Function at 0x401810
Capabilities:
Create directory
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
mov eax, dword [ebp + 8]
push esi
push edi
push eax
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40
lea ecx, [ebp - 0x50]
push esi
push ecx
mov edi, eax
mov dword [ebp - 0x54], esi
call fcn.00403390
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp edi, esi
je 0x401863
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x158]
push edx
call fcn.00401400
add esp, 4
test eax, eax
jne 0x401881
pop edi
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x159], 0x5c
lea eax, [ebp + eax - 0x159]
jne 0x4018a2
mov byte [eax], 0
mov ecx, dword [section..data]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push ecx
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x25c]
push str._s_s
push eax
call edi
push 0x40
lea ecx, [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x25c]
push edx
call fcn.00401660
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x25c]
push str._sjoin.me._s
push edx
call edi
add esp, 0x2c
push esi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401922
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401922
pop edi
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea esp, [esp]
mov eax, dword [esi + section..data]
test eax, eax
je 0x401989
push eax
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x4a4]
push str._s_s
push edx
call edi
mov eax, dword [esi + section..data]
push eax
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x3a0]
push str._s_s
push edx
call edi
add esp, 0x20
push 1
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
call ebx
add esi, 4
cmp esi, 0x24
jb 0x401930
push str.params.txt
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp - 0x4a4]
push str._s_s
push eax
call edi
push str.params.txt
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x3a0]
push str._s_s
push edx
call edi
add esp, 0x20
push 1
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
call ebx
push 0x5ba4
call fcn.00401030
add esp, 4
pop ebx
test eax, eax
jne 0x401a05
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x158]
push eax
call fcn.00401750
add esp, 8
pop edi
mov eax, 0x3eb
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [0x40de6c]
mov eax, dword [0x40de68]
push section..data
lea ecx, [ebp - 0x158]
push ecx
push edx
push eax
call fcn.00402c20
add esp, 0x10
test eax, eax
jne 0x401a4b
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x158]
push edx
call fcn.00401750
add esp, 8
pop edi
mov eax, 0x3ec
pop esi
mov esp, ebp
pop ebp
ret
push str.params.txt
push 0x5ba1
call fcn.00401200
add esp, 8
test eax, eax
je 0x401a82
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x158]
push ecx
call fcn.00401750
add esp, 8
pop edi
mov eax, 0x3ec
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edx, dword [section..data]
lea ecx, [ebp - 0x25c]
test eax, eax
je 0x401aab
push eax
push edx
lea eax, [ebp - 0x158]
push eax
push str.__s_s___update__url__s
push ecx
call edi
add esp, 0x14
jmp 0x401abe
push edx
lea eax, [ebp - 0x158]
push eax
push str.__s_s___update
push ecx
call edi
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x25c]
push edx
push 0
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
and eax, 0xfffffc13
pop edi
add eax, 0x3ed
pop esi
mov esp, ebp
pop ebp
ret