Function at 0x10009ec0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 8], eax
test edi, edi
je 0x1000a110
cmp word [edi], 0
je 0x1000a110
test eax, eax
je 0x1000a110
cmp word [eax], 0
je 0x1000a110
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__fi__Services_eq_gupdate___F
call esi
push 0
push str.taskkill__fi__Services_eq_gupdatem___F
call esi
push 0
push str.net_stop_gupdate
call esi
push 0
push str.net_stop_gupdatem
call esi
mov ecx, 0x1005d2c0
call fcn.10020000
mov ecx, str.GoogleUpdateSetup.exe
call fcn.10020000
mov ecx, str.GoogleCrashHandler.exe
call fcn.10020000
mov ecx, str.GoogleCrashHandler64.exe
call fcn.10020000
mov ecx, str.GoogleUpdateCore.exe
call fcn.10020000
mov ecx, str.GoogleUpdateBroker.exe
call fcn.10020000
mov ecx, str.GoogleUpdateOnDemand.exe
call fcn.10020000
mov ecx, str.GoogleUpdateHelper.msi
call fcn.10020000
mov ecx, str.GoogleUpdateWebPlugin.msi
call fcn.10020000
mov ecx, str.GoogleUpdateComRegisterShell64.msi
call fcn.10020000
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
xor esi, esi
call fcn.100272ed
add esp, 4
mov ebx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Update
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000a0b3
test al, 0x10
je 0x1000a0b3
cmp byte [ebp + 8], 0
je 0x1000a09f
push 0x208
call fcn.100272ed
add esp, 4
mov esi, eax
mov dword [ebp - 4], esi
push ebx
push esi
call edi
push 0x1005d4c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000a0b3
push 0x208
call fcn.100272ed
add esp, 4
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.GoogleUpdate.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x208
call fcn.100272ed
add esp, 4
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..remove
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
call esi
push 4
push dword [ebp - 4]
mov edi, eax
push ebx
call esi
test eax, eax
jne 0x1000a095
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
lea eax, [edi + 0x6f]
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.1001fcd0
test eax, eax
jne 0x1000a0b3
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0x208
call fcn.100272ed
add esp, 4
mov edi, eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str._recovery
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
xor edx, edx
mov ecx, edi
call fcn.1001fc30
add esp, 4
push 1
push edi
call esi
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0x63
pop edi
mov esp, ebp
pop ebp
ret