Function at 0x45076f
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50464f
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x56a078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 1
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x45094f
call fcn.00406cde
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b09
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
push 0x52ed58
call fcn.004093f6
mov byte [ebp - 4], 4
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.00470b60
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
push str..bat
lea ecx, [ebp - 0x10]
call fcn.004072a1
mov edi, dword [ebp - 0x10]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 6
cmp eax, 0xffffffff
jne 0x450838
mov byte [ebp - 4], 3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2c], 0
jmp 0x450943
call fcn.00406cde
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b09
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x14]
push edi
call fcn.00451be5
mov byte [ebp - 4], 0xa
mov ecx, str._echo_off__r_nATTRIB__r___s___r_n:try__r_ndel___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push dword [ebp - 0x14]
cmp byte [ebx + 9], 0
mov eax, str._echo_off__r_nATTRIB__r___s___r_n:try__r_nrd___s___r_nif_exist___s__goto_try_r_nATTRIB__r___s___r_ndel___s___cls
push dword [ebp - 0x14]
cmove eax, ecx
push dword [ebx]
push dword [ebx]
push dword [ebx]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00451ee1
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
add esp, 0x1c
push 0
push eax
push dword [esi - 0xc]
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov byte [ebp - 4], 6
lea ecx, [esi - 0x10]
call fcn.00406dd3
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4508c8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x2c], 0
lea edx, [ebx + 4]
lea ecx, [ebp - 0x18]
call fcn.004700e0
mov byte [ebp - 4], 0xd
cmp byte [ebx + 8], 0
jne 0x4508f3
xor eax, eax
push eax
push dword [ebp - 0x18]
push eax
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x450934
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004d1f70
mov eax, dword [ebp - 0x18]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], ecx
push eax
mov dword [ebp - 0x64], 0x500
mov dword [ebp - 0x5c], str.runas
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov byte [ebp - 4], 1
lea ecx, [edi - 0x10]
call fcn.00406dd3
mov byte [ebp - 4], 0
lea ecx, [ebx + 4]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 0
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebx]
sub ecx, 0x10
call fcn.00406dd3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret