Function at 0x420ec0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x308
mov eax, dword [0x4cd070]
xor eax, esp
mov dword [esp + 0x304], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push str.wechat_update_start.
push str.update
push 0x2e
push str.uiWechatUpdate.cpp
push 2
mov dword [esp + 0x2c], esi
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
push 0x421830
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xorps xmm0, xmm0
mov dword [esp + 0xd0], 0
push 0xffffffffffffffff
movaps xmmword [esp + 0xc4], xmm0
lea ecx, [esp + 0xc4]
push edi
movaps xmmword [esp + 0xc8], xmm0
mov dword [esp + 0xd8], 0
call fcn.00405e40
test edi, edi
je 0x421765
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420f57
sub ecx, edx
sar ecx, 1
je 0x421765
push str._FROM_SELF
lea ecx, [esp + 0xc4]
call fcn.00406270
test al, al
je 0x420f8d
call fcn.00415450
mov dword [eax + 0x68], 1
call fcn.00415450
mov ecx, eax
call fcn.004195b0
test al, al
je 0x420fdb
push str.update_has_already_been_running_
push str.update
push 0x44
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.00415450
mov dword [eax + 0x54], 2
call fcn.00415450
mov ecx, eax
call fcn.004189f0
jmp 0x42179e
xorps xmm0, xmm0
mov dword [esp + 0xb0], 0
push 0xffffffffffffffff
movaps xmmword [esp + 0xa4], xmm0
lea ecx, [esp + 0xa4]
push 0x4aebf4
movaps xmmword [esp + 0xa8], xmm0
mov dword [esp + 0xb8], 0
call fcn.00405e40
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
push edi
lea ecx, [esp + 0x88]
mov dword [esp + 0x84], 0
mov dword [esp + 0x1c], 0
movups xmmword [esp + 0x88], xmm0
mov dword [esp + 0x98], 0
call fcn.00405e40
mov ecx, dword [esp + 0x80]
test ecx, ecx
je 0x42108a
cmp word [ecx], 0
je 0x42108a
sub esp, 8
lea edx, [esp + 0x94]
call fcn.004237d0
mov eax, dword [esp + 0x94]
add esp, 8
test eax, eax
je 0x42108a
cmp byte [eax], 0
jne 0x42108f
mov eax, 0x4afda8
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00403b60
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
call fcn.00415450
add esp, 4
mov ecx, eax
call fcn.00415b90
test eax, eax
lea ecx, [esp + 0x80]
sete byte [esp + 0x13]
call fcn.00405df0
cmp byte [esp + 0x13], 0
je 0x421122
push str.Cmd_line_error
push str.update
push 0x51
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.00415450
mov dword [eax + 0x54], 1
call fcn.00415450
mov ecx, eax
call fcn.004189f0
lea ecx, [esp + 0xa0]
xor esi, esi
call fcn.00405df0
jmp 0x4217a0
call fcn.00415450
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x58], ecx
call fcn.00415450
mov ecx, dword [esp + 0x14]
push str.check_param_success_
push str.update
push 0x67
push str.uiWechatUpdate.cpp
push 2
mov dword [eax + 0x5c], ecx
call fcn.0040e400
push eax
call fcn.00402c30
mov ecx, dword [esp + 0x94]
add esp, 0x18
call fcn.004217e0
push 0x64
push 0x4d1890
push 0x67
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
call esi
push 0x64
push 0x4d17c8
push 0x6d
push dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x18]
call fcn.00435287
push ecx
call fcn.0044045f
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
call fcn.00420e40
mov byte [esp + 0x13], 0
call fcn.004294a0
test al, al
je 0x4214dd
push str.need_Admin_Privileges
push str.update
push 0x79
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.0042c4c0
test eax, eax
jne 0x4214b9
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [esp + 0x94], eax
push edi
lea ecx, [esp + 0x88]
movaps xmmword [esp + 0x88], xmm0
call fcn.00405b70
push str._FROM_SELF
lea ecx, [esp + 0x84]
call fcn.00406270
test al, al
je 0x421277
push str.Elevate_to_Admin_Privileges_failed_
push str.update
push 0x7d
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.0042e2a0
test al, al
je 0x421266
push 0x3f4
lea ecx, [esp + 0xa4]
call fcn.00406500
call fcn.00415450
mov dword [eax + 0x54], 0xa
lea ecx, [esp + 0x80]
call fcn.00405df0
jmp 0x4214dd
push str.Elevate_to_Admin_Privileges
push str.update
push 0x86
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
lea eax, [esp + 0x100]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x421266
push 0x38
lea eax, [esp + 0x48]
mov dword [esp + 0x44], 0x3c
push 0
push eax
call fcn.0047e1d0
add esp, 0xc
mov dword [esp + 0x4c], str.runas
lea eax, [esp + 0x100]
lea ecx, [esp + 0xe8]
mov dword [esp + 0x50], eax
push edi
call fcn.0040e510
push str._FROM_SELF
lea ecx, [esp + 0xec]
call fcn.00421a90
cmp dword [esp + 0xfc], 8
lea eax, [esp + 0xe8]
mov dword [esp + 0x5c], 1
cmovae eax, dword [esp + 0xe8]
mov dword [esp + 0x54], eax
lea eax, [esp + 0xe8]
cmovae eax, dword [esp + 0xe8]
push eax
push str.lanch_self_cmd:__S
push str.update
push 0x92
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x1c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x42146a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x4c7
jne 0x4213f4
push str.cancelled_elevation
push str.update
push 0x97
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.0042e2a0
test al, al
je 0x421450
push 0x3f4
lea ecx, [esp + 0xa4]
call fcn.00406500
mov byte [esp + 0x13], 1
call fcn.00415450
mov dword [eax + 0x6c], 1
call fcn.00415450
lea ecx, [esp + 0xe8]
mov dword [eax + 0x54], 0xa
call fcn.0040e4d0
lea ecx, [esp + 0x80]
call fcn.00405df0
jmp 0x4214dd
call fcn.0042e2a0
test al, al
je 0x421426
push 0x3f4
lea ecx, [esp + 0xa4]
call fcn.00406500
call fcn.00415450
mov dword [eax + 0x6c], 0
call fcn.00415450
mov dword [eax + 0x54], 0xa
push esi
push str.lanch_self_error:__d
push str.update
push 0xa9
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x1c
mov byte [esp + 0x13], 0
lea ecx, [esp + 0xe8]
call fcn.0040e4d0
lea ecx, [esp + 0x80]
call fcn.00405df0
jmp 0x4214dd
push str.exit_current_instance_for_the_elevation.
push str.update
push 0xad
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
lea ecx, [esp + 0xe8]
call fcn.0040e4d0
lea ecx, [esp + 0x80]
call fcn.00405df0
lea ecx, [esp + 0xa0]
xor esi, esi
call fcn.00405df0
jmp 0x4217a0
push str.already_have_admin_privileges
push str.update
push 0xb3
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
push str.start_update_
push str.update
push 0xb7
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
push 0x2f4
call fcn.00465409
add esp, 0x1c
mov esi, eax
push 0x2f4
push 0
push esi
call fcn.0047e1d0
add esp, 0xc
mov ecx, esi
call fcn.00421ce0
sub esp, 0x14
mov esi, eax
lea eax, [esp + 0xb4]
mov ecx, esp
push eax
call fcn.00405bb0
mov ecx, esi
call fcn.00422ce0
mov al, byte [esp + 0x13]
mov ecx, esi
push 0
push 0x320
push 0x258
push 0
push 0
push 0x60000
push 0x10cf0000
mov byte [esi + 0x2e8], al
mov eax, dword [esi]
push str.wechat_update
push 0
call dword [eax + 0x94]
mov ecx, esi
call fcn.00439765
push ecx
mov ecx, esi
call fcn.00439893
mov edi, dword [esp + 0x1c]
cmp edi, 0xc8
jne 0x421599
cmp dword [esp + 0x14], 0x3eb
jne 0x4215a0
cmp byte [esp + 0x13], 0
je 0x4215c8
push str.silent_update
push str.update
push 0xc2
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
push 0
jmp 0x4215ca
push 5
mov ecx, esi
call fcn.00439635
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x6d
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push 0
push eax
call esi
test eax, eax
je 0x421643
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x42162e
lea eax, [esp + 0x24]
push eax
call edi
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call esi
test eax, eax
jne 0x421605
mov edi, dword [esp + 0x1c]
call fcn.00415450
mov esi, eax
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x421671
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0xe8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xe8], 0
push dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
push esi
push str.runType:__d__msg.wParam:__d
push 0x4b75f0
push 0xd4
push str.uiWechatUpdate.cpp
push 1
call fcn.0040e400
push eax
call fcn.00402c30
mov eax, dword [esp + 0x4c]
add esp, 0x20
cmp esi, 0x3ea
je 0x4216e0
cmp eax, 1
jne 0x4216e0
push str.quit_and_start_wechat.exe
push 0x4b75f0
push 0xd6
push str.uiWechatUpdate.cpp
push eax
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.00415450
mov ecx, eax
call fcn.00418af0
jmp 0x421723
cmp edi, 0xc8
je 0x421723
cmp eax, 2
jne 0x421723
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push str.http:__weixin.qq.com_
push str.open
push 0
call esi
cmp eax, 0x20
jg 0x421723
push 1
push 0
push str.http:__weixin.qq.com_
push str.iexplore.exe
push str.open
push 0
call esi
push str.wechat_update_run_end._r_n
push str.update
push 0xe2
push str.uiWechatUpdate.cpp
push 2
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
call fcn.00415450
mov ecx, eax
call fcn.004189f0
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0xa0]
call fcn.00405df0
jmp 0x4217a0
call fcn.00415450
mov dword [eax + 0x54], 1
call fcn.00415450
mov ecx, eax
call fcn.004189f0
push str.Cmd_line_is_null_or_empty_error
push str.update
push 0x39
push str.uiWechatUpdate.cpp
push 4
call fcn.0040e400
push eax
call fcn.00402c30
add esp, 0x18
xor esi, esi
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x4217b4
push eax
call fcn.00480a27
add esp, 4
mov ecx, dword [esp + 0xcc]
test ecx, ecx
je 0x4217c8
push ecx
call fcn.00480a27
add esp, 4
mov ecx, dword [esp + 0x30c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00464f19
mov esp, ebp
pop ebp
ret 0x10