Function at 0x418aa0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
mov eax, dword [0x4926cc]
xor eax, esp
mov dword [esp + 0x2c0], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x4190d9
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418ad4
sub ecx, edx
sar ecx, 1
je 0x4190d9
xor edi, edi
xor esi, esi
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
cmp word [ebx], si
je 0x418beb
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x418b65
sub esi, ecx
sar esi, 1
push esi
lea ecx, [esp + 0x84]
call fcn.004045c0
mov edi, dword [esp + 0x80]
push esi
push ebx
push eax
push edi
call fcn.00454b08
xor eax, eax
add esp, 0x10
mov word [edi + esi*2], ax
mov dword [esp + 0x84], esi
test edi, edi
je 0x418be4
cmp word [edi], ax
je 0x418be4
sub esp, 8
lea edx, [esp + 0x94]
mov ecx, edi
call fcn.0041ac50
mov esi, dword [esp + 0x94]
add esp, 8
test esi, esi
je 0x418bdb
cmp byte [esi], 0
je 0x418bdb
mov edi, dword [esp + 0x80]
mov dword [esp + 0x1c], esi
jmp 0x418bf3
mov edi, dword [esp + 0x80]
jmp 0x418beb
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x1c], 0x479eb0
call fcn.00410b00
sub esp, 0x18
mov ecx, esp
push dword [esp + 0x34]
call fcn.00401270
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00410ec0
test eax, eax
sete byte [esp + 0x13]
test edi, edi
je 0x418c29
push edi
call fcn.004547da
add esp, 4
test esi, esi
je 0x418c36
push esi
call fcn.004547da
add esp, 4
cmp byte [esp + 0x13], 0
je 0x418c74
push str.Cmd_line_error
push str.update
push 0x37
push str.uiWechatUpdate.cpp
push 4
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
lea ecx, [esp + 0x94]
push 0x3f3
call fcn.00404620
jmp 0x419096
mov ecx, dword [esp + 0x20]
call fcn.00419210
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x495f78
push 0x67
push edi
call esi
push 0x64
push 0x496040
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00424431
push ecx
call fcn.0042f414
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
call fcn.004189f0
call fcn.004205c0
test al, al
je 0x418eaa
push str.need_Admin_Privileges
push str.update
push 0x50
push str.uiWechatUpdate.cpp
push 2
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
call fcn.00422330
test eax, eax
jne 0x418eaa
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
mov dword [esp + 0x88], eax
mov dword [esp + 0x94], eax
call fcn.00403f60
push str._FROM_SELF
lea ecx, [esp + 0x84]
call fcn.004043a0
test al, al
je 0x418d5d
push str.Elevate_to_Admin_Privileges_failed_
push str.update
push 0x56
push str.uiWechatUpdate.cpp
push 2
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
lea ecx, [esp + 0x80]
call fcn.00404110
jmp 0x419096
push str.Elevate_to_Admin_Privileges
push str.update
push 0x59
push str.uiWechatUpdate.cpp
push 2
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
lea eax, [esp + 0xc0]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x418e9e
push 0x38
lea eax, [esp + 0x4c]
push 0
push eax
mov dword [esp + 0x50], 0x3c
call fcn.0045a8b0
add esp, 0xc
lea eax, [esp + 0xc0]
push ebx
lea ecx, [esp + 0xac]
mov dword [esp + 0x54], str.runas
mov dword [esp + 0x58], eax
call fcn.0040aa50
push 0xa
push ecx
lea ecx, [esp + 0xb0]
call fcn.00419260
cmp dword [esp + 0xbc], 8
push str.lanch_self
push str.update
push 0x66
lea eax, [esp + 0xb4]
cmovae eax, dword [esp + 0xb4]
push str.uiWechatUpdate.cpp
push 2
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], 1
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x418e75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x418e92
push str.cancelled_elevation
push str.update
push 0x6d
push str.uiWechatUpdate.cpp
push 4
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
lea ecx, [esp + 0x94]
push 0x3f4
call fcn.00404620
lea ecx, [esp + 0xa8]
call fcn.0040aab0
lea ecx, [esp + 0x80]
call fcn.00404110
jmp 0x419096
lea ecx, [esp + 0xa8]
call fcn.0040aab0
lea ecx, [esp + 0x80]
call fcn.00404110
call fcn.00410b00
mov ecx, eax
call fcn.004142e0
test al, al
jne 0x419096
push 0x2e4
call fcn.00454627
mov esi, eax
add esp, 4
test esi, esi
je 0x41908a
push ecx
mov ecx, esi
call fcn.00419160
mov ecx, esi
call fcn.004194b0
mov esi, eax
test esi, esi
je 0x41908a
sub esp, 0x14
lea eax, [esp + 0xa8]
mov ecx, esp
push eax
call fcn.00403fa0
mov ecx, esi
call fcn.00419e70
mov eax, dword [esi]
push 0
push 0x320
push 0x258
push 0
push 0
push 0x60000
push 0x10cf0000
push str.wechat_update
push 0
mov ecx, esi
call dword [eax + 0x94]
mov ecx, esi
call fcn.00427b84
push ecx
mov ecx, esi
call fcn.00427cba
cmp dword [esp + 0x24], 0xc8
jne 0x418f73
push str.silent_update
push str.update
push 0x8d
push str.uiWechatUpdate.cpp
push 2
call fcn.0040f8f0
push eax
call fcn.00402130
add esp, 0x18
push 0
jmp 0x418f75
push 5
mov ecx, esi
call fcn.00427a54
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [esp + 0x20], eax
push 0
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
je 0x418fe9
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x418fd8
lea eax, [esp + 0x28]
push eax
call edi
lea eax, [esp + 0x28]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
call esi
test eax, eax
jne 0x418fb3
call fcn.00410b00
mov ecx, eax
call fcn.004143d0
cmp dword [esp + 0x24], 0xc8
je 0x41906d
cmp dword [esp + 0x30], 1
jne 0x419030
sub esp, 0x14
mov ecx, esp
push 0xffffffffffffffff
push 0x481274
call fcn.00403f60
sub esp, 0x14
mov ecx, esp
push 0xffffffffffffffff
push str.WeChat.exe
call fcn.00403f60
call fcn.004223d0
add esp, 0x28
cmp dword [esp + 0x30], 2
jne 0x41906d
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push str.http:__weixin.qq.com_
push str.open
push 0
call esi
cmp eax, 0x20
jg 0x41906d
push 1
push 0
push str.http:__weixin.qq.com_
push str.iexplore.exe
push str.open
push 0
call esi
mov esi, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret 0x10
call fcn.00410b00
mov ecx, eax
call fcn.004143d0
mov eax, dword [esp + 0x94]
xor esi, esi
test eax, eax
je 0x4190ac
push eax
call fcn.004547da
add esp, 4
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4190c0
push eax
call fcn.004547da
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2c0]
xor ecx, esp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4969d0]
test al, 1
jne 0x41911d
or eax, 1
sub esp, 8
mov dword [0x4969d0], eax
mov dword [0x4969ac], 0
mov dword [0x4969b0], 0
mov dword [0x4969b4], 0
call fcn.00401b40
push 0x471ef0
call fcn.00453882
add esp, 4
push str.Cmd_line_is_null_or_empty_error
push str.update
push 0x2f
push str.uiWechatUpdate.cpp
push 4
push 0x496990
call fcn.00402130
mov ecx, dword [esp + 0x2e4]
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00452ca6
mov esp, ebp
pop ebp
ret 0x10