Function at 0x414400
Capabilities:
Create directory
Create process on windows
Create process suspended
Delete file
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3894
call fcn.0042d2a0
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xc26]
push ecx
mov word [ebp - 0xc28], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x1436]
push eax
mov word [ebp - 0x1438], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x816]
push edx
mov word [ebp - 0x818], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0xa1e]
push ecx
mov word [ebp - 0xa20], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x102e]
push eax
mov word [ebp - 0x1030], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x122e]
push ecx
mov word [ebp - 0x1230], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0xe26]
push eax
mov word [ebp - 0xe28], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x60e]
push edx
mov word [ebp - 0x610], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x40e]
mov word [ebp - 0x410], ax
push ecx
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0x1c36]
push eax
mov word [ebp - 0x1c38], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x3fe
push ecx
lea edx, [ebp - 0x2036]
push edx
mov word [ebp - 0x2038], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x1836]
push ecx
mov word [ebp - 0x1838], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x2836]
push eax
mov word [ebp - 0x2838], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x3836]
push edx
mov word [ebp - 0x3838], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x3036]
push ecx
mov word [ebp - 0x3038], ax
call fcn.00428450
add esp, 0xc
push 0x104
lea edx, [ebp - 0xc28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
movzx ecx, word [ebp + eax - 0xc28]
mov word [ebp + eax - 0x1030], cx
add eax, 2
test cx, cx
jne 0x414610
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0xc28]
mov word [ebp + eax - 0x1438], cx
add eax, 2
test cx, cx
jne 0x414630
lea eax, [ebp - 0xc28]
push 0x5c
push eax
call fcn.0042220c
add esp, 8
test eax, eax
je 0x4146e3
lea ecx, [ebp - 0xc28]
push 0x5c
push ecx
call fcn.0042220c
add eax, 2
lea edx, [ebp - 0x818]
add esp, 8
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x414680
xor eax, eax
jmp 0x4146a0
movzx ecx, word [ebp + eax - 0x818]
mov word [ebp + eax - 0xa20], cx
add eax, 2
test cx, cx
jne 0x4146a0
lea edx, [ebp - 0xa20]
push 0x2e
push edx
call fcn.0042220c
add esp, 8
test eax, eax
je 0x4146e3
lea eax, [ebp - 0xa20]
push 0x2e
push eax
call fcn.0042220c
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x1030]
push 0x5c
push edx
call fcn.0042220c
add esp, 8
test eax, eax
je 0x41470e
lea eax, [ebp - 0x1030]
push 0x5c
push eax
call fcn.0042220c
add esp, 8
xor ecx, ecx
mov word [eax], cx
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0xa20]
push edx
lea eax, [ebp - 0x1030]
push eax
lea ecx, [ebp - 0x210]
push str._s_s.dat
push ecx
call edi
add esp, 0x10
call fcn.00403500
test eax, eax
jne 0x414c5c
cmp dword [0x48ba94], 1
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jne 0x41475d
push str._ManualUpdate__Elevate_AD_
call ebx
xor esi, esi
call fcn.0040d300
lea edx, [ebp - 0xa20]
push str.setup
push edx
call fcn.00422d63
add esp, 8
test eax, eax
jne 0x414783
push str._ManualUpdate__Elevate_setup_
call ebx
xor esi, esi
call fcn.0040d300
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00422520
add esp, 8
test eax, eax
jne 0x4147f2
push str._ManualUpdate__Read_Out_Dat_1_
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
push 0x3fe
lea edx, [ebp - 0x2838]
push edx
push 0x43d31c
push 0x441e2c
push str.Config
call esi
lea eax, [ebp - 0x210]
push eax
push 0x3fe
lea ecx, [ebp - 0x3838]
push ecx
push 0x43d31c
push str.Passphrase
push str.Config
call esi
jmp 0x41490b
cmp dword [0x490708], 0
jbe 0x4148fd
cmp dword [0x490720], 0
jbe 0x4148fd
push str._ManualUpdate__Read_Install_Dat_2_
call ebx
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x816]
push eax
mov word [ebp - 0x818], dx
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0x818]
push str.C:UsersPublicSMR7
push ecx
call edi
add esp, 8
push 0
lea edx, [ebp - 0x818]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x210]
push str.C:UsersPublicSMR7_s.dat
push ecx
call edi
mov edx, dword [0x4906fc]
mov eax, dword [0x4906f8]
add esp, 0xc
push edx
push eax
lea ecx, [ebp - 0x210]
push ecx
mov ecx, 1
call fcn.004024f0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0x1f4
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x210]
push edx
push 0x3fe
lea eax, [ebp - 0x2838]
push eax
push 0x43d31c
push 0x441e2c
push str.Config
call edi
lea ecx, [ebp - 0x210]
push ecx
push 0x3fe
lea edx, [ebp - 0x3838]
push edx
push 0x43d31c
push str.Passphrase
push str.Config
call edi
push 0x1f4
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41490b
push str._ManualUpdate__Elevate_Exception_Type_
call ebx
xor esi, esi
call fcn.0040d300
lea eax, [ebp - 0x2838]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414914
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x414974
lea eax, [ebp - 0x3838]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414933
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x414974
push str._ManualUpdate__Have_to_Using_CPWL_Run...
call ebx
lea edi, [ebp - 0x2038]
lea esi, [ebp - 0x2838]
call fcn.00407400
lea edi, [ebp - 0x1c38]
lea esi, [ebp - 0x3838]
call fcn.00407400
jmp 0x414982
push str._ManualUpdate__Elevate_Dat_size_Error_or_Empty_
call ebx
xor esi, esi
call fcn.0040d300
xor eax, eax
jmp 0x414990
movzx ecx, word [ebp + eax - 0x2038]
mov word [ebp + eax - 0x1838], cx
add eax, 2
test cx, cx
jne 0x414990
lea ecx, [ebp - 0x1838]
push 0x5c
push ecx
call fcn.0042220c
add esp, 8
lea edx, [ebp - 0x1838]
test eax, eax
je 0x414a13
push 0x5c
push edx
call fcn.0042220c
add eax, 2
push 0x100
push eax
lea eax, [ebp - 0x610]
push eax
call fcn.0042393f
add esp, 0x14
lea ecx, [ebp - 0x1838]
push 0x5c
push ecx
call fcn.0042220c
xor edx, edx
mov word [eax], dx
push 0x100
lea eax, [ebp - 0x1838]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.0042393f
add esp, 0x14
jmp 0x414a47
push 0x100
push edx
lea eax, [ebp - 0x610]
push eax
call fcn.0042393f
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x43c7f8]
mov word [ebp + eax - 0x410], cx
add eax, 2
test cx, cx
jne 0x414a30
lea ecx, [ebp - 0xe28]
push ecx
lea edx, [ebp - 0x1230]
push edx
call fcn.0040d590
lea eax, [ebp - 0x1c38]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414a66
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, edx
sar eax, 1
mov esi, eax
call ebx
push eax
push esi
lea eax, [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x610]
push ecx
lea edx, [ebp - 0xe28]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x3038]
push str._ManualUpdate__GetProcessInfo___s___s_____s___s_____u___lu_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x20
lea edx, [ebp - 0x3038]
push edx
call edi
push 1
lea eax, [ebp - 0x410]
push 0x43c7f8
push eax
call fcn.004243b6
add esp, 0xc
test eax, eax
jne 0x414b0a
lea ecx, [ebp - 0x610]
push ecx
lea edx, [ebp - 0x1230]
push edx
call fcn.00422d63
add esp, 8
test eax, eax
jne 0x414b03
push str._ManualUpdate__DAT_Using_Local__Account_Match__Elevate__
call edi
xor esi, esi
call fcn.0040d300
push str._ManualUpdate__DAT_Using_Local__Account_MisMatch__Create...
jmp 0x414b6d
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x1230]
push ecx
call fcn.00422d63
add esp, 8
test eax, eax
jne 0x414b68
lea eax, [ebp - 0xe28]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414b30
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0xe28]
push eax
call fcn.004243b6
add esp, 0xc
test eax, eax
jne 0x414b68
push str._ManualUpdate__DAT_Using_Domain__All_Match__Elevate__
call edi
xor esi, esi
call fcn.0040d300
push str._ManualUpdate__DAT_Using_Domain__MisMatch__Create...
call edi
xor eax, eax
push 0x40
push eax
lea ecx, [ebp - 0x388c]
push ecx
mov dword [ebp - 0x3848], 0
mov dword [ebp - 0x3844], eax
mov dword [ebp - 0x3840], eax
mov dword [ebp - 0x383c], eax
call fcn.00428450
add esp, 0xc
lea edx, [ebp - 0x3848]
push edx
lea eax, [ebp - 0x3890]
push eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1438]
push ecx
push 0
lea edx, [ebp - 0x1c38]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x610]
push ecx
mov dword [ebp - 0x3890], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov edi, eax
lea eax, [ebp - 0x1c38]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414bf0
sub eax, edx
sar eax, 1
mov esi, eax
call ebx
push eax
push edi
lea edx, [ebp - 0x1438]
push edx
push esi
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x3038]
push str._ManualUpdate__CreateProcess___s_s___u___s___lu___lu_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp - 0x3038]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x3848]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x3844]
push edx
call esi
push 0
call fcn.00424079
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret