Function at 0x439660
Capabilities:
Create process on windows
Delete file
Download and write a file
Download url
Get file size
Parse pe header
Read file on windows
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b4cbf
mov eax, dword fs:[0]
push eax
mov eax, 0x1784
call fcn.00570340
mov eax, dword [0x61f138]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x8a1], cl
push 0x104
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.00585f4e
lea edx, [ebp - 0x420]
add esp, 8
lea ecx, [eax + 2]
sub edx, ecx
jmp 0x4396e0
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4396e0
lea eax, [ebp - 0x420]
push 0x2e
push eax
call fcn.00585f4e
xor ecx, ecx
push 0x5c
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
call fcn.00585f4e
xor ecx, ecx
add esp, 8
mov word [eax + 2], cx
lea ecx, [ebp - 0x9d0]
call fcn.00442390
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x9c0]
call fcn.00442d30
lea eax, [ebp - 0x510]
push eax
lea ecx, [ebp - 0x9b8]
call fcn.004466f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x218]
xor eax, eax
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 7
lea edx, [ecx + 2]
mov word [ebp - 0x4c8], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439777
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4c8]
call fcn.00445cb0
push str._version
lea edx, [ebp - 0x4c8]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x528]
call fcn.0044a240
add esp, 4
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0x498]
call fcn.0044a330
add esp, 4
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x514]
cmp edx, 8
jb 0x439815
mov ecx, dword [ebp - 0x528]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43980b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ae0a
push edx
push ecx
call fcn.0056eec5
add esp, 8
xor eax, eax
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x514], 7
mov word [ebp - 0x528], ax
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x4b4]
cmp edx, 8
jb 0x439876
mov ecx, dword [ebp - 0x4c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43986c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ae0f
push edx
push ecx
call fcn.0056eec5
add esp, 8
xor eax, eax
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x4fc]
cmp edx, 8
jb 0x4398d7
mov ecx, dword [ebp - 0x510]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4398cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ae14
push edx
push ecx
call fcn.0056eec5
add esp, 8
xor eax, eax
mov dword [ebp - 0x500], 0
push str.build_number
lea edx, [ebp + 8]
mov dword [ebp - 0x4fc], 7
lea ecx, [ebp - 0x540]
mov word [ebp - 0x510], ax
call fcn.0044a170
add esp, 4
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x498]
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x540]
push 0
cmovae ecx, dword [ebp - 0x498]
cmp dword [ebp - 0x52c], 8
push 0
cmovae eax, dword [ebp - 0x540]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x439a29
sub esp, 8
lea ecx, [ebp - 0xa80]
call fcn.00443510
mov edx, str.UPDATER:_cant_download_build_version
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa70]
call fcn.00449a40
lea eax, [ebp - 0x588]
push eax
lea ecx, [ebp - 0xa80]
call fcn.004433d0
push 0x17c
mov edx, 0x5ec93c
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.004c2da0
mov edx, dword [ebp - 0x574]
add esp, 4
cmp edx, 0x10
jb 0x4399d2
mov ecx, dword [ebp - 0x588]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4399c8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ae19
push edx
push ecx
call fcn.0056eec5
add esp, 8
lea ecx, [ebp - 0xa80]
call fcn.0043aef0
mov esi, 2
lea ecx, [ebp - 0x540]
call fcn.00445c30
lea ecx, [ebp - 0x498]
call fcn.00445c30
lea ecx, [ebp - 0x9d0]
call fcn.0043ae30
lea ecx, [ebp + 8]
call fcn.00445c30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056eeb4
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
push 0
cmovae eax, dword [ebp - 0x498]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4399dd
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x439a94
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
cmovae eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4399dd
xor eax, eax
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
mov byte [ebp - 4], 0xc
test esi, esi
jne 0x439ac9
mov dword [ebp - 0x4a0], esi
mov word [ebp + esi*2 - 0x4b0], ax
jmp 0x439ad7
push 0
push esi
lea ecx, [ebp - 0x4b0]
call fcn.00445e00
cmp dword [ebp - 0x49c], 8
lea ecx, [ebp - 0x8a8]
push 0
push ecx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x8a8], 0
cmovae eax, dword [ebp - 0x4b0]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
cmp dword [ebp - 0x484], 8
lea eax, [ebp - 0x498]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmovae eax, dword [ebp - 0x498]
push eax
call edi
cmp dword [ebp - 0x8a8], esi
je 0x439b3f
mov esi, 2
jmp 0x43adc5
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c0], 0
push 1
sub esp, 0x14
mov byte [ebp - 4], 0xd
mov edx, 0x5e2f34
mov ecx, esp
call fcn.0044a3e0
lea edx, [ebp - 0x4b0]
lea ecx, [ebp - 0x8c8]
call fcn.0044a420
mov ecx, dword [ebp - 0x8c4]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x8c8]
add esp, 0x18
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x439bb4
mov esi, 2
jmp 0x43adba
cmp dword [esi + 0x2c], 8
lea eax, [esi + 0x18]
jb 0x439bbf
mov eax, dword [eax]
push eax
call fcn.0059826e
add esp, 4
cmp eax, 0xce9
je 0x43adb8
lea ecx, [ebp - 0x8c8]
call fcn.00444a40
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 4], 9
call fcn.00445c30
cmp byte [ebp - 0x8a1], 0
je 0x439c00
mov esi, 1
jmp 0x4399e2
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x9b8]
call fcn.004466f0
push 0x5e2f44
lea ecx, [ebp - 0x738]
mov byte [ebp - 4], 0xe
call fcn.00441310
mov esi, eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x720]
call fcn.00441310
push esi
mov edx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x708]
call fcn.0044a330
add esp, 4
lea ecx, [ebp - 0x5a0]
mov byte [ebp - 4], 0x11
push ecx
mov edx, eax
lea ecx, [ebp - 0x6f0]
call fcn.0044a330
add esp, 4
push 0x5e2f38
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x438]
call fcn.0044a240
add esp, 4
lea ecx, [ebp - 0x6f0]
call fcn.00445c30
lea ecx, [ebp - 0x708]
call fcn.00445c30
lea ecx, [ebp - 0x720]
call fcn.00445c30
lea ecx, [ebp - 0x738]
call fcn.00445c30
lea ecx, [ebp - 0x5a0]
mov byte [ebp - 4], 0x18
call fcn.00445c30
push 0x5e2f5c
lea edx, [ebp + 8]
lea ecx, [ebp - 0x570]
call fcn.0044a170
add esp, 4
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x438]
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x570]
push 0
cmovae ecx, dword [ebp - 0x438]
cmp dword [ebp - 0x55c], 8
push 0
cmovae eax, dword [ebp - 0x570]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x439d82
sub esp, 8
lea ecx, [ebp - 0x1160]
call fcn.00443510
mov edx, str.UPDATER:_cant_download_temporary_exe
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x1150]
call fcn.00449a40
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x1160]
call fcn.004433d0
push 0x1b1
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x1b
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x750]
call fcn.004414e0
lea ecx, [ebp - 0x1160]
call fcn.0043aef0
mov esi, 3
jmp 0x43ad9d
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push 0
cmovae eax, dword [ebp - 0x438]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x439e22
sub esp, 8
lea ecx, [ebp - 0xb30]
call fcn.00443510
mov edx, str.UPDATER:_cant_open_temporary_exe
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xb20]
call fcn.00449a40
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0xb30]
call fcn.004433d0
push 0x1b6
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x1d
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x768]
call fcn.004414e0
lea ecx, [ebp - 0xb30]
call fcn.0043aef0
mov esi, 3
jmp 0x43ad9d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x8a8], eax
cmp eax, 0xffffffff
jne 0x439ed1
sub esp, 8
lea ecx, [ebp - 0xbe0]
call fcn.00442390
mov edx, str.UPDATER:_cant_open_loaded_file:
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xbd0]
call fcn.0044a500
lea edx, [ebp - 0x438]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0xbc8]
call fcn.004466f0
push 0x1bd
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x5b8]
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x5b8]
call fcn.00445c30
lea ecx, [ebp - 0xbe0]
call fcn.0043ae30
push esi
call ebx
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
mov esi, 3
jmp 0x43ad9d
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
push 0
push eax
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0x20
call fcn.00441450
cmp dword [ebp - 0x46c], 0x10
lea ecx, [ebp - 0x8b8]
push 0
push ecx
push dword [ebp - 0x8a8]
lea eax, [ebp - 0x480]
mov dword [ebp - 0x8b8], 0
cmovae eax, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call ebx
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
mov eax, dword [ebp - 0x8a8]
cmp dword [ebp - 0x8b8], eax
je 0x439fd8
sub esp, 8
lea ecx, [ebp - 0xc90]
call fcn.00442390
mov edx, str.Updater:_Error_loading_new_executable_from_disk:
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xc80]
call fcn.0044a500
lea edx, [ebp - 0x438]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x5d0]
push eax
lea ecx, [ebp - 0xc78]
call fcn.004466f0
push 0x1cc
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5d0]
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x5d0]
call fcn.00445c30
lea ecx, [ebp - 0xc90]
call fcn.0043ae30
mov esi, 3
jmp 0x43ad92
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
lea edx, [ebp - 0x468]
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x480]
call fcn.004394e0
test al, al
jne 0x43a06e
sub esp, 8
lea ecx, [ebp - 0xd40]
call fcn.00443510
mov edx, str.Updater:_Error_decompressing_file.
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xd30]
call fcn.00449a40
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0xd40]
call fcn.004433d0
push 0x1d3
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x25
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x780]
call fcn.004414e0
lea ecx, [ebp - 0xd40]
jmp 0x43ad7d
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push 0
cmovae eax, dword [ebp - 0x438]
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ad20
cmp dword [ebp - 0x454], 0x10
lea eax, [ebp - 0x8ac]
push 0
push eax
push dword [ebp - 0x458]
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x8ac], 0
cmovae ecx, dword [ebp - 0x468]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
mov eax, dword [ebp - 0x8ac]
cmp eax, dword [ebp - 0x458]
je 0x43a16a
sub esp, 8
lea ecx, [ebp - 0xdf0]
call fcn.00443510
mov edx, str.UPDATER:_cant_write_uncompressed_data
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0xde0]
call fcn.00449a40
lea eax, [ebp - 0x798]
push eax
lea ecx, [ebp - 0xdf0]
call fcn.004433d0
push 0x1e0
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x27
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x798]
call fcn.004414e0
lea ecx, [ebp - 0xdf0]
call fcn.0043aef0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
jmp 0x43ad82
lea eax, [ebp - 0x5e8]
push eax
lea ecx, [ebp - 0x9b8]
call fcn.004466f0
push 0x5e30e0
lea ecx, [ebp - 0x7f8]
mov byte [ebp - 4], 0x2a
call fcn.00441310
mov esi, eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x7e0]
call fcn.00441310
push esi
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x7c8]
call fcn.0044a330
add esp, 4
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0x2d
push ecx
mov edx, eax
lea ecx, [ebp - 0x7b0]
call fcn.0044a330
add esp, 4
push 0x5e2f38
mov edx, eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x450]
call fcn.0044a240
add esp, 4
lea ecx, [ebp - 0x7b0]
call fcn.00445c30
lea ecx, [ebp - 0x7c8]
call fcn.00445c30
lea ecx, [ebp - 0x7e0]
call fcn.00445c30
lea ecx, [ebp - 0x7f8]
call fcn.00445c30
lea ecx, [ebp - 0x5e8]
mov byte [ebp - 4], 0x34
call fcn.00445c30
push str.updater
lea edx, [ebp + 8]
lea ecx, [ebp - 0x558]
call fcn.0044a170
add esp, 4
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x558]
push 0
cmovae ecx, dword [ebp - 0x450]
cmp dword [ebp - 0x544], 8
push 0
cmovae eax, dword [ebp - 0x558]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
je 0x43a2f8
sub esp, 8
lea ecx, [ebp - 0xea0]
call fcn.00442390
mov edx, str.UPDATER:_cant_download_updater:
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xe90]
call fcn.0044a500
lea edx, [ebp - 0x450]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0xe88]
call fcn.004466f0
push 0x1f3
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x600]
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x600]
call fcn.00445c30
lea ecx, [ebp - 0xea0]
call fcn.0043ae30
jmp 0x43acec
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
push 0
cmovae eax, dword [ebp - 0x450]
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43a3a0
sub esp, 8
lea ecx, [ebp - 0xf50]
call fcn.00442390
mov edx, str.UPDATER:_cant_download_updater:
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0xf40]
call fcn.0044a500
lea edx, [ebp - 0x450]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xf50]
call fcn.00442370
push 0x1fb
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x39
mov ecx, eax
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x810]
call fcn.00445c30
lea ecx, [ebp - 0xf50]
call fcn.0043ae30
jmp 0x43acec
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x8ac], eax
cmp eax, 0xffffffff
jne 0x43a446
sub esp, 8
lea ecx, [ebp - 0x1000]
call fcn.00442390
mov edx, str.UPDATER:_cant_get_updater_file_size
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0xff0]
call fcn.0044a500
lea edx, [ebp - 0x450]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x1000]
call fcn.00442370
push 0x203
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x3b
mov ecx, eax
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x828]
call fcn.00445c30
lea ecx, [ebp - 0x1000]
call fcn.0043ae30
push esi
call ebx
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push eax
call edi
jmp 0x43acec
push 0
push eax
lea ecx, [ebp - 0x480]
call fcn.00441450
cmp dword [ebp - 0x46c], 0x10
lea ecx, [ebp - 0x8b8]
push 0
push ecx
push dword [ebp - 0x8ac]
lea eax, [ebp - 0x480]
cmovae eax, dword [ebp - 0x480]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call ebx
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
push eax
call edi
mov eax, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8b8], eax
je 0x43a51b
sub esp, 8
lea ecx, [ebp - 0x10b0]
call fcn.00442390
mov edx, str.Updater:_Error_loading_new_executable_from_disk:
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x10a0]
call fcn.0044a500
lea edx, [ebp - 0x450]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x10b0]
call fcn.00442370
push 0x211
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x3d
mov ecx, eax
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x840]
call fcn.00445c30
lea ecx, [ebp - 0x10b0]
call fcn.0043ae30
jmp 0x43acec
cmp dword [ebp - 0x454], 0x10
lea eax, [ebp - 0x468]
mov dword [ebp - 0x458], 0
lea edx, [ebp - 0x468]
cmovae eax, dword [ebp - 0x468]
lea ecx, [ebp - 0x480]
mov byte [eax], 0
call fcn.004394e0
test al, al
jne 0x43a5b3
sub esp, 8
lea ecx, [ebp - 0x1790]
call fcn.00443510
mov edx, str.Updater:_Error_decompressing_updater_file.
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x1780]
call fcn.00449a40
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x1790]
call fcn.004433d0
push 0x219
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x3f
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x858]
call fcn.004414e0
lea ecx, [ebp - 0x1790]
jmp 0x43ace7
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
push 0
cmovae eax, dword [ebp - 0x450]
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ac8a
cmp dword [ebp - 0x454], 0x10
lea eax, [ebp - 0x8bc]
push 0
push eax
push dword [ebp - 0x458]
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x8bc], 0
cmovae ecx, dword [ebp - 0x468]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
mov eax, dword [ebp - 0x8bc]
cmp eax, dword [ebp - 0x458]
je 0x43a6c7
sub esp, 8
lea ecx, [ebp - 0x1210]
call fcn.00443510
mov edx, str.UPDATER:_cant_write_uncompressed_updater
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x1200]
call fcn.00449a40
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x1210]
call fcn.004433d0
push 0x227
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x41
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x870]
call fcn.004414e0
lea ecx, [ebp - 0x1210]
call fcn.0043aef0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
jmp 0x43ad00
push 0x38
lea eax, [ebp - 0x918]
mov dword [ebp - 0x91c], 0x3c
push 0
push eax
call fcn.00586880
add esp, 0xc
mov dword [ebp - 0x910], 0
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x4e0]
push eax
call fcn.00441370
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x4e0]
cmp dword [ebp - 0x4cc], 8
lea ecx, [ebp - 0x8a0]
mov bl, byte [0x6c4d9c]
cmovae eax, dword [ebp - 0x4e0]
push 0x5e3220
mov dword [ebp - 0x90c], eax
call fcn.00441310
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 0x45
push ecx
mov edx, eax
lea ecx, [ebp - 0x888]
call fcn.0044a240
add esp, 4
push 0x5e3220
mov edx, eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x4f8]
call fcn.0044a240
add esp, 4
lea ecx, [ebp - 0x888]
call fcn.00445c30
lea ecx, [ebp - 0x8a0]
mov byte [ebp - 4], 0x49
call fcn.00445c30
push 0x6aac84
mov edx, 0x5e3224
lea ecx, [ebp - 0x630]
call fcn.00449ce0
add esp, 4
mov byte [ebp - 4], 0x4a
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x43a7a8
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x4f8]
call fcn.00448340
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x49
call fcn.00445c30
cmp byte [0x6c4d9a], 0
jne 0x43a7d7
test bl, bl
je 0x43aa1c
push 0x12
push 0x5e3240
lea ecx, [ebp - 0x4f8]
call fcn.00448340
test bl, bl
je 0x43aa1c
push 0x6d1eec
lea ecx, [ebp - 0x8b0]
call fcn.00441110
push 0x73
mov byte [ebp - 4], 0x4b
call fcn.00451b90
mov byte [ebp - 4], 0x4c
push dword [ebp - 0x8b0]
call fcn.0055d067
add esp, 4
test eax, eax
je 0x43a82b
push eax
call fcn.0055ca85
add esp, 4
sub esp, 8
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x12c0]
call fcn.00443510
mov byte [ebp - 4], 0x4d
mov edx, str.UPDATER:_stopping_and_removing_service._IsRunning_
mov al, byte [0x6c4d9c]
mov byte [ebp - 0x8b0], al
push dword [ebp - 0x8b0]
push ecx
lea ecx, [ebp - 0x12b0]
call fcn.00449a40
add esp, 4
mov ecx, eax
call fcn.00443db0
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x12c0]
call fcn.004433d0
push 0x254
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x4e
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x648]
call fcn.004414e0
lea ecx, [ebp - 0x12c0]
mov byte [ebp - 4], 0x49
call fcn.0043aef0
call fcn.00455c60
call fcn.004558c0
xor esi, esi
lea ecx, [ecx]
cmp byte [0x6c4d9c], 0
je 0x43a8ee
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x8e0], 0x64
mov dword [ebp - 0x8dc], 0
call fcn.0044a7d0
inc esi
cmp esi, 0x64
jl 0x43a8c0
sub esp, 8
cmp esi, 0x64
jne 0x43a9a8
lea ecx, [ebp - 0x1370]
call fcn.00443510
mov byte [ebp - 4], 0x4f
mov edx, str.UPDATER:_error_stopping_and_or_removing_service._IsRunning_
mov al, byte [0x6c4d9c]
mov byte [ebp - 0x8b0], al
push dword [ebp - 0x8b0]
push ecx
lea ecx, [ebp - 0x1360]
call fcn.00449a40
add esp, 4
mov ecx, eax
call fcn.00443db0
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x1370]
call fcn.004433d0
push 0x262
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x50
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x660]
call fcn.004414e0
lea ecx, [ebp - 0x1370]
call fcn.0043aef0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
cmp dword [ebp - 0x4cc], 8
lea eax, [ebp - 0x4e0]
cmovae eax, dword [ebp - 0x4e0]
push eax
call edi
jmp 0x43ac6a
lea ecx, [ebp - 0x1420]
call fcn.00443510
push esi
push ecx
mov edx, str.UPDATER:_service_terminated
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x1410]
call fcn.00449a40
add esp, 4
mov ecx, eax
call fcn.00443c10
lea eax, [ebp - 0x678]
push eax
lea ecx, [ebp - 0x1420]
call fcn.004433d0
push 0x267
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x52
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x678]
call fcn.004414e0
lea ecx, [ebp - 0x1420]
mov byte [ebp - 4], 0x49
call fcn.0043aef0
call fcn.004393d0
cmp dword [ebp - 0x4e4], 8
lea eax, [ebp - 0x4f8]
mov dword [ebp - 0x914], 0
cmovae eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x908], eax
lea eax, [ebp - 0x91c]
push eax
mov dword [ebp - 0x900], 1
mov dword [ebp - 0x918], 0x100
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sub esp, 8
test eax, eax
je 0x43ab94
lea ecx, [ebp - 0x14d0]
call fcn.00442390
mov edx, str.UPDATER:_started_with_args:
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x14c0]
call fcn.0044a500
lea edx, [ebp - 0x4f8]
mov ecx, eax
call fcn.0044a7b0
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0x14d0]
call fcn.00442370
push 0x272
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x54
mov ecx, eax
call fcn.004c37b0
add esp, 4
lea ecx, [ebp - 0x690]
call fcn.00445c30
lea ecx, [ebp - 0x14d0]
mov byte [ebp - 4], 0x49
call fcn.0043ae30
cmp dword [0x6c4d88], 0
jle 0x43ab8a
lea ecx, [ebp - 0x8d4]
call fcn.00456850
mov byte [ebp - 4], 0x55
lea eax, [ebp - 0x8a0]
push dword [ebp - 0x8b4]
mov byte [ebp - 0x8a1], 0x66
push eax
lea eax, [ebp - 0x8a1]
push eax
push dword [ebp - 0x8d0]
call fcn.00465ce0
push str.fromInterface
lea ecx, [ebp - 0x618]
call fcn.00441310
lea edx, [ebp - 0x618]
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x8b4]
call fcn.004fac70
mov byte [ebp - 4], 0x57
mov edx, dword [ebp - 0x8d4]
mov ecx, dword [ebp - 0x8d0]
sub ecx, edx
push ecx
push edx
mov ecx, eax
call fcn.004faf10
lea ecx, [ebp - 0x8b4]
call fcn.004fae30
lea ecx, [ebp - 0x618]
call fcn.00445c30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x8d4]
call fcn.0043afb0
mov esi, 4
jmp 0x43ac6f
lea ecx, [ebp - 0x1580]
call fcn.00443510
mov edx, str.UPDATER:_error_executing___rolling_back_update_state
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x1570]
call fcn.00449a40
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x1580]
call fcn.004433d0
push 0x27f
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x59
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x6a8]
call fcn.004414e0
lea ecx, [ebp - 0x1580]
mov byte [ebp - 4], 0x49
call fcn.0043aef0
lea ecx, [ebp - 0x438]
call fcn.004411b0
push eax
call edi
lea ecx, [ebp - 0x4e0]
call fcn.004411b0
push eax
call edi
test bl, bl
je 0x43ac6a
call fcn.00455a90
push 0x58
call fcn.0056eed3
mov esi, eax
add esp, 4
mov dword [ebp - 0x8b4], esi
mov ecx, 0x6aacb4
mov byte [ebp - 4], 0x5a
call fcn.004411b0
push eax
mov ecx, esi
call fcn.00451820
mov byte [ebp - 4], 0x49
push 8
mov dword [0x6c4d94], eax
call fcn.0056eed3
mov dword [ebp - 0x8b4], eax
mov ecx, eax
mov byte [ebp - 4], 0x5b
call fcn.0044a8a0
mov dword [0x6c4d90], eax
mov esi, 3
lea ecx, [ebp - 0x4f8]
call fcn.00445c30
lea ecx, [ebp - 0x4e0]
call fcn.00445c30
jmp 0x43ad08
sub esp, 8
lea ecx, [ebp - 0x1630]
call fcn.00443510
mov edx, str.UPDATER:_cant_create_uncompressed_updater
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1620]
call fcn.00449a40
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x1630]
call fcn.004433d0
push 0x22d
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x43
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x6c0]
call fcn.004414e0
lea ecx, [ebp - 0x1630]
call fcn.0043aef0
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
push eax
call edi
mov esi, 3
lea ecx, [ebp - 0x558]
call fcn.00445c30
lea ecx, [ebp - 0x450]
call fcn.00445c30
jmp 0x43ad87
sub esp, 8
lea ecx, [ebp - 0x16e0]
call fcn.00443510
mov edx, str.UPDATER:_cant_open_uncompressed_file
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x16d0]
call fcn.00449a40
lea eax, [ebp - 0x6d8]
push eax
lea ecx, [ebp - 0x16e0]
call fcn.004433d0
push 0x1e7
mov edx, 0x5ec93c
mov byte [ebp - 4], 0x29
mov ecx, eax
call fcn.004c2da0
add esp, 4
lea ecx, [ebp - 0x6d8]
call fcn.004414e0
lea ecx, [ebp - 0x16e0]
call fcn.0043aef0
mov esi, 3
lea ecx, [ebp - 0x468]
call fcn.004414e0
lea ecx, [ebp - 0x480]
call fcn.004414e0
lea ecx, [ebp - 0x570]
call fcn.00445c30
lea ecx, [ebp - 0x438]
call fcn.00445c30
jmp 0x4399e2
xor esi, esi
lea ecx, [ebp - 0x8c8]
call fcn.00444a40
mov edx, dword [ebp - 0x49c]
cmp edx, 8
jb 0x4399e2
mov ecx, dword [ebp - 0x4b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43adfb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ae1e
push edx
push ecx
call fcn.0056eec5
add esp, 8
jmp 0x4399e2
call fcn.00591dc6
call fcn.00591dc6
call fcn.00591dc6
call fcn.00591dc6
call fcn.00591dc6
int3