Function at 0x4d3530
Capabilities:
Create process on windows
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x664
push ebp
mov ebp, dword [esp + 0x670]
push edi
push 0x104
lea eax, [esp + 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x64]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x64]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3570
mov edx, dword [str.update.bat]
mov eax, dword [0x5488b4]
mov cx, word [0x5488b8]
push 0
push 0x80000000
push 2
mov dword [edi], edx
mov dl, byte [0x5488ba]
push 0
mov dword [edi + 4], eax
push 2
push 0x40000000
lea eax, [esp + 0x7c]
mov word [edi + 8], cx
push eax
mov byte [edi + 0xa], dl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 8], eax
je 0x4d3925
lea eax, [esp + 0x168]
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d35d7
sub eax, edx
dec eax
js 0x4d35fb
mov cl, 0x5c
cmp byte [esp + eax + 0x168], cl
je 0x4d35f3
dec eax
jns 0x4d35e5
jmp 0x4d35fb
mov byte [esp + eax + 0x169], 0
push esi
mov ecx, 7
mov esi, str._echo_off_r_n_:Repeat_r_n_del__
lea edi, [esp + 0x270]
mov eax, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3613
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d3624
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3644
mov ecx, dword [str.__r_n_if_exist__]
mov edx, dword [0x548888]
mov eax, dword [0x54888c]
mov dword [edi], ecx
mov cx, word [0x548890]
mov dword [edi + 4], edx
mov dl, byte [0x548892]
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
mov eax, ebp
mov byte [edi + 0xe], dl
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3680
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d3691
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d36b1
mov ecx, 7
mov esi, str.__goto_Repeat_r_n_:MoveMe_r_n_cd__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x16c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d36d1
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d36e2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3702
mov eax, dword [str.__r_n_move__]
mov ecx, dword [0x54885c]
mov dx, word [0x548860]
mov dword [edi], eax
mov al, byte [0x548862]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
mov eax, dword [esp + 0x67c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3736
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d3747
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3767
mov cx, word [0x548854]
mov dl, byte [0x548856]
mov eax, dword [esp + 0x674]
mov word [edi], cx
mov byte [edi + 2], dl
mov edx, eax
jmp 0x4d3790
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3790
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d37a1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d37c1
mov eax, dword [str..exe_r_n__]
mov ecx, dword [0x54884c]
mov dl, byte [0x548850]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, ebp
mov byte [edi + 8], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d37e6
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d37f7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3817
mov eax, dword [str.__r_n_del__]
mov ecx, dword [0x548840]
mov dx, word [0x548844]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [esp + 0x68]
mov word [edi + 8], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3840
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d3851
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d3871
mov ax, word [0x540860]
mov word [edi], ax
lea eax, [esp + 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d3890
mov esi, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x27c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4d3924
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop esi
pop edi
pop ebp
add esp, 0x664
ret