Function at 0x401520
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x151c
call fcn.00409bb0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x18], edi
call fcn.00406de0
mov eax, dword [0x419f60]
test eax, eax
jne 0x4015f2
push str.wininet.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
mov dword [0x419f60], eax
je 0x401662
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.InternetOpenA
push eax
call esi
mov dword [0x419f5c], eax
mov eax, dword [0x419f60]
push str.InternetOpenUrlA
push eax
call esi
mov ecx, dword [0x419f60]
push str.InternetCloseHandle
push ecx
mov dword [0x419f58], eax
call esi
mov edx, dword [0x419f60]
push str.InternetReadFile
push edx
mov dword [0x419f54], eax
call esi
mov ecx, dword [0x419f5c]
test ecx, ecx
mov dword [0x419f50], eax
je 0x401662
mov ecx, dword [0x419f58]
test ecx, ecx
je 0x401662
mov ecx, dword [0x419f54]
test ecx, ecx
je 0x401662
test eax, eax
je 0x401662
push 0
push 4
push 0x21
push 4
push str.C_D_Update_Check___d._d._d._d_
lea eax, [ebp - 0x52c]
push 0xff
push eax
mov dword [ebp - 4], 0
call fcn.00409dc4
add esp, 0x1c
push 0
push str.Checking_for_update...
push 0
push 0x64
mov byte [ebp - 0x42d], 0
call dword [ebp + 8]
mov eax, dword [0x419f44]
test eax, eax
je 0x401691
push 0
call fcn.00409523
mov ecx, dword [0x419f44]
add ecx, 0x3c
add esp, 4
cmp ecx, eax
jle 0x401691
test edi, edi
jne 0x401662
push 0x30
push str.Failed
push str.You_can_only_update_once_in_every_60_seconds._Try_again_in_60_seconds.
call dword [ebp + 0xc]
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 4], 0xffffffff
call fcn.00406de0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
call fcn.00409523
add esp, 4
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x52c]
push edx
mov dword [0x419f44], eax
mov byte [ebp - 4], 3
call dword [0x419f5c]
mov ebx, eax
test ebx, ebx
je 0x4016e8
push 4
push 0
call fcn.00401270
shl eax, 7
add esp, 8
add eax, 0x4132c0
push eax
lea eax, [ebp - 0xd2c]
push str.http:___s_cdeath_update_client_auto.php
push eax
call fcn.00409d6c
add esp, 0xc
push 0
push 0x80000000
push 0
push 0
lea ecx, [ebp - 0xd2c]
push ecx
push ebx
call dword [0x419f58]
mov esi, eax
test esi, esi
jne 0x401773
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x401738
mov dword [ebp - 0x14], 0x413a42
push ebx
call dword [0x419f54]
test edi, edi
jne 0x401d87
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push eax
push esi
push 0x30
push str.Error
push str.Could_not_connect_to_server_to_check_for_an_update._nError__d__n_s
push ecx
call fcn.00401320
mov edx, dword [ebp - 0x14]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x401662
xor eax, eax
mov ecx, 0x200
lea edi, [ebp - 0x152c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 0x800
lea ecx, [ebp - 0x152c]
push ecx
push esi
call dword [0x419f50]
push esi
mov byte [ebp - 0xd2d], 0
call dword [0x419f54]
push ebx
call dword [0x419f54]
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x152c]
lea edx, [ebp - 0xd2c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4017c3
movsx edx, byte [ebp - 0xd2c]
push edx
call fcn.00409c66
add esp, 4
test eax, eax
je 0x4024d0
mov al, byte [ebp - 0xd2b]
mov bl, 0x2e
cmp al, bl
jne 0x4024d0
movsx eax, byte [ebp - 0xd2a]
push eax
call fcn.00409c66
add esp, 4
test eax, eax
je 0x4024d0
cmp byte [ebp - 0xd29], bl
jne 0x4024d0
movsx ecx, byte [ebp - 0xd28]
push ecx
call fcn.00409c66
add esp, 4
test eax, eax
je 0x4024d0
cmp byte [ebp - 0xd27], bl
jne 0x4024d0
movsx edx, byte [ebp - 0xd26]
push edx
call fcn.00409c66
add esp, 4
test eax, eax
je 0x4024d0
lea esi, [ebp - 0x152c]
mov dword [ebp - 4], edi
mov byte [ebp - 4], 7
mov ebx, esi
xor eax, eax
mov al, byte [esi]
test al, al
je 0x401881
push eax
call fcn.004014a0
add esp, 4
test eax, eax
jne 0x40187c
inc esi
jmp 0x401864
cmp byte [esi], 0
jne 0x401892
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00401410
jmp 0x401662
mov byte [esi], 0
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4024d0
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401895
mov dword [ebp - 0x40], esi
jmp 0x4018d0
mov al, byte [esi]
test al, al
je 0x4024d0
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401901
inc esi
jmp 0x4018d0
cmp byte [esi], 0
je 0x4024d0
mov byte [esi], 0
lea ecx, [ecx]
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4024d0
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401910
push esi
call fcn.00409d67
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
mov edi, edi
mov al, byte [esi]
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x40197d
inc esi
jmp 0x401950
cmp byte [esi], 0
jne 0x401999
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x401662
mov eax, dword [0x41a080]
test eax, eax
jmp 0x4024df
mov byte [esi], 0
lea esp, [esp]
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x4019a0
mov dword [ebp - 0x48], esi
nop
mov al, byte [esi]
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x4019fd
inc esi
jmp 0x4019d0
cmp byte [esi], 0
je 0x401982
mov byte [esi], 0
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401a05
mov dword [ebp - 0x44], esi
jmp 0x401a40
mov al, byte [esi]
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401a71
inc esi
jmp 0x401a40
cmp byte [esi], 0
je 0x401982
mov byte [esi], 0
lea ecx, [ecx]
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401982
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401a80
mov dword [ebp - 0x60], esi
mov al, byte [esi]
test al, al
je 0x401ae6
xor ecx, ecx
cmp al, 0x20
sete cl
xor edx, edx
cmp al, 0xd
sete dl
or ecx, edx
xor edx, edx
cmp al, 0xa
sete dl
or ecx, edx
xor edx, edx
cmp al, 9
sete dl
or ecx, edx
jne 0x401ae6
inc esi
jmp 0x401ab3
mov byte [esi], 0
cmp byte [ebx + 7], 0x2d
mov dword [ebp - 4], 0
mov byte [ebp - 4], 9
jne 0x4024ae
cmp byte [ebx + 8], 0x30
jne 0x4024ae
cmp byte [ebx + 9], 0x78
jne 0x4024ae
movsx eax, byte [ebx + 0xa]
lea esi, [ebx + 0xa]
push eax
call fcn.00409ca0
add esp, 4
test eax, eax
je 0x4024ae
mov eax, esi
call fcn.00401430
cmp eax, 0x4210400
mov dword [ebp - 0x1c], eax
jle 0x4024ae
cmp byte [ebx + 6], 0x30
jne 0x401b49
mov byte [ebx + 5], 0
mov ecx, eax
movzx edx, ah
movzx eax, byte [ebp - 0x1a]
and ecx, 0xff
push ecx
movzx ecx, byte [ebp - 0x19]
push edx
push eax
push ecx
push str._d._d._d._d
lea edx, [ebp - 0x118]
push 0x20
push edx
call fcn.00409dc4
lea eax, [ebp - 0x118]
add esp, 0x1c
mov byte [ebp - 0xf8], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b86
sub eax, edx
cmp byte [ebp + eax - 0x119], 0x30
jne 0x401bb2
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ba2
sub eax, edx
mov byte [ebp + eax - 0x11a], cl
mov eax, dword [0x41a080]
test eax, eax
jne 0x401be3
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
push 0x24
push str.Verify_Download
push str.There_is_update_available._nVersion:__s_nDo_you_want_to_download_the_update_
push ecx
call fcn.00401320
add esp, 0x14
cmp eax, 7
je 0x401662
push 1
push str.Downloading_update...
push 0
push edi
mov dword [ebp - 4], 0
call dword [ebp + 8]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x52c]
push edx
mov byte [ebp - 4], 0xb
call dword [0x419f5c]
mov edi, eax
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x40242b
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0xd2c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x401c26
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xd2c]
push eax
push edi
call dword [0x419f58]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x18], ebx
jne 0x401cae
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push 0x400
mov esi, eax
push esi
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x401c7d
mov dword [ebp - 0x14], 0x413a42
push edi
call dword [0x419f54]
mov eax, dword [0x41a080]
test eax, eax
jne 0x401d87
mov edx, dword [ebp - 0x14]
push edx
push esi
lea eax, [ebp - 0xd2c]
push eax
push 0x30
push str.Error
push str.Could_not_download_update_file___s__from_server._nError__d__n_s
jmp 0x401d7b
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x42c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x401cb7
lea edi, [ebp - 0x42c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401cc8
mov eax, dword [str.autoupdate.exe]
mov ecx, dword [0x413928]
mov edx, dword [0x41392c]
push 0
push 0
mov dword [edi], eax
mov ax, word [0x413930]
push 2
mov dword [edi + 4], ecx
mov cl, byte [0x413932]
push 0
mov dword [edi + 8], edx
push 0
push 0x40000000
lea edx, [ebp - 0x42c]
mov word [edi + 0xc], ax
push edx
mov byte [edi + 0xe], cl
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401d96
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x401d50
mov dword [ebp - 0x14], 0x413a42
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x419f54]
mov eax, dword [0x41a080]
test eax, eax
jne 0x401d87
mov edx, dword [ebp - 0x14]
push edx
push esi
lea eax, [ebp - 0x42c]
push eax
push 0x30
push str.Error
push str.Could_not_create_update_file___s_._nError__d__n_s
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401320
add esp, 0x1c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x401662
lea ecx, [ebp - 0x1e0]
xor esi, esi
call fcn.00406de0
lea eax, [ebp - 0x20]
push eax
push pe_nt_image_headers32
lea ecx, [ebp - 0xd2c]
push ecx
push ebx
call dword [0x419f50]
mov ebx, dword [ebp + 8]
lea ecx, [ecx]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x401e5c
push 0
lea edx, [ebp - 0xd8]
push edx
push eax
lea eax, [ebp - 0xd2c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp - 0x20]
push 1
add esi, ecx
mov ecx, dword [ebp - 0x24]
push str.Downloading_update...
push esi
push ecx
call ebx
test eax, eax
jne 0x401e27
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp - 0x18]
push edx
call dword [0x419f54]
mov eax, dword [ebp - 0x1c]
push eax
call dword [0x419f54]
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x401662
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0xd2c]
push eax
lea ecx, [ebp - 0x1e0]
call fcn.00406e60
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
push ecx
push pe_nt_image_headers32
lea edx, [ebp - 0xd2c]
push edx
push eax
call dword [0x419f50]
jmp 0x401dc0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [0x419f54]
mov edx, dword [ebp - 0x1c]
push edx
call dword [0x419f54]
mov edi, dword [ebp - 0x24]
push 0
push str.Download_complete_
push edi
push edi
call ebx
cmp edi, esi
mov dword [ebp - 4], 0
je 0x401ec7
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [0x41a080]
test eax, eax
jne 0x401662
mov ecx, dword [ebp + 0xc]
push 0x30
push str.Error
push str.Download_failed__server_too_busy___nDownloaded_file_deleted.
push ecx
call fcn.00401320
add esp, 0x10
jmp 0x401662
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0xd
call fcn.00406f20
push 0
lea ecx, [ebp - 0x88]
call fcn.00407b40
push 0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0xe
call fcn.00407b40
push 0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xf
call fcn.00407b40
push 0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x10
call fcn.00407b40
push 0
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x11
call fcn.00407b40
push 1
lea edx, [ebp - 0x5c]
push 0x4138a0
push edx
mov byte [ebp - 4], 0x12
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x13
call fcn.00407b70
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
push 0x40
lea eax, [ebp - 0x5c]
push 0x413860
push eax
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x14
call fcn.00407b70
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00408250
add esp, 8
push eax
lea eax, [ebp - 0x5c]
mov bl, 0x15
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.004011d0
push eax
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0x16
call fcn.00407b70
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.00407b90
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
push 1
lea ecx, [ebp - 0x3c]
push 0x413858
push ecx
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x17
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
push 0x40
lea edx, [ebp - 0x3c]
push 0x413818
push edx
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x18
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00408250
add esp, 8
push eax
lea edx, [ebp - 0x3c]
mov bl, 0x19
push edx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.004011d0
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1a
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00407b90
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
push 1
lea eax, [ebp - 0x3c]
push 0x413810
push eax
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1b
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
push 0x40
lea ecx, [ebp - 0x3c]
push 0x4137d0
push ecx
call fcn.00408150
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x1c
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
mov edx, dword [ebp - 0x60]
push edx
lea eax, [ebp - 0x5c]
push eax
call fcn.00408250
add esp, 8
push eax
lea ecx, [ebp - 0x3c]
push ecx
mov bl, 0x1d
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.004011d0
push eax
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x1e
call fcn.00407b70
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00407b90
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.00407b90
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
cmp edi, 0x20
jge 0x402196
mov esi, 0x1f
sub esi, edi
push esi
lea ecx, [ebp - 0xc0]
call fcn.00408120
cmp al, byte [ebp + edi - 0x138]
je 0x40214f
mov dword [ebp - 0x18], 1
push esi
lea ecx, [ebp - 0xd4]
call fcn.00408120
cmp al, byte [ebp + edi - 0x138]
je 0x40216b
mov dword [ebp - 0x1c], 1
push esi
lea ecx, [ebp - 0xac]
call fcn.00408120
cmp al, byte [ebp + edi - 0x138]
je 0x402185
mov ebx, 1
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + edx]
add eax, dword [ebp - 0x18]
cmp eax, 1
jg 0x402196
inc edi
jmp 0x402127
mov ecx, dword [ebp - 0x1c]
add ebx, ecx
add ebx, dword [ebp - 0x18]
cmp ebx, 1
jle 0x402222
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [0x41a080]
test eax, eax
jne 0x4021d5
mov eax, dword [ebp + 0xc]
push 0x30
push str.Error
push str.Updatefile_failed_signature_check._nDownloaded_file_deleted.
push eax
call fcn.00401320
add esp, 0x10
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x11
call fcn.00407b90
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x10
call fcn.00407b90
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xf
call fcn.00407b90
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
call fcn.00407b90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xd
call fcn.00407b90
jmp 0x401662
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x11
call fcn.00407b90
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x10
call fcn.00407b90
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xf
call fcn.00407b90
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x20
call fcn.00407b90
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xd
call fcn.00407b90
mov eax, dword [0x41a080]
test eax, eax
jne 0x40228b
push 0x24
push str.Verify_Install
push str.This_program_must_be_closed_to_install_the_update._nDo_you_want_to_install_the_update_
call dword [ebp + 0xc]
cmp eax, 7
je 0x401662
mov eax, dword [ebp - 0x24]
push 0
push str.Download_complete_
push eax
push eax
call dword [ebp + 8]
mov ebx, dword [ebp - 0x28]
mov eax, ebx
mov word [ebp - 0xd2c], 0x22
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4022b0
lea edi, [ebp - 0xd2c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4022c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xd2c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4022e0
mov ecx, dword [str.autoupdate.exe___S_auto]
mov edx, dword [0x413714]
mov eax, dword [0x413718]
mov dword [edi], ecx
mov ecx, dword [0x41371c]
mov dword [edi + 4], edx
mov edx, dword [0x413720]
mov dword [edi + 8], eax
mov eax, dword [0x413724]
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], eax
mov ecx, ebx
lea edx, [ebp - 0x42c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x402323
xor ecx, ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
xor eax, eax
mov ecx, 0x11
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0xd2c]
push edx
push 0
mov dword [ebp - 0x224], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x4023fb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x400
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4023c4
mov eax, 0x413a42
mov dword [ebp - 0x14], eax
push eax
mov eax, dword [ebp + 0xc]
push esi
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0xd2c]
push edx
push 0x30
push str.Error
push str.Could_not_run_the_install_program._nCommandline__s__nCWD__s__nError__d__n_s
push eax
call fcn.00401320
mov ecx, dword [ebp - 0x14]
add esp, 0x20
push ecx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x401662
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 4], 0xffffffff
call fcn.00406de0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0x400
mov esi, eax
push esi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40245d
mov eax, 0x413a42
mov dword [ebp - 0x14], eax
mov ecx, dword [0x41a080]
test ecx, ecx
jne 0x402484
push eax
mov eax, dword [ebp + 0xc]
push esi
push 0x30
push str.Error
push str.Could_not_open_connection_to_the_internet._nError__d__n_s
push eax
call fcn.00401320
mov eax, dword [ebp - 0x14]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x401662
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x401662
push 0x40
push str.Update_Complete
push str.Update_not_necessary._nYou_already_have_the_current_version.
jmp 0x40165f
cmp dword [ebp - 0x18], edi
jne 0x401662
cmp dword [0x41a080], edi
jne 0x401662
push 0x40
push str.Server_Busy
push str.The_update_server_is_busy.__Please_try_again_at_a_later_time.
jmp 0x40165f