Function at 0x46ef50
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483c9d
mov eax, dword fs:[0]
push eax
mov eax, 0x10b8
call fcn.00465b80
mov eax, dword [0x4b6018]
xor eax, ebp
mov dword [ebp - 0x48], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0xc
push 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x46efce
push 0
mov eax, dword [0x4c8c00]
push eax
push str.create_pipe1_failed.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
or eax, 0xffffffff
jmp 0x46f36a
push 0
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x1098]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x46f00a
push 0
mov ecx, dword [0x4c8c00]
push ecx
push str.create_pipe2_failed.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
or eax, 0xffffffff
jmp 0x46f36a
push 0
push 1
mov edx, dword [ebp - 0x1098]
push edx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
lea edx, [ebp - 0x1094]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 0x1094], 0x44
mov dword [ebp - 0x1068], 0x101
xor eax, eax
mov word [ebp - 0x1064], ax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x105c], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1058], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1054], eax
mov ecx, dword [0x4c8be8]
mov dword [ebp - 0x10ac], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10b0], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1094]
push edx
mov eax, dword [ebp - 0x10ac]
push eax
push 0
push 0x20
push 1
push 0
push 0
mov ecx, dword [ebp - 0x10b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x46f0e3
push 0
mov edx, dword [0x4c8c00]
push edx
push str.can_not_create_downloading.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
or eax, 0xffffffff
jmp 0x46f36a
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.e.dat
push 0x4c8aec
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401660
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x10b4], edx
push 0x4a99cc
mov eax, dword [ebp - 0x10b4]
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x104c], 0
push 0xfff
push 0
lea ecx, [ebp - 0x104b]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
lea edx, [ebp - 0x14]
push edx
push 0xfff
lea eax, [ebp - 0x104c]
push eax
mov ecx, dword [ebp - 0x1098]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46f2f1
cmp dword [ebp - 0x18], 0
je 0x46f196
mov edx, dword [ebp - 0x18]
push edx
push 1
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x104c]
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x14], 0
jne 0x46f1a1
jmp 0x46f2f1
cmp dword [0x4c7b04], 0
je 0x46f1e2
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
mov eax, dword [0x4c8c00]
push eax
push str.canceled_by_user.
push 0
call dword [sym.imp.BCGCBPRO120090.dll_int___cdecl_BCGPMessageBox_struct_HWND_____char_const___char_const___unsigned_int_]
add esp, 0x10
mov dword [ebp - 0x40], 0xffffffff
jmp 0x46f2f1
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x104c], 0
lea edx, [ebp - 0x104c]
mov dword [ebp - 0x109c], edx
mov dword [ebp - 0x10a0], 0
push str.has_already_been_downloaded
mov eax, dword [ebp - 0x109c]
push eax
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
test eax, eax
je 0x46f223
mov dword [ebp - 0x40], 1
push str.__of
mov ecx, dword [ebp - 0x109c]
push ecx
call dword [sym.imp.MSVCR90.dll_strstr]
add esp, 8
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0
je 0x46f2ec
mov edx, dword [ebp - 0x109c]
sub edx, 5
mov dword [ebp - 0x10a0], edx
movss xmm0, dword [0x4add20]
movss dword [ebp - 0x10a4], xmm0
lea eax, [ebp - 0x10a4]
push eax
push 0x4abdc4
mov ecx, dword [ebp - 0x10a0]
push ecx
call dword [sym.imp.MSVCR90.dll_sscanf]
add esp, 0xc
push 0
fld dword [ebp - 0x10a4]
fnstcw word [ebp - 0x10b6]
movzx eax, word [ebp - 0x10b6]
or eax, 0xc00
mov dword [ebp - 0x10bc], eax
fldcw word [ebp - 0x10bc]
fistp qword [ebp - 0x10c4]
fldcw word [ebp - 0x10b6]
mov edx, dword [ebp - 0x10c4]
push edx
push 0x4a2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x40], 1
mov edx, dword [ebp - 0x109c]
add edx, 5
mov dword [ebp - 0x109c], edx
jmp 0x46f223
jmp 0x46f14f
cmp dword [ebp - 0x40], 0xffffffff
je 0x46f301
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1098]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x46f34b
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [ebp - 0x10a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.00408de6
mov esp, ebp
pop ebp
ret