Function at 0x4e5090
Capabilities:
Create process on windows
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x664
push ebp
mov ebp, dword [esp + 0x670]
push edi
push 0x104
lea eax, [esp + 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x64]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x64]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e50d0
mov edx, dword [str.update.bat]
mov eax, dword [0x5e39c4]
mov cx, word [0x5e39c8]
push 0
push closesocket
push 2
mov dword [edi], edx
mov dl, byte [0x5e39ca]
push 0
mov dword [edi + 4], eax
push 2
push 0x40000000
lea eax, [esp + 0x7c]
mov word [edi + 8], cx
push eax
mov byte [edi + 0xa], dl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 8], eax
je 0x4e5485
lea eax, [esp + 0x168]
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5137
sub eax, edx
dec eax
js 0x4e515b
mov cl, 0x5c
cmp byte [esp + eax + 0x168], cl
je 0x4e5153
dec eax
jns 0x4e5145
jmp 0x4e515b
mov byte [esp + eax + 0x169], 0
push esi
mov ecx, 7
mov esi, str._echo_off_r_n_:Repeat_r_n_del__
lea edi, [esp + 0x270]
mov eax, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5173
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5184
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e51a4
mov ecx, dword [str.__r_n_if_exist__]
mov edx, dword [0x5e3998]
mov eax, dword [0x5e399c]
mov dword [edi], ecx
mov cx, word [0x5e39a0]
mov dword [edi + 4], edx
mov dl, byte [0x5e39a2]
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
mov eax, ebp
mov byte [edi + 0xe], dl
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e51e0
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e51f1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5211
mov ecx, 7
mov esi, str.__goto_Repeat_r_n_:MoveMe_r_n_cd__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x16c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5231
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5242
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5262
mov eax, dword [str.__r_n_move__]
mov ecx, dword [0x5e396c]
mov dx, word [0x5e3970]
mov dword [edi], eax
mov al, byte [0x5e3972]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
mov eax, dword [esp + 0x67c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5296
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e52a7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e52c7
mov cx, word [0x5e3964]
mov dl, byte [0x5e3966]
mov eax, dword [esp + 0x674]
mov word [edi], cx
mov byte [edi + 2], dl
mov edx, eax
jmp 0x4e52f0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e52f0
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5301
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5321
mov eax, dword [str..exe_r_n__]
mov ecx, dword [0x5e395c]
mov dl, byte [0x5e3960]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, ebp
mov byte [edi + 8], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5346
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5357
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5377
mov eax, dword [str.__r_n_del__]
mov ecx, dword [0x5e3950]
mov dx, word [0x5e3954]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [esp + 0x68]
mov word [edi + 8], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e53a0
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e53b1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e53d1
mov ax, word [0x5da104]
mov word [edi], ax
lea eax, [esp + 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e53f0
mov esi, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x27c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4e5484
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop esi
pop edi
pop ebp
add esp, 0x664
ret