Function at 0x4296e9
Capabilities:
Move file

Disassembly:
push 0x398
mov eax, 0x4796f4
call fcn.0045053c
mov esi, edx
mov dword [ebp - 0x30c], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3a4]
mov dword [ebp - 0x318], eax
xor ebx, ebx
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x308], ebx
push eax
push str.ApplyXmlUpdate
mov dword [ebp - 0x2e8], ebx
call fcn.0041dfa0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2e4]
call fcn.0044a4e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2fc]
call fcn.0044a4d0
call fcn.00409480
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00408c39
mov byte [ebp - 4], 3
call fcn.00409480
push eax
lea ecx, [ebp - 0x314]
call fcn.00408c39
mov byte [ebp - 4], 5
call fcn.00409480
push eax
lea ecx, [ebp - 0x304]
call fcn.00408c39
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x398]
call fcn.0043244b
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x300]
call fcn.0044a4d0
or edi, 0xffffffff
mov byte [ebp - 0x2f1], bl
mov bh, bl
test esi, esi
je 0x429ec8
xor ecx, ecx
cmp word [esi], cx
je 0x429ec8
push esi
lea ecx, [ebp - 0x2ec]
call fcn.0040a211
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2ec]
call fcn.0041f4d8
mov bl, al
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ec]
add ecx, 0xfffffff0
call fcn.00409575
test bl, bl
jne 0x429848
xor eax, eax
push eax
mov word [ebp - 0x14], ax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x429839
cmp word [ebp - 0x21c], 0
je 0x429839
lea ecx, [ebp - 0x21c]
call fcn.0040b056
push eax
lea eax, [ebp - 0x21c]
push eax
jmp 0x429851
mov dword [ebp - 0x2e8], 0x57
jmp 0x429edb
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x2f0]
call fcn.0040afd8
push 0x5c
push 0x2f
lea ecx, [ebp - 0x2f0]
call fcn.0040a11e
xor eax, eax
lea ecx, [ebp - 0x2e4]
push eax
push 0x74
push esi
lea eax, [ebp - 0x324]
push eax
call fcn.0044b420
lea ecx, [ebp - 0x324]
call fcn.0044a600
test al, al
jne 0x4298c6
push dword [ebp - 0x320]
lea ecx, [ebp - 0x324]
push dword [ebp - 0x324]
call fcn.0044af30
push eax
push str.XML_is_not_valid:___hs__error:_u__file_offset:_u
call fcn.0041dafb
add esp, 0x10
mov dword [ebp - 0x2e8], 0xd
jmp 0x429edb
push 0x5c
push dword [ebp - 0x2f0]
call fcn.00450d4e
pop ecx
pop ecx
test eax, eax
jne 0x4298de
or eax, 0xffffffff
jmp 0x4298e6
sub eax, dword [ebp - 0x2f0]
sar eax, 1
lea esi, [eax + 1]
push esi
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00416d0f
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x314]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2f8]
lea ecx, [ecx - 0x10]
call fcn.00409575
push esi
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.0040c287
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2f0]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2f8]
lea ecx, [ecx - 0x10]
call fcn.00409575
lea ecx, [ebp - 0x2f0]
call fcn.0040a0f6
push str.aswmicroupdate
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.0044ab20
lea ecx, [ebp - 0x2fc]
mov eax, dword [eax]
mov dword [ebp - 0x2fc], eax
call fcn.0044a600
test al, al
jne 0x4298b7
xor eax, eax
lea ecx, [ebp - 0x2fc]
mov esi, eax
lea eax, [ebp - 0x2ec]
push str.version
push eax
call fcn.0044aa60
lea ecx, [ebp - 0x2ec]
call fcn.0044a630
test eax, eax
je 0x4299ca
xor eax, eax
lea ecx, [ebp - 0x2ec]
push eax
call fcn.0044aa00
mov esi, eax
cmp esi, edi
jle 0x4299e1
cmp esi, 0x15
jg 0x4299e1
mov eax, dword [ebp - 0x2fc]
mov edi, esi
mov dword [ebp - 0x300], eax
push str.aswmicroupdate
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0044b600
lea ecx, [ebp - 0x2fc]
mov eax, dword [eax]
mov dword [ebp - 0x2fc], eax
call fcn.0044a630
test eax, eax
jne 0x429990
lea ecx, [ebp - 0x300]
call fcn.0044a600
test al, al
jne 0x4298b7
push str.flags
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x300]
call fcn.0044aa60
lea ecx, [ebp - 0x310]
call fcn.0044a630
test eax, eax
je 0x429aef
lea ecx, [ebp - 0x310]
call fcn.0044e3b0
mov bl, byte [ebp - 0x2f1]
mov dword [ebp - 0x2ec], eax
lea ecx, [ebp - 0x2ec]
call fcn.0041e8af
mov esi, dword [ebp - 0x2ec]
push 8
push str.noreboot
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x429a95
add esi, 0x10
mov bl, 1
mov dword [ebp - 0x2ec], esi
jmp 0x429a63
push 6
push str.reboot
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x429abf
add esi, 0xc
mov dword [ebp - 0x2ec], esi
call fcn.0042f494
test al, al
jne 0x429a63
mov bh, 1
jmp 0x429a63
lea ecx, [ebp - 0x2ec]
call fcn.0041e8af
mov eax, dword [ebp - 0x2ec]
xor ecx, ecx
cmp word [eax], cx
je 0x429af5
push str.aswmicroupdate
push eax
push str.Invalid_flag__s_in_node__s
call fcn.0041dafb
add esp, 0xc
jmp 0x4298b7
mov bl, byte [ebp - 0x2f1]
mov edi, dword [0x4a0464]
mov eax, edi
inc edi
mov dword [0x4a0464], edi
test eax, eax
je 0x429b59
call fcn.00420ab9
mov esi, dword [0x4a03b8]
mov ecx, 0x4a03b8
push dword [esi + 4]
push ecx
call fcn.0040c7a2
mov dword [esi + 4], esi
xor edi, edi
mov dword [esi], esi
mov ecx, 0x4a03c0
mov dword [esi + 8], esi
mov esi, dword [0x4a03c0]
mov dword [0x4a03bc], edi
push dword [esi + 4]
push ecx
call fcn.0040c83a
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [0x4a03c4], edi
mov edi, dword [0x4a0464]
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x398], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor eax, eax
push eax
mov esi, edx
call fcn.0046505b
push edi
push esi
push eax
lea eax, [ebp - 0x304]
push str._u_03u_02u
push eax
call fcn.00408e2a
add esp, 0x18
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x304]
call fcn.0040a2f5
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00408c39
mov byte [ebp - 4], 0xf
xor ecx, ecx
mov eax, dword [ebp - 0x304]
lea edx, [ebp - 0x30c]
inc ecx
mov dword [ebp - 0x30c], 0x2e
mov dword [ebp - 0x308], ecx
push dword [eax - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x2ec]
call fcn.0040a347
add esp, 0xc
lea eax, [ebp - 0x2ec]
lea ecx, [ebp - 0x390]
push eax
call fcn.0040a1c3
xor eax, eax
inc eax
mov dword [ebp - 0x308], eax
and eax, 0xfffffffe
mov dword [ebp - 0x308], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2ec]
lea ecx, [ecx - 0x10]
call fcn.00409575
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x394]
call fcn.0040a1c3
lea eax, [ebp - 0x2f0]
mov esi, 0x4a034c
push eax
mov ecx, esi
call fcn.0040a1c3
lea edx, [ebp - 0x398]
lea ecx, [ebp - 0x300]
call fcn.0042a281
mov ecx, esi
mov dword [ebp - 0x2e8], eax
call fcn.00408f6d
cmp dword [ebp - 0x2e8], 0
jne 0x429edb
mov ecx, dword [ebp - 0x318]
test ecx, ecx
je 0x429c7e
mov al, byte [ebp - 0x383]
mov byte [ecx], al
xor edx, edx
lea ecx, [ebp - 0x398]
inc edx
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.0042fed0
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
push 2
pop edx
lea ecx, [ebp - 0x398]
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
push 3
pop edx
lea ecx, [ebp - 0x398]
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.00430296
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
push 4
pop edx
lea ecx, [ebp - 0x398]
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
push 5
pop edx
lea ecx, [ebp - 0x398]
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.0043065d
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
push 6
pop edx
lea ecx, [ebp - 0x398]
call fcn.00430845
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.00430cef
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.004304f5
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x429edb
lea ecx, [ebp - 0x398]
call fcn.00431069
cmp byte [ebp - 0x38a], 0
jne 0x429dbf
test bh, bh
je 0x429ed2
test bl, bl
jne 0x429ed2
mov eax, dword [0x4a03e0]
lea ecx, [ebp - 0x2f8]
push ecx
mov esi, 0x2001f
xor ebx, ebx
or eax, esi
push eax
push ebx
push dword [0x4a03dc]
push dword [0x4a03d8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429e66
push ebx
lea eax, [ebp - 0x2ec]
push eax
push ebx
push esi
push 1
push ebx
push ebx
push str.EmUpdatePending
push dword [ebp - 0x2f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x429e5e
mov eax, dword [ebp - 0x378]
mov esi, dword [eax]
jmp 0x429e52
cmp dword [esi + 0x10], ebx
je 0x429e50
push ebx
call fcn.0046508b
mov ecx, dword [ebp - 0x2ec]
push edx
push eax
push dword [esi + 0x10]
mov edx, str.MicroUpdates
call fcn.004200ac
mov eax, dword [ebp - 0x378]
add esp, 0x10
mov esi, dword [esi]
cmp esi, eax
jne 0x429e27
push dword [ebp - 0x2ec]
call edi
push dword [ebp - 0x2f8]
call edi
mov eax, dword [0x4a03ec]
cmp dword [eax - 0xc], ebx
je 0x429ed2
push eax
push str.Creating_reboot_file:__s
call fcn.0041dafb
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [0x4a03ec]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x429ed2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xb7
je 0x429ed2
push 4
push ebx
push dword [0x4a03ec]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x429ed2
mov dword [ebp - 0x2e8], 0x57
cmp dword [ebp - 0x2e8], 0
je 0x429f4f
lea ecx, [ebp - 0x398]
call fcn.00430d72
lea ecx, [ebp - 0x398]
call fcn.00430e16
lea ecx, [ebp - 0x398]
call fcn.00430f76
mov eax, dword [ebp - 0x368]
mov esi, dword [eax]
jmp 0x429f22
cmp byte [esi + 0x14], 0
jne 0x429f20
cmp byte [esi + 0x15], 0
je 0x429f20
mov ecx, dword [esi + 0x10]
call fcn.0042557e
mov eax, dword [ebp - 0x368]
mov esi, dword [esi]
cmp esi, eax
jne 0x429f06
mov edi, dword [ebp - 0x350]
mov esi, dword [edi]
jmp 0x429f4b
cmp byte [esi + 9], 0
jne 0x429f49
cmp byte [esi + 8], 0
je 0x429f49
mov ecx, dword [esi + 0x10]
call fcn.0042557e
xor eax, eax
mov byte [esi + 8], al
mov esi, dword [esi]
cmp esi, edi
jne 0x429f30
cmp byte [0x4a0471], 0
je 0x429f69
mov edx, dword [ebp - 0x2e8]
lea ecx, [ebp - 0x398]
call fcn.004308d3
cmp dword [ebp - 0x2e8], 0
jne 0x429fa4
mov ecx, dword [0x4a0430]
cmp dword [0x4a0440], ecx
cmovne ecx, dword [0x4a0440]
mov dword [0x4a0430], ecx
mov ecx, dword [0x4a042c]
cmp dword [0x4a043c], ecx
cmovne ecx, dword [0x4a043c]
mov dword [0x4a042c], ecx
mov esi, dword [ebp - 0x2e8]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x398]
call fcn.0042a016
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x304]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x314]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2f0]
lea ecx, [ecx - 0x10]
call fcn.00409575
xor eax, eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x2e4]
call fcn.0044a5c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a4]
call fcn.0041e015
mov eax, esi
call fcn.004504e6
ret