Function at 0x46f848
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xbf8]
sub rsp, 0xcd0
xor edx, edx
mov r14, rcx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x70]
call fcn.00424830
mov ebx, 0x208
lea rcx, [rbp + 0x1c0]
mov r8d, ebx
xor edx, edx
call fcn.00424830
mov r8d, ebx
lea rcx, [rbp - 0x50]
xor edx, edx
call fcn.00424830
mov esi, 0x800
lea rcx, [rbp + 0x3d0]
mov r8d, esi
xor edx, edx
call fcn.00424830
mov ebx, 0x104
lea rdx, [rbp + 0x1c0]
xor r12d, r12d
mov r8d, ebx
xor ecx, ecx
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp - 0x50]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or r15, 0xffffffffffffffff
mov ebx, 0x103
test eax, eax
jne 0x46f935
mov r9, r15
lea r8, [rbp + 0x1c0]
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.00435528
lea edx, [r12 + 0x5c]
lea rcx, [rbp - 0x50]
call fcn.00423d84
test rax, rax
je 0x46f925
lea rcx, [rbp - 0x50]
sub rax, rcx
sar rax, 1
jmp 0x46f928
mov eax, r15d
movsxd rdi, eax
test eax, eax
je 0x46f935
mov word [rbp + rdi*2 - 0x50], r12w
lea rcx, [rbp - 0x50]
cmp word [rcx], r12w
je 0x46f94b
add rcx, 2
sub rbx, 1
jne 0x46f939
jmp 0x46f973
lea r8, str.mtuninstall.bat
mov rdx, rcx
sub r8, rcx
movzx eax, word [r8 + rdx]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
je 0x46f973
sub rbx, 1
jne 0x46f958
mov word [rcx], r12w
mov rax, qword [r14 + 0xa8]
test byte [rax + 0x850], 1
je 0x46f9cf
mov rbx, qword [0x004b9088]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rbp - 0x50]
mov edx, 0x7ff
mov qword [rsp + 0x38], rcx
lea r9, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
lea r8, str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_nrd___S__r_ndel__Q___S__r_n
lea rcx, [rbp + 0x3d0]
mov dword [rsp + 0x20], eax
call fcn.00405a98
jmp 0x46fa0d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rbp - 0x50]
mov edx, 0x7ff
mov qword [rsp + 0x30], rcx
lea r9, [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
mov qword [rsp + 0x28], rcx
lea r8, str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_ndel__Q___S__r_n
lea rcx, [rbp + 0x3d0]
mov dword [rsp + 0x20], eax
call fcn.00405a98
test eax, eax
sete bl
test bl, bl
je 0x46fb2f
mov rdx, rsi
lea rax, [rbp + 0x3d0]
cmp byte [rax], r12b
je 0x46fa32
inc rax
sub rdx, 1
jne 0x46fa24
test rdx, rdx
mov rax, rdx
setne bl
sub rsi, rdx
neg rax
sbb rcx, rcx
and rcx, rsi
neg rdx
sbb rdi, rdi
and rdi, rcx
test bl, bl
je 0x46fb2f
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 0x50]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, r15
je 0x46fb2f
mov r15, rdi
mov rsi, r12
test rdi, rdi
je 0x46fae2
mov r13d, 0xfffffff
mov r8d, r15d
mov dword [rbp + 0xc00], r12d
cmp r15, r13
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 0x3d0]
mov rcx, r14
cmova r8d, r13d
lea r9, [rbp + 0xc00]
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46fae2
mov eax, dword [rbp + 0xc00]
add rsi, rax
sub r15, rax
jne 0x46faa0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
jne 0x46fb2f
lea rax, str.Open
mov dword [rsp + 0x40], WSAStartup
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x44], 0x40
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
lea r11, [rsp + 0xcd0]
mov al, bl
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret