Function at 0x4d0840
Capabilities:
Create process on windows
Get common file path
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x664
push ebp
mov ebp, dword [esp + 0x670]
push edi
push 0x104
lea eax, [esp + 0x16c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x64]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x64]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0880
mov edx, dword [str.update.bat]
mov eax, dword [0x545690]
mov cx, word [0x545694]
push 0
push 0x80000000
push 2
mov dword [edi], edx
mov dl, byte [0x545696]
push 0
mov dword [edi + 4], eax
push 2
push 0x40000000
lea eax, [esp + 0x7c]
mov word [edi + 8], cx
push eax
mov byte [edi + 0xa], dl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 8], eax
je 0x4d0c35
lea eax, [esp + 0x168]
mov dword [esp + 0xc], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d08e7
sub eax, edx
dec eax
js 0x4d090b
mov cl, 0x5c
cmp byte [esp + eax + 0x168], cl
je 0x4d0903
dec eax
jns 0x4d08f5
jmp 0x4d090b
mov byte [esp + eax + 0x169], 0
push esi
mov ecx, 7
mov esi, str._echo_off_r_n_:Repeat_r_n_del__
lea edi, [esp + 0x270]
mov eax, ebp
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0923
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d0934
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0954
mov ecx, dword [str.__r_n_if_exist__]
mov edx, dword [0x545664]
mov eax, dword [0x545668]
mov dword [edi], ecx
mov cx, word [0x54566c]
mov dword [edi + 4], edx
mov dl, byte [0x54566e]
mov dword [edi + 8], eax
mov word [edi + 0xc], cx
mov eax, ebp
mov byte [edi + 0xe], dl
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0990
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d09a1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d09c1
mov ecx, 7
mov esi, str.__goto_Repeat_r_n_:MoveMe_r_n_cd__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x16c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d09e1
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d09f2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0a12
mov eax, dword [str.__r_n_move__]
mov ecx, dword [0x545638]
mov dx, word [0x54563c]
mov dword [edi], eax
mov al, byte [0x54563e]
mov dword [edi + 4], ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
mov eax, dword [esp + 0x67c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0a46
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d0a57
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0a77
mov cx, word [0x545630]
mov dl, byte [0x545632]
mov eax, dword [esp + 0x674]
mov word [edi], cx
mov byte [edi + 2], dl
mov edx, eax
jmp 0x4d0aa0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0aa0
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d0ab1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0ad1
mov eax, dword [str..exe_r_n__]
mov ecx, dword [0x545628]
mov dl, byte [0x54562c]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov eax, ebp
mov byte [edi + 8], dl
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0af6
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d0b07
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0b27
mov eax, dword [str.__r_n_del__]
mov ecx, dword [0x54561c]
mov dx, word [0x545620]
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [esp + 0x68]
mov word [edi + 8], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0b50
lea edi, [esp + 0x270]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d0b61
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x270]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d0b81
mov ax, word [0x53d808]
mov word [edi], ax
lea eax, [esp + 0x270]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d0ba0
mov esi, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x27c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x8c]
push edx
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4d0c34
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop esi
pop edi
pop ebp
add esp, 0x664
ret