Function at 0x46dd20
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
mov ebx, ecx
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0x2712
call fcn.0047cff8
xor edi, edi
cmp dword [ebp - 0x18], edi
jne 0x46e05a
mov dword [ebx + 0x10], 0x64
cmp dword [ebp + 8], edi
je 0x46ddd8
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x46ddd8
push edi
lea ecx, [ebx + 4]
push 0x80
mov dword [ebp - 0x1c], ecx
call fcn.004a0ff9
push 6
pop edx
mov ecx, eax
call fcn.00482361
mov esi, eax
cmp esi, 0xffffffff
je 0x46ddbf
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46dda9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jne 0x46dda9
cmp edi, dword [ebp + 0x10]
je 0x46ddb6
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
mov dword [ebp + 8], edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46ddf8
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
mov dword [ebp + 8], edi
mov dword [ebp - 8], 0x522190
jmp 0x46e061
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 0xc], 0x2713
mov dword [ebp - 0x1c], ecx
call fcn.004a0ff9
lea edx, [ebp + 0xc]
mov ecx, eax
call fcn.004b93d7
mov dword [ebp + 8], eax
cmp dword [ebp + 8], edi
je 0x46ddcc
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xc], 0x2714
call fcn.00501c46
push dword [ebp + 0xc]
lea ecx, [ebp - 0xa8]
push dword [ebp + 8]
call fcn.00502f43
mov ecx, dword [0x556c94]
push edi
push 0x522184
mov dword [ebp - 0x10], eax
call fcn.0040b398
mov esi, eax
call fcn.004a1a4d
test eax, eax
je 0x46de4d
cmp byte [0x56baf4], 0
je 0x46de4d
mov esi, 0x56baa8
mov ecx, dword [0x556c94]
push edi
push 0x520070
call fcn.0040b40a
test eax, eax
jne 0x46de7f
cmp esi, edi
je 0x46de73
mov ecx, dword [ebp - 0x10]
push esi
call fcn.004ba452
test al, al
jne 0x46de7f
mov dword [ebp - 8], 0x516d44
jmp 0x46e04d
push 0x517834
lea ecx, [ebp - 0x14]
call fcn.004a0fd9
mov ecx, dword [0x556c94]
push edi
push edi
push 0x51fd40
call fcn.0040b3c9
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.0046a74f
mov ecx, dword [ebp - 0x10]
cmp ecx, edi
je 0x46def0
xor eax, eax
cmp word [ecx], di
sete al
test al, al
jne 0x46def0
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x14]
call fcn.004a0ff9
push eax
lea eax, [ebp - 0xc]
push 0x522178
push eax
call fcn.004a1618
add esp, 0x10
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.004a101e
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
mov ecx, dword [0x556c94]
push 0x51fd34
mov byte [ebp - 1], 0
call fcn.0040ba1a
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], edi
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ecx + 8]
jae 0x46dfe6
push eax
call fcn.0040b27c
mov esi, eax
cmp esi, edi
je 0x46dfe6
mov ecx, dword [ebp - 8]
xor eax, eax
inc eax
shl eax, cl
mov ecx, dword [ebp - 0x20]
test ecx, eax
je 0x46dfd9
push edi
push edi
push 0x51fcb8
mov ecx, esi
call fcn.0040b3c9
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.0046a74f
push edi
push 0x52216c
mov ecx, esi
call fcn.0040b40a
mov ecx, dword [ebp - 0xc]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
cmp ecx, edi
je 0x46dfc6
xor eax, eax
cmp word [ecx], di
sete al
test al, al
jne 0x46dfc6
test bl, bl
je 0x46df8b
mov esi, 0x510b30
cmp byte [ebp - 1], al
je 0x46df90
mov esi, 0x517834
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x30]
push 0x52215c
push eax
call fcn.004a1618
add esp, 0x14
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.004a101e
lea ecx, [ebp - 0x30]
call fcn.004a0c7d
test bl, bl
je 0x46dfce
mov byte [ebp - 1], 1
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
mov ebx, dword [ebp - 0x2c]
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x46df0a
cmp byte [ebp - 1], 0
je 0x46e007
lea ecx, [ebp - 0x14]
call fcn.004a1005
lea ecx, [ebp - 0x14]
lea esi, [eax + eax - 2]
call fcn.004a0ff9
push 0x22
pop ecx
mov word [eax + esi], cx
push 1
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], 0x522158
call fcn.004a0ff9
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.004a0ff9
push eax
push 0x510edc
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x1f
mov dword [ebp - 0xc], eax
jle 0x46e03d
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
lea ecx, [ebp - 0x14]
call fcn.004a0c7d
lea ecx, [ebp - 0xa8]
call fcn.00501c70
jmp 0x46e061
mov dword [ebp - 8], 0x51571c
lea ecx, [ebx + 4]
mov dword [ebp - 0x10], edi
call fcn.004a0ff9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46e090
cmp dword [ebp - 0x10], 0x14
jge 0x46e097
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x10]
lea ecx, [ebx + 4]
call fcn.004a0ff9
push eax
call esi
test eax, eax
je 0x46e074
call fcn.0047cfd9
mov ecx, dword [ebp - 0x18]
cmp ecx, edi
je 0x46e0ac
call fcn.0049e64a
mov esi, eax
jmp 0x46e0ae
xor esi, esi
push dword [ebp - 8]
lea ecx, [ebx + 0xc]
push dword [ebx + 0x10]
call fcn.004a0e99
mov edx, dword [ebp - 0x20]
push eax
push esi
push dword [ebp - 0xc]
push 6
pop ecx
call fcn.0046d0b6
mov ecx, dword [0x556c94]
push edi
push 0x51fd50
call fcn.0040b398
push eax
lea eax, [ebp - 0x24]
push 0x522148
push eax
call fcn.004a15fa
add esp, 0xc
cmp dword [ebp + 0x18], edi
je 0x46e113
lea ecx, [ebp - 0x24]
call fcn.004a0e99
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x18]
push eax
push 0x8903bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004674fe
mov ecx, 0x55a698
call fcn.004a0cb3
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
mov ecx, ebx
call fcn.00467ca4
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x24]
call fcn.004a0c7d
pop edi
pop esi
pop ebx
leave
ret 0x24