Function at 0x4574b4
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc70
push ebx
push ebp
push esi
push edi
push 0x3c
xor ebp, ebp
lea eax, [esp + 0x38]
push ebp
push eax
mov esi, ecx
call fcn.0041c9b0
add esp, 0xc
lea eax, [esp + 0x278]
mov edi, 0x208
push edi
push ebp
push eax
call fcn.0041c9b0
add esp, 0xc
lea eax, [esp + 0x70]
push edi
push ebp
push eax
call fcn.0041c9b0
add esp, 0xc
lea eax, [esp + 0x480]
push 0x800
push ebp
push eax
call fcn.0041c9b0
add esp, 0xc
lea eax, [esp + 0x278]
mov ebx, 0x104
mov edi, ebp
mov dword [esp + 0x14], edi
push ebx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec ebx
test eax, eax
jne 0x45758f
push 0xffffffffffffffff
lea eax, [esp + 0x27c]
push eax
lea eax, [esp + 0x78]
push ebx
push eax
call fcn.004290da
lea eax, [esp + 0x80]
push 0x5c
push eax
call fcn.0041bf10
mov edi, eax
add esp, 0x18
test edi, edi
je 0x45757f
lea eax, [esp + 0x70]
sub edi, eax
sar edi, 1
mov dword [esp + 0x14], edi
mov eax, edi
je 0x45758f
jmp 0x457588
or eax, 0xffffffff
or edi, eax
mov dword [esp + 0x14], edi
xor ecx, ecx
mov word [esp + eax*2 + 0x70], cx
push str.mtuninstall.bat
mov edx, ebx
lea ecx, [esp + 0x74]
call fcn.004088ee
mov eax, dword [esi + 0x58]
pop ecx
test byte [eax + 0x840], 1
je 0x4575ee
mov esi, dword [0x491ebc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x70]
push ecx
push esi
lea ecx, [esp + 0x280]
push ecx
push eax
mov eax, ecx
push eax
push str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_nrd___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x498]
push 0x7ff
push eax
call fcn.004051b5
add esp, 0x20
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jmp 0x45762c
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x284]
push eax
push str.cd_r_n__S___processwait:_u_r_ndel__Q___S__r_ndel__Q___S__r_n
lea eax, [esp + 0x494]
push 0x7ff
push eax
call fcn.004051b5
add esp, 0x1c
neg eax
sbb al, al
inc al
mov bl, al
test bl, bl
je 0x45764f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x484]
call fcn.004572c1
mov edi, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
cmovs edi, ecx
sete bl
or esi, 0xffffffff
mov dword [esp + 0x24], 0x4679a8
mov dword [esp + 0x28], esi
test bl, bl
je 0x45777b
push ecx
push 2
push 3
push 0x40000000
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x38]
call fcn.00401442
mov esi, dword [esp + 0x28]
test al, al
je 0x45777b
xor ecx, ecx
xorps xmm0, xmm0
mov dword [esp + 0x30], ecx
mov ebp, edi
movlpd qword [esp + 0x18], xmm0
cmp esi, 0xffffffff
je 0x457722
test ebp, ebp
je 0x457722
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
and dword [esp + 0x2c], 0
test ecx, ecx
jb 0x4576d1
ja 0x4576ca
cmp ebp, 0xfffffff
jbe 0x4576d1
mov ecx, 0xfffffff
jmp 0x4576d3
mov ecx, ebp
push 0
lea edx, [esp + 0x30]
push edx
push ecx
lea ecx, [esp + 0x48c]
add eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x24]
test eax, eax
mov eax, dword [esp + 0x18]
je 0x45772a
add eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
adc edx, 0
mov dword [esp + 0x18], eax
sub ebp, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
sbb ecx, 0
mov dword [esp + 0x30], ecx
test ecx, ecx
ja 0x4576b7
jb 0x45772a
test ebp, ebp
jne 0x4576b7
jmp 0x45772a
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp eax, edi
jne 0x45777b
test edx, edx
jne 0x45777b
cmp esi, 0xffffffff
je 0x457741
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
and dword [esp + 0x48], 0
lea eax, [esp + 0x70]
and dword [esp + 0x50], 0
mov dword [esp + 0x44], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x3c
mov dword [esp + 0x44], str.Open
mov dword [esp + 0x3c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
cmp esi, 0xffffffff
je 0x457787
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret