Function at 0x4051e0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xebc
mov eax, dword [0x440014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, 0x20a
xor ecx, ecx
lea esi, [ebp - 0x21a]
push eax
push ecx
push esi
call fcn.00414cd0
add esp, 0xc
mov ebx, 0x104
mov edi, 0x4420d0
push ebx
push edi
push esi
call fcn.00412348
add esp, 0xc
lea esi, [ebp - 0x424]
mov eax, 0x20a
push eax
xor eax, eax
push eax
push esi
call fcn.00414cd0
add esp, 0xc
push ebx
push edi
push esi
call fcn.00412348
add esp, 0xc
push str.updater.ini
push esi
call fcn.00432700
add esp, 8
test eax, eax
je 0x4052ea
lea edi, [ebp - 0x62e]
push esi
push 0x105
push edi
push 0
push str.ExeRelPath
push str.PostUpdateWin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4052ea
lea eax, [ebp - 0x838]
push esi
push 0x105
push eax
push 0
push str.ExeArg
push str.PostUpdateWin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4052ea
push 0x43adfc
push edi
call fcn.0041513b
add esp, 8
test eax, eax
jne 0x4052ea
push 0x43adf6
push edi
call fcn.0041513b
add esp, 8
test eax, eax
jne 0x4052ea
push 0x43ad30
push edi
call fcn.0041513b
add esp, 8
test eax, eax
jne 0x4052ea
push 0x43ad36
push edi
call fcn.0041513b
add esp, 8
test eax, eax
je 0x405303
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412e03
mov eax, ebx
add esp, 0xebc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, word [ebp - 0x62e]
xor ebx, ebx
lea ecx, [eax - 0x2e]
cmp ecx, 2
jb 0x4052ec
cmp eax, 0x5c
je 0x4052ec
lea esi, [ebp - 0xa42]
push 0x20a
push 0
push esi
call fcn.00414cd0
add esp, 0xc
push 0x104
push 0x4420d0
push esi
call fcn.00412348
add esp, 0xc
push edi
push esi
call fcn.00432700
add esp, 8
test eax, eax
je 0x4052ea
push esi
call fcn.00410990
add esp, 4
test al, al
je 0x4052ea
cmp byte [0x4420cc], 0
je 0x405384
push 1
lea eax, [ebp - 0xa42]
push eax
push 0x4420d0
call fcn.0040fb00
add esp, 0xc
test eax, eax
je 0x4052ea
lea eax, [ebp - 0xc4c]
push str.uninstall.update
lea ecx, [ebp - 0xa42]
push ecx
push eax
call fcn.00410c30
add esp, 0xc
test eax, eax
je 0x4052ea
lea eax, [ebp - 0xe56]
push 0x20a
push 0
push eax
call fcn.00414cd0
add esp, 0xc
cmp byte [0x4420cd], 1
jne 0x405516
lea eax, [ebp - 0xe56]
push eax
push 0x43aa48
push 0x4418a4
call fcn.00410e10
add esp, 0xc
test eax, eax
je 0x4052ea
xorps xmm0, xmm0
lea esi, [ebp - 0xe74]
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi], xmm0
push 0xd
push str.argv0ignored
push esi
call fcn.00412348
add esp, 0xc
lea eax, [ebp - 0x838]
push eax
call fcn.0041221b
add esp, 4
mov ebx, eax
push esi
call fcn.0041221b
add esp, 4
add eax, ebx
mov edi, eax
add eax, eax
add eax, 2
push eax
call fcn.00420172
add esp, 4
xor ebx, ebx
test eax, eax
je 0x4052ec
mov ecx, eax
push edi
push esi
mov ebx, eax
push ecx
call fcn.00412348
add esp, 0xc
lea eax, [ebp - 0x838]
push eax
push ebx
call fcn.00420a59
add esp, 8
xor esi, esi
push esi
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0xe56]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xeb8]
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
mov dword [eax], 0x44
mov dword [eax + 8], 0x43ae74
lea ecx, [ebp - 0xec8]
movups xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x21a]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
lea eax, [ebp - 0xa42]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
push ebx
call fcn.0041fc39
add esp, 4
test edi, edi
setne bl
je 0x4052ec
push 0xffffffffffffffff
push dword [ebp - 0xec8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xec8]
call esi
push dword [ebp - 0xec4]
call esi
jmp 0x4052ec
push 0x104
push 0x4418a4
lea esi, [ebp - 0xe56]
push esi
call fcn.00412348
add esp, 0xc
push 0x43aa3c
push esi
call fcn.00432700
add esp, 8
jmp 0x4053e3