd.exe__c_schtasks__Create__TN_REACT_UPDATE__TR____S____SC_MINUTE__MO_10__ST__s__RU_SYSTEM
jmp 0x461686
push str.c:WindowsSystem32cmd.exe__c_schtasks__Create__TN_REACT_UPDATE__TR____S____SC_MINUTE__MO_10__ST__s__RU_SYSTEM
push 0x1000
push 0x552d60
call fcn.004bb50e
add esp, 0x14
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x552d60
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4616da
mov ecx, str.Update_failed_n
call fcn.00458190
lea ecx, [ebp - 0x5e0]
call fcn.00461380
jmp 0x46172e
push str.UPDATE___Updating_REACT_to_latest_version_n
call fcn.004bc829
add esp, 4
push 0xffffffffffffffff
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x638]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x634]
call esi
lea ecx, [ebp - 0x5e0]
call fcn.00461380
xor eax, eax
jmp 0x461733
cmp eax, 0x8007000e
jne 0x46174e
push str.UPDATE___Buffer_length_invalid__or_insufficient_memory_n
call fcn.004bc829
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
cmp eax, 0x800c0008
jne 0x46175c
push str.UPDATE___URL_is_invalid_n
jmp 0x461726
push str.UPDATE___Other_error_n
jmp 0x461726
call fcn.004bbfd4
int3