Function at 0x405ba0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xed0
mov eax, dword [0x43e00c]
xor eax, ebp
mov dword [esp + 0xec8], eax
mov eax, 0x20a
xor ecx, ecx
lea esi, [esp + 0xcbe]
push eax
push ecx
push esi
call fcn.00414ee0
add esp, 0xc
mov ebx, 0x104
mov edi, 0x43ffd4
push ebx
push edi
push esi
call fcn.0041213d
add esp, 0xc
lea esi, [esp + 0xab4]
mov eax, 0x20a
push eax
xor eax, eax
push eax
push esi
call fcn.00414ee0
add esp, 0xc
push ebx
push edi
push esi
call fcn.0041213d
add esp, 0xc
push str.updater.ini
push esi
call fcn.00430560
add esp, 8
test eax, eax
je 0x405cb5
lea edi, [esp + 0x8aa]
push esi
push 0x105
push edi
push 0
push str.ExeRelPath
push str.PostUpdateWin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x405cb5
lea eax, [esp + 0x6a0]
push esi
push 0x105
push eax
push 0
push str.ExeArg
push str.PostUpdateWin
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x405cb5
push 0x4387e8
push edi
call fcn.00415349
add esp, 8
test eax, eax
jne 0x405cb5
push 0x4387e2
push edi
call fcn.00415349
add esp, 8
test eax, eax
jne 0x405cb5
push 0x43871c
push edi
call fcn.00415349
add esp, 8
test eax, eax
jne 0x405cb5
push 0x438722
push edi
call fcn.00415349
add esp, 8
test eax, eax
je 0x405ccf
xor ebx, ebx
mov ecx, dword [esp + 0xec8]
xor ecx, ebp
call fcn.00412b41
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, word [esp + 0x8aa]
xor ebx, ebx
lea ecx, [eax - 0x2e]
cmp cx, 2
jb 0x405cb7
cmp ax, 0x5c
je 0x405cb7
lea esi, [esp + 0x496]
push 0x20a
push 0
push esi
call fcn.00414ee0
add esp, 0xc
push 0x104
push 0x43ffd4
push esi
call fcn.0041213d
add esp, 0xc
push edi
push esi
call fcn.00430560
add esp, 8
test eax, eax
je 0x405cb5
push esi
call fcn.00410700
add esp, 4
test al, al
je 0x405cb5
cmp byte [0x43ffd0], 0
je 0x405d55
push 1
lea eax, [esp + 0x49a]
push eax
push 0x43ffd4
call fcn.0040f8e0
add esp, 0xc
test eax, eax
je 0x405cb5
lea eax, [esp + 0x28c]
push str.uninstall.update
lea ecx, [esp + 0x49a]
push ecx
push eax
call fcn.004109a0
add esp, 0xc
test eax, eax
je 0x405cb5
lea eax, [esp + 0x82]
push 0x20a
push 0
push eax
call fcn.00414ee0
add esp, 0xc
cmp byte [0x43ffd1], 1
jne 0x405ee2
lea eax, [esp + 0x82]
push eax
push 0x438434
push 0x43f7a8
call fcn.00410b80
add esp, 0xc
test eax, eax
je 0x405cb5
xorps xmm0, xmm0
lea esi, [esp + 0x60]
movups xmmword [esi + 0xc], xmm0
movaps xmmword [esi], xmm0
push 0xd
push str.argv0ignored
push esi
call fcn.0041213d
add esp, 0xc
lea eax, [esp + 0x6a0]
push eax
call fcn.00411f8b
add esp, 4
mov ebx, eax
push esi
call fcn.00411f8b
add esp, 4
add eax, ebx
mov edi, eax
add eax, eax
add eax, 2
push eax
call fcn.0041f4bf
add esp, 4
xor ebx, ebx
test eax, eax
je 0x405cb7
mov ecx, eax
push edi
push esi
mov ebx, eax
push ecx
call fcn.0041213d
add esp, 0xc
lea eax, [esp + 0x6a0]
push eax
push ebx
call fcn.0041fa6d
add esp, 8
xor esi, esi
push esi
lea eax, [esp + 0x290]
push eax
lea eax, [esp + 0x8a]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
movups xmmword [eax + 0x34], xmm0
movups xmmword [eax + 0x24], xmm0
movups xmmword [eax + 0x14], xmm0
mov dword [eax], 0x44
mov dword [eax + 8], 0x438860
mov ecx, esp
movaps xmmword [ecx], xmm0
sub esp, 0x28
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xce6]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
lea eax, [esp + 0x4be]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
push ebx
call fcn.0041f035
add esp, 4
test edi, edi
setne bl
je 0x405cb7
push 0xffffffffffffffff
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call esi
push dword [esp + 4]
call esi
jmp 0x405cb7
push 0x104
push 0x43f7a8
lea esi, [esp + 0x8a]
push esi
call fcn.0041213d
add esp, 0xc
push 0x438428
push esi
call fcn.00430560
add esp, 8
jmp 0x405db8