Function at 0x40dbf0
Capabilities:
Create directory
Create process on windows
Enumerate processes
Resolve function by parsing pe exports
Terminate process
Terminate process by name
Write and execute a file
Write file on windows

Disassembly:
mov eax, 0x5bb4
call fcn.00412110
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push esi
push edi
lea eax, [esp + 0x1180]
push 0x41d19c
push eax
call ebp
lea ecx, [esp + 0x1180]
push str.update
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0x1180]
push edx
call fcn.0040dad0
add esp, 4
lea eax, [esp + 0x1388]
mov dword [esp + 0x5c], 0x104
push 0x41d600
push eax
call ebp
lea ecx, [esp + 0x1388]
push str.update.json
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea edx, [esp + 0x5c]
push 0x30000000
lea eax, [esp + 0x179c]
push edx
lea ecx, [esp + 0x1390]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_UrlCanonicalizeW]
lea edx, [esp + 0x68]
lea eax, [esp + 0x1798]
push edx
push eax
call fcn.00411ab0
mov esi, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x30a]
mov word [esp + 0x308], 0
add esp, 8
rep stosd dword es:[edi], eax
xor bl, bl
mov dword [esp + 0x54], esi
test esi, esi
mov byte [esp + 0x11], bl
stosw word es:[edi], ax
je 0x40e3fe
push esi
call fcn.0040f7b0
mov ecx, eax
add esp, 4
test ecx, ecx
mov dword [esp + 0x18], ecx
je 0x40e3ad
mov eax, dword [ecx + 4]
cmp eax, 1
jne 0x40dd0a
mov ebp, dword [ecx + 8]
xor eax, eax
test ebp, ebp
jbe 0x40dd0a
mov edx, dword [ecx + 0xc]
mov esi, dword [edx]
mov edi, str.version
mov ecx, 8
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40dd58
inc eax
add edx, 8
cmp eax, ebp
jb 0x40dcf0
mov eax, 0x41d5b0
mov eax, dword [eax + 8]
mov ecx, dword [esp + 0x5bc8]
cmp eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
setg byte [esp + 0x13]
cmp eax, 1
jne 0x40dd76
mov ebp, dword [ecx + 8]
xor eax, eax
test ebp, ebp
jbe 0x40dd76
mov edx, dword [ecx + 0xc]
mov esi, dword [edx]
mov edi, str.files
mov ecx, 6
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x40dd65
inc eax
add edx, 8
cmp eax, ebp
jb 0x40dd3c
jmp 0x40dd76
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0xc]
mov eax, dword [ecx + eax*8 + 4]
jmp 0x40dd0f
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + eax*8 + 4]
mov dword [esp + 0x14], eax
jmp 0x40dd7e
mov dword [esp + 0x14], 0x41d5b0
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 4], 1
jne 0x40e392
mov edx, dword [ecx + 8]
xor eax, eax
test edx, edx
mov dword [esp + 0x2c], eax
jbe 0x40e392
mov ecx, dword [ecx + 0xc]
mov ebx, 5
mov ebp, dword [ecx + eax*8 + 4]
mov esi, dword [ecx + eax*8]
lea eax, [ecx + eax*8]
cmp dword [ebp + 4], ebx
jne 0x40e37a
lea edx, [esp + 0x918]
push 0x41d19c
push edx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0xf8]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [esp + 0xf8]
lea edx, [esp + 0x918]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x85]
mov byte [esp + 0x84], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x84]
lea ecx, [esp + 0x918]
push eax
push ecx
call fcn.0040cf20
add esp, 8
test al, al
jne 0x40e261
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea edx, [esp + 0x918]
push 0x41cf94
push edx
call ebp
test eax, eax
sete bl
test bl, bl
mov byte [esp + 0x12], bl
je 0x40def1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40def1
lea eax, [esp + 0xd4c]
mov dword [esp + 0xd4c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40def1
lea ecx, [esp + 0xd70]
lea edx, [esp + 0xf8]
push ecx
push edx
call ebp
test eax, eax
jne 0x40ded8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0xd54]
cmp ecx, eax
je 0x40ded8
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40ded8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xd4c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40de8d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x11]
lea ecx, [esp + 0xf8]
lea edx, [esp + 0xf78]
or al, bl
push ecx
push edx
mov byte [esp + 0x19], al
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
lea eax, [esp + 0xf78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [esp + 0xf78]
push 0x41c6a4
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xf78]
push edx
push eax
push 0x41d600
lea ecx, [esp + 0x19ac]
push str._s_ld__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea edx, [esp + 0x64]
lea eax, [esp + 0x1590]
lea ecx, [esp + 0x19a0]
push 0x30000000
push edx
push eax
push ecx
mov dword [esp + 0x74], 0x104
call dword [sym.imp.SHLWAPI.dll_UrlCanonicalizeW]
lea edx, [esp + 0x44]
lea eax, [esp + 0x1590]
push edx
push eax
call fcn.00411ab0
mov ebp, eax
xor ebx, ebx
add esp, 8
cmp ebp, ebx
mov dword [esp + 0x40], ebp
je 0x40e37a
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x78]
push ecx
push ebp
push edx
mov dword [esp + 0x30], fcn.00415010
mov dword [esp + 0x34], fcn.00415030
mov dword [esp + 0x58], 0x415040
mov dword [esp + 0x5c], 0x415060
call fcn.00414e70
lea eax, [esp + 0x7c]
push eax
call fcn.00414f00
lea ecx, [esp + 0x1bb8]
push ebx
push ecx
call fcn.00414c60
lea eax, [esp + 0x1bc0]
lea edx, [esp + 0x88]
push eax
mov dword [esp + 0x1bd4], edx
call fcn.00414e00
add esp, 0x1c
call fcn.00414a40
lea ecx, [esp + 0xa8]
push ecx
call fcn.00412610
lea edx, [esp + 0x50]
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x1bb0]
push eax
lea edx, [esp + 0xb4]
push ecx
push edx
call fcn.00412770
add esp, 0x14
test eax, eax
jne 0x40e241
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x60], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], ebx
jbe 0x40e230
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x1c]
push 0
lea edx, [esp + 0xac]
push ebx
push edx
lea esi, [ecx + eax]
call fcn.00412730
add eax, eax
push eax
push 0
call fcn.00415010
mov edi, eax
add esp, 0x14
test edi, edi
je 0x40e230
push edi
lea ecx, [esp + 0xac]
push ebx
push ecx
call fcn.00412730
mov al, byte [esi + 0x19]
add esp, 0xc
test al, al
jne 0x40e20a
xor eax, eax
lea edx, [esp + 0x4c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x5c]
push eax
lea edx, [esp + 0x44]
push ecx
lea eax, [esp + 0x44]
push edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x74]
push ecx
push edx
lea eax, [esp + 0x1bc4]
push ebx
lea ecx, [esp + 0xc8]
push eax
push ecx
call fcn.004147e0
add esp, 0x28
test eax, eax
jne 0x40e230
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x508]
push edi
push edx
call ebp
lea eax, [esp + 0x508]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [esp + 0x34], 0xa
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x508]
push 0
push ecx
call esi
lea edx, [esp + 0x710]
push 0x41d19c
push edx
call ebp
mov al, byte [esp + 0x12]
test al, al
je 0x40e17b
lea eax, [esp + 0x710]
push 0x41c6c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x710]
push 0
push ecx
call esi
lea edx, [esp + 0x710]
push edi
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov al, byte [esp + 0x12]
test al, al
je 0x40e1a4
lea eax, [esp + 0x710]
lea ecx, [esp + 0x300]
push eax
push ecx
call ebp
push 0
push 0x80
push 2
push 0
push 1
lea edx, [esp + 0x724]
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e1d8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e1f7
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push 0
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
dec eax
mov dword [esp + 0x34], eax
jne 0x40e133
mov ebp, dword [esp + 0x40]
push edi
push 0
call fcn.00415030
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xcc]
add esp, 8
inc ebx
add ecx, 0x20
cmp ebx, eax
mov dword [esp + 0x1c], ecx
jb 0x40e06c
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [esp + 0x30]
add esp, 8
lea edx, [esp + 0x24]
lea eax, [esp + 0xa8]
push edx
push eax
call fcn.00412640
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
jmp 0x40e37a
mov al, byte [esp + 0x13]
test al, al
je 0x40e37a
cmp dword [ebp + 4], ebx
je 0x40e279
mov ebp, 0x41cf84
jmp 0x40e27c
mov ebp, dword [ebp + 0xc]
lea ecx, [esp + 0x84]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40e37a
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
lea edx, [esp + 0x918]
push 0x41cf94
push edx
call ebp
test eax, eax
sete bl
test bl, bl
mov byte [esp + 0x48], bl
je 0x40e34e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40e34e
lea eax, [esp + 0xb20]
mov dword [esp + 0xb20], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40e34e
lea ecx, [esp + 0xb44]
lea edx, [esp + 0xf8]
push ecx
push edx
call ebp
test eax, eax
jne 0x40e335
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0xb28]
cmp ecx, eax
je 0x40e335
push ecx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40e335
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xb20]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40e2ea
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x11]
mov ecx, dword [esp + 0x30]
or al, bl
lea edx, [esp + 0x300]
mov byte [esp + 0x11], al
mov eax, dword [esp + 0x48]
push ecx
push edx
lea ecx, [esp + 0x100]
push eax
push ecx
call fcn.0040e410
add esp, 0x10
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
inc eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x2c], eax
cmp eax, edx
jb 0x40dd9d
mov edx, dword [esp + 0x18]
push edx
call fcn.0040f7e0
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov bl, byte [esp + 0x15]
mov esi, dword [esp + 0x58]
add esp, 4
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
je 0x40e3fe
lea eax, [esp + 0x300]
lea ecx, [esp + 0x508]
push eax
push ecx
call ebp
lea edx, [esp + 0x508]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x508]
push 1
push eax
lea ecx, [esp + 0x308]
push str.force
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x5bb4
ret