Function at 0x406f50
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x407159
mov eax, dword [esi + 0x60]
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
mov dword [ebp - 0x844], 0
test eax, eax
je 0x407003
lea ecx, [ebp - 0x838]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jns 0x406fa4
mov ecx, dword [esi + 0x60]
call fcn.00403860
mov ecx, dword [esi + 0x60]
lea edx, [ebp - 0x408]
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x406fb0
lea edi, [ebp - 0x408]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x406fc4
mov ax, word [0x41e584]
lea ecx, [ebp - 0x408]
mov word [edi], ax
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x406fe0
mov eax, dword [str.version.xml]
mov dword [ecx], eax
mov eax, dword [0x420b6c]
mov dword [ecx + 4], eax
mov eax, dword [0x420b70]
mov dword [ecx + 8], eax
jmp 0x40701e
movq xmm0, qword [str.version.xml]
mov eax, dword [0x420b70]
movq qword [ebp - 0x408], xmm0
mov dword [ebp - 0x400], eax
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x408]
push eax
call ebx
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 8
test eax, eax
js 0x40706f
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
sub eax, 0x15180
sbb edx, 0
cmp edx, dword [ebp - 0x814]
jg 0x40706f
jl 0x407060
cmp eax, dword [ebp - 0x818]
ja 0x40706f
mov dword [ebp - 0x844], 1
jmp 0x40710c
xor ecx, ecx
mov al, byte [ebp + ecx - 0x408]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x809], al
test al, al
jne 0x407071
lea ecx, [ebp - 0x808]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x407090
mov eax, dword [str..tmp]
lea edx, [ebp - 0x808]
mov dword [ecx], eax
mov al, byte [0x420b78]
mov byte [ecx + 4], al
mov ecx, str.http:__itunes.apple.com_check_version
push 0
call fcn.004050b0
add esp, 4
test eax, eax
jne 0x40710c
lea eax, [ebp - 0x408]
push eax
call ebx
add esp, 4
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
add esp, 8
test eax, eax
jns 0x4070ff
lea eax, [ebp - 0x408]
push eax
push str.ERROR:_Could_not_update__s_n
call fcn.004035a0
add esp, 8
jmp 0x40710c
push str.NOTE:_Updated_version_data._n
call fcn.00403550
add esp, 4
lea eax, [ebp - 0x840]
mov dword [ebp - 0x83c], 0
push eax
lea edx, [ebp - 0x83c]
mov dword [ebp - 0x840], 0
lea ecx, [ebp - 0x408]
call fcn.00403660
mov edi, dword [ebp - 0x83c]
add esp, 4
test edi, edi
jne 0x40716d
lea eax, [ebp - 0x408]
push eax
push str.ERROR:_Could_not_load__s_n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
add esi, 0xc
push esi
push dword [ebp - 0x840]
mov dword [esi], 0
push edi
call dword [sym.imp.plist.dll_plist_from_xml]
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp dword [esi], 0
jne 0x4071ca
lea eax, [ebp - 0x408]
push eax
call ebx
add esp, 4
lea eax, [ebp - 0x408]
push eax
push str.ERROR:_Cannot_parse_plist_data_from__s._n
call fcn.004035a0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c84a
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x844], 0
je 0x4071e0
push str.NOTE:_using_cached_version_data_n
call fcn.00403550
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041c84a
mov esp, ebp
pop ebp
ret