Function at 0x4e5a10
Capabilities:
Create process on windows
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x664
push ebp
mov ebp, dword [esp + 0x670]
push edi
push 0x104
lea eax, [esp + 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x64]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x64]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5a50
mov edx, dword [str.update.bat]
mov eax, dword [0x5e3a94]
mov cx, word [0x5e3a98]
push 0
push closesocket
push 2
mov dword [edi], edx
mov dl, byte [0x5e3a9a]
push 0
mov dword [edi + 4], eax
push 2
push 0x40000000
lea eax, [esp + 0x7c]
mov word [edi + 8], cx
push eax
mov byte [edi + 0xa], dl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 8], eax
je 0x4e5e05
lea eax, [esp + 0x168]
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5ab7
sub eax, edx
dec eax
js 0x4e5adb
mov cl, 0x5c
cmp byte [esp + eax + 0x168], cl
je 0x4e5ad3
dec eax
jns 0x4e5ac5
jmp 0x4e5adb
mov byte [esp + eax + 0x169], 0
push esi
mov ecx, 7
mov esi, str._echo_off_r_n_:Repeat_r_n_del__
lea edi, [esp + 0x270]
mov eax, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5af3
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5b04
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5b24
mov ecx, dword [str.__r_n_if_exist__]
mov edx, dword [0x5e3a68]
mov eax, dword [0x5e3a6c]
mov dword [edi], ecx
mov cx, word [0x5e3a70]
mov dword [edi + 4], edx
mov dl, byte [0x5e3a72]
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
mov eax, ebp
mov byte [edi + 0xe], dl
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5b60
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5b71
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5b91
mov ecx, 7
mov esi, str.__goto_Repeat_r_n_:MoveMe_r_n_cd__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x16c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5bb1
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5bc2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5be2
mov eax, dword [str.__r_n_move__]
mov ecx, dword [0x5e3a3c]
mov dx, word [0x5e3a40]
mov dword [edi], eax
mov al, byte [0x5e3a42]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
mov eax, dword [esp + 0x67c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5c16
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5c27
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5c47
mov cx, word [0x5e3a34]
mov dl, byte [0x5e3a36]
mov eax, dword [esp + 0x674]
mov word [edi], cx
mov byte [edi + 2], dl
mov edx, eax
jmp 0x4e5c70
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5c70
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5c81
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5ca1
mov eax, dword [str..exe_r_n__]
mov ecx, dword [0x5e3a2c]
mov dl, byte [0x5e3a30]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, ebp
mov byte [edi + 8], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5cc6
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5cd7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5cf7
mov eax, dword [str.__r_n_del__]
mov ecx, dword [0x5e3a20]
mov dx, word [0x5e3a24]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [esp + 0x68]
mov word [edi + 8], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5d20
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4e5d31
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4e5d51
mov ax, word [0x5da134]
mov word [edi], ax
lea eax, [esp + 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e5d70
mov esi, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x27c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4e5e04
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop esi
pop edi
pop ebp
add esp, 0x664
ret