Function at 0x440f10
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x7fc]
sub esp, 0x7fc
push 0xffffffffffffffff
push 0x48fb58
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4c0074]
xor eax, ebp
mov dword [ebp + 0x7f8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x440f69
or eax, 0xffffffff
jmp 0x441156
lea eax, [ebp + 0x5f0]
push eax
push 0
push 0x4a7284
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x440f61
lea eax, [ebp + 0x5f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp word [ebp + 0x5f0], ax
je 0x440fac
nop dword [eax]
inc eax
cmp word [ebp + eax*2 + 0x5f0], 0
jne 0x440fa0
push 0
push 0x80
push 2
push 0
push 0
mov dword [ebp + eax*2 + 0x5ec], 0x6c0072
mov dword [ebp + eax*2 + 0x5e8], 0x75002e
lea eax, [ebp + 0x5f0]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x440f61
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push 0xfde9
mov ecx, esi
call fcn.0041e070
mov ebx, dword [ebp - 0x10]
lea esi, [ebp + 0x208]
mov ecx, str._InternetShortcut__r_nURL
mov edx, esi
add esp, 4
mov edi, ebx
mov al, 0x5b
sub ecx, edx
nop word [eax + eax]
mov byte [esi], al
inc esi
mov al, byte [ecx + esi]
test al, al
jne 0x441030
mov byte [esi], al
mov al, byte [ebx]
test al, al
je 0x4410bb
lea edi, [edi + 1]
cmp al, 0x61
jl 0x441051
cmp al, 0x7a
jle 0x441185
cmp al, 0x41
jl 0x44105d
cmp al, 0x5a
jle 0x441185
cmp al, 0x30
jl 0x441069
cmp al, 0x39
jle 0x441185
mov ecx, str.__.____:_______
mov dl, 0x2d
cmp dl, al
je 0x441179
mov dl, byte [ecx + 1]
inc ecx
test dl, dl
jne 0x441070
mov dl, al
mov byte [esi], 0x25
sar dl, 4
and al, 0xf
and dl, 0xf
cmp dl, 0xa
sbb cl, cl
and cl, 0xf9
add cl, 0x37
add cl, dl
cmp al, 0xa
mov byte [esi + 1], cl
sbb cl, cl
add al, 0x37
and cl, 0xf9
add cl, al
mov eax, 3
mov byte [esi + 2], cl
add esi, eax
mov byte [esi], 0
mov al, byte [edi]
test al, al
jne 0x441042
mov edi, dword [ebp - 0x1c]
lea eax, [ebp + 0x208]
mov word [esi], 0xa0d
add esi, 2
push 0
mov byte [esi], 0
sub esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp + 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
test esi, esi
je 0x44112e
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp + 0x5f0]
push 5
push 0
push 0
push eax
push str.open
push 0
call esi
mov edi, eax
cmp edi, 0x20
ja 0x44112e
push 5
push 0
push 0
lea eax, [ebp + 0x5f0]
push eax
push 0
push 0
call esi
mov edi, eax
xor eax, eax
cmp edi, 0x20
cmova edi, eax
mov dword [ebp - 4], 0xffffffff
push ebx
call fcn.0046ce46
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7f8]
xor ecx, ebp
call fcn.0046c8db
lea esp, [ebp + 0x7fc]
pop ebp
ret
sub ecx, str.__.____:_______
js 0x441080
mov byte [esi], al
mov eax, 1
jmp 0x4410b0