Function at 0x404530
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push edi
lea ecx, [edx + 0x10]
lea edi, [esp + 8]
and esp, 0xfffffff0
movd xmm1, ecx
push dword [edi - 4]
push ebp
punpckldq xmm1, xmm1
mov ebp, esp
push edi
lea edi, [edx + 8]
push esi
movd xmm0, edi
mov esi, eax
push ebx
punpckldq xmm0, xmm0
punpcklqdq xmm0, xmm1
sub esp, 0x4f0
mov dword [ebp - 0x4bc], edi
lea edi, [edx + 0x18]
movups xmmword [edx + 8], xmm0
movd xmm0, edi
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 0x4c4], ecx
punpckldq xmm0, xmm0
mov dword [ebp - 0x4c8], edi
movq qword [edx + 0x18], xmm0
mov dword [esp], 0
call dword [sym.imp.ole32.dll_CoInitialize]
sub esp, 4
test byte [section..data], 8
jne 0x4049a0
mov eax, dword [ebp - 0x4c0]
call fcn.00401040
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], eax
test eax, eax
je 0x4046aa
mov edx, eax
mov eax, esi
call fcn.004012a0
test eax, eax
jne 0x4046c0
test byte [section..data], 2
jne 0x404a20
mov dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4c0]
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov esi, dword [eax + 8]
mov edi, dword [esi]
cmp dword [ebp - 0x4bc], esi
je 0x40463b
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [esi + 8]
call fcn.00401f60
mov eax, dword [esi + 8]
mov dword [esp], eax
call ebx
mov dword [esp], esi
mov esi, edi
call ebx
mov edi, dword [edi]
cmp dword [ebp - 0x4bc], esi
jne 0x404610
mov eax, dword [ebp - 0x4c0]
mov ebx, dword [ebp - 0x4c4]
mov eax, dword [eax + 0x10]
mov esi, dword [eax]
cmp dword [ebp - 0x4c4], eax
je 0x404672
lea esi, [esi]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [esp], eax
call fcn.00406e80
mov eax, esi
mov esi, dword [esi]
cmp ebx, eax
jne 0x404658
mov eax, dword [ebp - 0x4c0]
mov ebx, dword [ebp - 0x4c8]
mov eax, dword [eax + 0x18]
mov esi, dword [eax]
cmp dword [ebp - 0x4c8], eax
je 0x4046aa
lea esi, cs:[esi]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax]
mov dword [edx], ecx
mov dword [esp], eax
call fcn.00406e30
mov eax, esi
mov esi, dword [esi]
cmp ebx, eax
jne 0x404690
mov eax, dword [ebp - 0x4d0]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [ebp - 0x4cc]
mov edx, str..cab
call fcn.00401e20
mov ebx, eax
test eax, eax
je 0x4045ed
lea eax, [ebp - 0x4b8]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.kernel32.dll_FindFirstFileW]
mov dword [ebp - 0x4d8], eax
call eax
sub esp, 8
mov edi, eax
mov dword [ebp - 0x4dc], eax
mov dword [esp], ebx
mov ebx, dword [sym.imp.ucrtbase.dll_free]
call ebx
cmp edi, 0xffffffff
je 0x4047e2
mov esi, dword [sym.imp.kernel32.dll_FindNextFileW]
mov dword [ebp - 0x4d0], ebx
nop
test byte [ebp - 0x4b8], 0x10
jne 0x4047b0
mov dword [esp + 4], str.WSUSSCAN.cab
lea eax, [ebp - 0x48c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x4047b0
mov eax, dword [ebp - 0x4cc]
lea edx, [ebp - 0x48c]
call fcn.00401e20
mov ebx, eax
test eax, eax
je 0x4047b0
test byte [section..data], 8
jne 0x404d30
mov eax, dword [ebp - 0x4c0]
call fcn.00401040
mov dword [ebp - 0x4d4], eax
test eax, eax
je 0x404cb8
mov edx, eax
mov eax, ebx
call fcn.004012a0
test eax, eax
jne 0x404a88
test byte [section..data], 2
jne 0x404c55
mov dword [esp], ebx
mov eax, dword [ebp - 0x4d0]
call eax
nop
lea eax, [ebp - 0x4b8]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 8
test eax, eax
jne 0x404720
mov eax, dword [ebp - 0x4dc]
mov ebx, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
mov eax, dword [ebp - 0x4cc]
mov edx, str..xml
call fcn.00401e20
mov esi, eax
test eax, eax
je 0x4045ed
lea eax, [ebp - 0x4b8]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d8]
call eax
sub esp, 8
mov edi, eax
mov dword [ebp - 0x4d0], eax
mov dword [esp], esi
call ebx
cmp edi, 0xffffffff
je 0x4048b8
mov esi, dword [sym.imp.kernel32.dll_FindNextFileW]
lea edi, [ebp - 0x48c]
mov dword [ebp - 0x4d4], ebx
lea esi, [esi]
test byte [ebp - 0x4b8], 0x10
jne 0x40488a
mov eax, dword [ebp - 0x4cc]
mov edx, edi
call fcn.00401e20
mov ebx, eax
test eax, eax
je 0x40488a
mov eax, dword [ebp - 0x4c8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407170
test eax, eax
jne 0x40487f
test byte [section..data], 2
jne 0x404e88
mov dword [esp], ebx
mov eax, dword [ebp - 0x4d4]
call eax
lea eax, [ebp - 0x4b8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call esi
sub esp, 8
test eax, eax
jne 0x404840
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
test byte [section..data], 8
jne 0x404d93
mov eax, dword [ebp - 0x4c0]
mov ebx, dword [ebp - 0x4c8]
cmp ebx, dword [eax + 0x18]
je 0x404f69
mov eax, dword [ebp - 0x4c0]
mov edx, dword [ebp - 0x4c4]
mov eax, dword [eax + 0x10]
cmp dword [ebp - 0x4c4], eax
je 0x404905
lea esi, [esi]
mov dword [eax + 8], 0
mov eax, dword [eax]
cmp edx, eax
jne 0x4048f8
mov eax, dword [ebp - 0x4c0]
mov edx, 1
call fcn.00404420
test eax, eax
je 0x404eed
mov eax, dword [ebp - 0x4c0]
mov edx, dword [ebp - 0x4c4]
mov eax, dword [eax + 0x10]
cmp dword [ebp - 0x4c4], eax
je 0x404945
lea esi, [esi]
mov dword [eax + 8], 0
mov eax, dword [eax]
cmp edx, eax
jne 0x404938
mov eax, dword [ebp - 0x4c0]
xor edx, edx
call fcn.00404420
mov ebx, eax
mov dword [ebp - 0x4d0], eax
movzx eax, byte [section..data]
test ebx, ebx
je 0x404f38
test al, 8
je 0x4045f7
mov dword [esp + 0xc], str.Installation_finished_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
jmp 0x4045f7
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x404a08
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x4049d4
mov edx, 0xffffffff
mov eax, esi
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Processing_msu_file__s_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
jmp 0x4045ac
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x4049d4
mov eax, esi
shr eax, 0x10
test eax, eax
je 0x404f23
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404a58
mov edx, 0xffffffff
mov eax, esi
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_extract__s_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x4045ed
mov eax, dword [ebp - 0x4d4]
mov edx, str._manifest_.cix.xml
call fcn.00401e20
test eax, eax
je 0x404cb8
mov dword [esp], eax
mov dword [ebp - 0x4e0], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x4e0]
sub esp, 4
cmp eax, 0xffffffff
je 0x404b23
test byte [section..data], 1
je 0x404b23
mov dword [esp + 0xc], str.Cabinet_uses_proprietary_msdelta_file_compression_which_is_not__yet__supported_n
mov dword [esp + 8], str.load_assemblies_from_cab
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ad0
test byte [section..data], 1
mov edx, dword [ebp - 0x4e0]
je 0x404b23
mov dword [esp + 0xc], str.Installation_of_msu_file_will_most_likely_fail_n
mov dword [esp + 8], str.load_assemblies_from_cab
mov dword [esp + 4], 0x408000
mov dword [esp], 0
call fcn.00401ad0
mov edx, dword [ebp - 0x4e0]
mov dword [esp], edx
mov eax, dword [ebp - 0x4d0]
call eax
mov eax, dword [ebp - 0x4d4]
mov edx, 0x40a06e
call fcn.00401e20
test eax, eax
je 0x404cb8
lea ecx, [ebp - 0x268]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov edx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4e4], eax
call edx
mov edx, dword [ebp - 0x4e4]
sub esp, 8
mov dword [ebp - 0x4e0], eax
mov dword [esp], edx
mov ecx, dword [ebp - 0x4d0]
call ecx
mov eax, dword [ebp - 0x4e0]
cmp eax, 0xffffffff
je 0x4047a3
mov dword [ebp - 0x4e4], edi
mov edi, eax
mov dword [ebp - 0x4e8], ebx
lea esi, cs:[esi]
test byte [ebp - 0x268], 0x10
jne 0x404c18
mov edx, str..manifest
lea eax, [ebp - 0x23c]
call fcn.00401400
test eax, eax
jne 0x404bd1
lea eax, [ebp - 0x23c]
mov edx, str..mum
call fcn.00401400
test eax, eax
je 0x404c18
mov eax, dword [ebp - 0x4d4]
lea edx, [ebp - 0x23c]
call fcn.00401e20
mov ebx, eax
test eax, eax
je 0x404c18
mov dword [esp], eax
call fcn.00406fb0
test eax, eax
je 0x404c0d
mov ecx, dword [ebp - 0x4c4]
mov edx, dword [ebp - 0x4c0]
mov dword [eax], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 4], ecx
mov dword [ecx], eax
mov dword [edx + 0x14], eax
mov dword [esp], ebx
mov eax, dword [ebp - 0x4d0]
call eax
lea eax, [ebp - 0x268]
mov dword [esp], edi
mov dword [esp + 4], eax
call esi
sub esp, 8
test eax, eax
jne 0x404ba0
mov eax, dword [ebp - 0x4e0]
mov edi, dword [ebp - 0x4e4]
mov ebx, dword [ebp - 0x4e8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindClose]
sub esp, 4
jmp 0x4047a3
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4051de
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404c8d
mov edx, 0xffffffff
mov eax, ebx
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_extract__s_n
mov dword [esp + 8], str.load_assemblies_from_cab
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
lea esi, [esi]
test byte [section..data], 2
je 0x4047a3
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4051c9
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404cfd
mov edx, 0xffffffff
mov eax, ebx
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_load_all_manifests_from__s__ignoring_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x4047a3
shr eax, 0x10
test eax, eax
je 0x404e73
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404d66
mov edx, 0xffffffff
mov eax, ebx
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Processing_cab_file__s_n
mov dword [esp + 8], str.load_assemblies_from_cab
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
jmp 0x40476c
mov dword [esp], section..data
call fcn.00407b90
test al, 8
je 0x4048c5
movzx eax, byte [section..data]
test al, 8
jne 0x404f9f
mov ebx, dword [ebp - 0x4c0]
mov esi, dword [ebx + 0x18]
cmp dword [ebp - 0x4c8], esi
je 0x40500c
mov ebx, dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edi, dword [ebp - 0x4c8]
jmp 0x404dea
mov esi, dword [esi]
cmp edi, esi
je 0x404fe4
mov edx, eax
and edx, 8
je 0x404de0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4051b8
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x40517c
mov dword [esp + 4], 0xffffffff
mov dword [esp], ecx
mov dword [ebp - 0x4cc], ecx
call ebx
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404e3a
mov eax, dword [ebp - 0x4cc]
mov edx, 0xffffffff
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.___s_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
movzx eax, byte [section..data]
mov edx, eax
and edx, 8
jmp 0x404de0
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404d66
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x4051a3
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x404ec0
mov edx, 0xffffffff
mov eax, ebx
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_load_all_updates_from__s__ignoring_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x40487f
test byte [section..data], 2
je 0x4045ed
mov dword [esp + 0xc], str.Dry_run_failed__aborting_installation_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x4045ed
mov dword [esp + 4], esi
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404a58
test al, 2
je 0x4045ed
mov dword [esp + 0xc], str.Installation_failed_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x4045ed
test byte [section..data], 2
je 0x4045ed
mov dword [esp + 0xc], str.No_updates_found__probably_incompatible_MSU_file_format__n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 1
call fcn.00401ad0
jmp 0x4045ed
mov dword [esp + 0xc], str.List_of_updates:_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
mov eax, dword [ebp - 0x4c0]
mov esi, dword [eax + 0x18]
movzx eax, byte [section..data]
cmp dword [ebp - 0x4c8], esi
jne 0x404dcb
and eax, 8
mov edx, eax
test dl, dl
je 0x40500c
mov dword [esp + 0xc], str.List_of_manifests__with_dependencies_:_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
mov eax, dword [ebp - 0x4c0]
mov esi, dword [eax + 0x10]
cmp dword [ebp - 0x4c4], esi
je 0x4048c5
mov edi, esi
lea esi, cs:[esi]
test byte [section..data], 8
jne 0x405110
mov ebx, dword [edi + 0x28]
lea esi, [edi + 0x28]
cmp esi, ebx
je 0x4050d2
mov dword [ebp - 0x4cc], edi
jmp 0x405056
mov ebx, dword [ebx]
cmp ebx, esi
je 0x4050cc
test byte [section..data], 8
je 0x405050
mov edi, dword [ebx + 8]
test edi, edi
je 0x405100
mov eax, edi
shr eax, 0x10
test eax, eax
je 0x4050e8
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x40509e
mov edx, 0xffffffff
mov eax, edi
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._______s_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
mov ebx, dword [ebx]
cmp ebx, esi
jne 0x405056
mov edi, dword [ebp - 0x4cc]
mov edi, dword [edi]
cmp dword [ebp - 0x4c4], edi
jne 0x405028
jmp 0x4048c5
mov dword [esp + 4], edi
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x40509e
mov eax, 0x40a00e
jmp 0x40509e
mov ebx, dword [edi + 0x14]
test ebx, ebx
je 0x4051c2
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x405191
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, 0x40a015
test edx, edx
jne 0x40514f
mov edx, 0xffffffff
mov eax, ebx
call fcn.00401490
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.___s_n
mov dword [esp + 8], str.install_msu
mov dword [esp + 4], 0x408000
mov dword [esp], 3
call fcn.00401ad0
jmp 0x405035
mov dword [esp + 4], ecx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404e3a
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x40514f
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404ec0
mov eax, 0x40a00e
jmp 0x404e3a
mov eax, 0x40a00e
jmp 0x40514f
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404cfd
mov dword [esp + 4], ebx
mov dword [esp], 0x40a008
call fcn.004016b0
jmp 0x404c8d