Function at 0x4033e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5691dc
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5cce5c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0040d988
mov ecx, eax
test ecx, ecx
je 0x40368d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
call fcn.0040d988
mov ecx, eax
test ecx, ecx
je 0x403697
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
mov esi, 0xea60
push eax
call fcn.00403d30
mov edi, eax
add esp, 8
cmp edi, 7
jne 0x40349e
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push esi
call ebx
add esi, esi
mov eax, 0x6fd91d85
mul esi
shr edx, 0x11
imul eax, edx, 0xfffb6c20
add esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403d30
mov edi, eax
add esp, 8
cmp edi, 7
je 0x403470
call fcn.0040d988
mov ecx, eax
test ecx, ecx
je 0x4036a1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push edi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push str.eFail:__d
push eax
call fcn.00406040
mov eax, dword [ebp - 0x1c]
add esp, 8
add eax, 0xfffffff0
mov esi, esp
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], eax
push eax
call fcn.004027a0
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.00402ac0
add esp, 4
or esi, 0xffffffff
cmp edi, 1
jne 0x40361f
call fcn.0040d988
mov ecx, eax
test ecx, ecx
je 0x4036ab
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str._upgrade
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
test eax, 0xffff0000
jne 0x403536
movzx eax, ax
push eax
call fcn.004061f0
jmp 0x403542
push 8
push str._upgrade
call fcn.004062f0
mov edi, dword [ebp - 0x14]
push 5
push 0
push edi
push dword [ebp - 0x10]
mov byte [ebp - 4], 4
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
cmp ebx, 0x20
ja 0x403604
call fcn.0040d988
mov ecx, eax
test ecx, ecx
je 0x4036b5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 5
push str.Failed_to_run_the_updater._Please_contact_your_IT_admin._n_nError_code__d
push eax
call fcn.00406040
mov esi, dword [ebp - 0x20]
add esp, 8
mov ebx, esp
mov dword [ebp - 0x24], ebx
lea eax, [esi - 0x10]
push eax
mov dword [ebp - 0x24], eax
call fcn.004027a0
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00402ac0
add esp, 4
push 0
push 0
push esi
call fcn.00412c77
mov edx, dword [ebp - 0x24]
or esi, 0xffffffff
mov byte [ebp - 4], 4
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4035e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x403600
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
jmp 0x403621
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40361f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov bl, 1
mov edx, dword [ebp - 0x28]
mov eax, esi
mov byte [ebp - 4], 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40363c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40365a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x403679
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402780
push 0x80004005
call fcn.00402780
push 0x80004005
call fcn.00402780
push 0x80004005
call fcn.00402780
push 0x80004005
call fcn.00402780
int3