Function at 0x1400046f0
Capabilities:
Create process on windows
Resume thread
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x1428
call fcn.14003a240
sub rsp, rax
mov rax, qword [0x140055708]
xor rax, rsp
mov qword [rsp + 0x1410], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [0x14003ca80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0xffffffffffffffff
je 0x140004d8c
lea rax, [rsp + 0x148]
lea rcx, [0x14003ca90]
mov rdi, rax
mov rsi, rcx
mov ecx, VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x104
lea rdx, [rsp + 0x10e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x10e0]
mov edx, 0x104
lea rcx, [rsp + 0xfc0]
call fcn.1400027a0
mov edx, 0x5c
lea rcx, [rsp + 0xfc0]
call fcn.140005930
mov byte [rax], 0
cmp dword [0x140057384], 0
je 0x1400047f5
lea rdx, str.C:Program_Files
lea rcx, [rsp + 0xfc0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1400047f5
mov edx, 0x5c
lea rcx, [rsp + 0xfc0]
call fcn.140005930
mov byte [rax], 0
mov edx, 0x104
lea rcx, [rsp + 0x11f0]
call fcn.140004680
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0xeb0]
call fcn.1400027a0
lea r8, [0x14003cab8]
mov edx, 0x104
lea rcx, [rsp + 0xeb0]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x380]
call fcn.1400027a0
lea r8, [0x14003cac8]
mov edx, 0x104
lea rcx, [rsp + 0x380]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x1300]
call fcn.1400027a0
lea r8, [0x14003cad8]
mov edx, 0x104
lea rcx, [rsp + 0x1300]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.1400027a0
lea r8, str.Ezauto.dll
mov edx, 0x104
lea rcx, [rsp + 0x270]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x9a0]
call fcn.1400027a0
lea r8, [0x14003caf8]
mov edx, 0x104
lea rcx, [rsp + 0x9a0]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.1400027a0
lea r8, str.Ezlaunch.dll
mov edx, 0x104
lea rcx, [rsp + 0x160]
call fcn.1400027f0
lea r8, [0x140057270]
mov edx, 0x104
lea rcx, [rsp + 0x890]
call fcn.1400027a0
lea r8, [0x14003cb18]
mov edx, 0x104
lea rcx, [rsp + 0x890]
call fcn.1400027f0
lea r8, str.set__A_count0__r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027a0
lea r8, str.:Repeat_r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cb50]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cb70]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cb90]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cbb0]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cbd0]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.if_exist___s__del___s___r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.set__A_countcount1__r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.if___count___LSS_50__goto_repeat__r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.:Repeat1_r_n
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, [0x14003cc60]
mov edx, 0x400
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.if_exist___s__goto_repeat1__r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.rmdir__S__Q___sTouchPad__r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.rmdir__S__Q___sDell__r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.rmdir__S__Q___s__r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
cmp dword [rsp + 0x1440], 0
jne 0x140004b18
lea r8, str.shutdown__r__t_0_r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea r8, str.del___s__r_n
mov edx, 0x800
lea rcx, [rsp + 0xab0]
call fcn.1400027f0
lea rax, str.DelUS.bat
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xfc0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x11f0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x11f0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x9a0]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x9a0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1300]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1300]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x380]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x380]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xeb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xeb0]
lea r8, [rsp + 0xab0]
mov edx, 0x800
lea rcx, [rsp + 0x490]
call fcn.140002a40
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x10d0]
mov r8d, eax
lea rdx, [rsp + 0x490]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.140023b30
mov dword [rsp + 0xd0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140023b30
mov dword [rsp + 0x10c], 1
mov word [rsp + 0x110], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
lea rax, [0x14003cac4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x148]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004d8c
mov edx, 0xfffffff1
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1410]
xor rcx, rsp
call fcn.1400232d0
add rsp, 0x1428
pop rdi
pop rsi
ret