Function at 0x40398c
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
sub esp, 0xf0c
mov eax, dword [0x42e440]
xor eax, esp
mov dword [esp + 0xf04], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [0x43074c]
xor eax, eax
mov ebp, 0x208
mov word [esp + 0x6d0], ax
push ebp
xor ebx, ebx
lea eax, [esp + 0x6d6]
push ebx
push eax
call fcn.00414050
add esp, 0xc
lea eax, [esp + 0x6d0]
mov esi, 0x104
push esi
push 0x431230
push eax
call fcn.0040cf8a
add esp, 0xc
xor eax, eax
mov word [esp + 0xa0], ax
lea eax, [esp + 0xa2]
push ebp
push ebx
push eax
call fcn.00414050
add esp, 0xc
lea eax, [esp + 0xa0]
push esi
push 0x431230
push eax
call fcn.0040cf8a
add esp, 0xc
lea ecx, [esp + 0xa0]
mov edx, str.updater.ini
call fcn.0040809b
test eax, eax
jne 0x403a36
xor al, al
jmp 0x403d4a
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0xa0]
push eax
push 0x105
lea eax, [esp + 0xaf8]
mov byte [esp + 0x1e], 1
push eax
push ebx
push str.ExeRelPath
mov ebp, str.PostUpdateWin
push ebp
call esi
test eax, eax
je 0x403a2f
lea eax, [esp + 0xa0]
push eax
push 0x105
lea eax, [esp + 0x8e8]
push eax
push ebx
push str.ExeArg
push ebp
call esi
test eax, eax
je 0x403a2f
lea eax, [esp + 0xa0]
push eax
push 0xa
lea eax, [esp + 0x94]
push eax
push str.TRUE
push str.ExeAsync
push ebp
call esi
test eax, eax
je 0x403a2f
lea eax, [esp + 0xaf0]
push 0x429290
push eax
call fcn.0040e216
pop ecx
pop ecx
test eax, eax
jne 0x403a2f
mov esi, 0x208
mov word [esp + 0x2b0], ax
push esi
lea eax, [esp + 0x2b6]
push ebx
push eax
call fcn.00414050
add esp, 0xc
lea eax, [esp + 0x2b0]
mov ebp, 0x104
push ebp
push 0x431230
push eax
call fcn.0040cf8a
add esp, 0xc
lea edx, [esp + 0xaf0]
lea ecx, [esp + 0x2b0]
call fcn.0040809b
test eax, eax
je 0x403a2f
cmp byte [0x430538], bl
je 0x403b3c
push ecx
lea edx, [esp + 0x2b4]
call fcn.00407928
pop ecx
test eax, eax
je 0x403a2f
push str.uninstall.update
lea edx, [esp + 0x2b4]
lea ecx, [esp + 0xd04]
call fcn.00407cdc
pop ecx
test eax, eax
je 0x403a2f
xor eax, eax
push esi
mov word [esp + 0x4c4], ax
lea eax, [esp + 0x4c6]
push ebx
push eax
call fcn.00414050
add esp, 0xc
lea eax, [esp + 0x4c0]
push ebp
push edi
push eax
call fcn.0040cf8a
add esp, 0xc
lea ecx, [esp + 0x4c0]
mov edx, str.update.log
call fcn.0040809b
test eax, eax
je 0x403a2f
push 6
xor eax, eax
lea edi, [esp + 0x76]
pop ecx
mov word [esp + 0x70], ax
rep stosd dword es:[edi], eax
push 0xd
push str.argv0ignored
stosw word es:[edi], ax
lea eax, [esp + 0x78]
push eax
call fcn.0040cf8a
add esp, 0xc
lea ecx, [esp + 0x8e0]
lea edx, [ecx + 2]
push 2
pop ebp
mov ax, word [ecx]
add ecx, ebp
cmp ax, bx
jne 0x403bd7
sub ecx, edx
lea edx, [esp + 0x70]
sar ecx, 1
lea esi, [edx + 2]
mov ax, word [edx]
add edx, ebp
cmp ax, bx
jne 0x403bec
sub edx, esi
sar edx, 1
lea esi, [edx + ecx]
lea eax, [esi*2 + 2]
push eax
call fcn.0040be77
mov ebx, eax
pop ecx
test ebx, ebx
je 0x403a2f
push esi
lea eax, [esp + 0x74]
push eax
push ebx
call fcn.0040cf8a
lea edx, [esp + 0x8ec]
add esp, 0xc
mov esi, edx
xor ecx, ecx
mov ax, word [edx]
add edx, ebp
cmp ax, cx
jne 0x403c2f
sub edx, esi
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, ebp
cmp ax, cx
jne 0x403c3e
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp byte [0x430538], 0
rep movsb byte es:[edi], byte [esi]
jne 0x403c95
push 6
lea eax, [esp + 0x90]
push str.false
push eax
call fcn.0040d3b8
add esp, 0xc
test eax, eax
je 0x403c95
push ebp
lea eax, [esp + 0x90]
push 0x429da0
push eax
call fcn.0040d3b8
add esp, 0xc
test eax, eax
jne 0x403c9a
mov byte [esp + 0x16], 0
push 0
lea eax, [esp + 0xd04]
push eax
lea eax, [esp + 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
mov dword [esp + 0x28], 0x44
push 0x3c
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x38]
push eax
call fcn.00414050
xor ecx, ecx
mov dword [esp + 0x3c], 0x427d8c
xor eax, eax
mov dword [esp + 0x24], ecx
add esp, 0xc
lea edi, [esp + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x6d8]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
push ebx
setne byte [esp + 0x1b]
call fcn.0040be3f
mov bl, byte [esp + 0x1b]
pop ecx
test bl, bl
je 0x403d48
cmp byte [esp + 0x16], 0
jne 0x403d36
push 0xffffffffffffffff
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x1c]
call esi
mov al, bl
mov ecx, dword [esp + 0xf14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040bd82
add esp, 0xf0c
ret