Function at 0x40f4a0
Capabilities:
Create process on windows
Create process suspended
Delete file
Get token membership
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x38a4
call fcn.004284b0
mov eax, dword [0x441044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0xc26]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xc28], ax
call fcn.004238b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0x1236]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1238], dx
call fcn.004238b0
add esp, 0xc
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x210], cx
call fcn.004238b0
add esp, 0xc
push 0x206
lea ecx, [ebp - 0xa1e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xa20], ax
call fcn.004238b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0xe2e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xe30], dx
call fcn.004238b0
add esp, 0xc
push 0x206
lea edx, [ebp - 0x416]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x418], cx
call fcn.004238b0
add esp, 0xc
push 0x1fe
lea ecx, [ebp - 0x102e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x1030], ax
call fcn.004238b0
add esp, 0xc
push 0x1fe
lea eax, [ebp - 0x1436]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1438], dx
call fcn.004238b0
add esp, 0xc
push 0x1fe
lea edx, [ebp - 0x816]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x818], cx
call fcn.004238b0
add esp, 0xc
xor eax, eax
push 0x1fe
mov word [ebp - 0x618], ax
push ebx
lea ecx, [ebp - 0x616]
push ecx
call fcn.004238b0
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x1c36]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1c38], dx
call fcn.004238b0
add esp, 0xc
push 0x3fe
lea edx, [ebp - 0x2036]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x2038], cx
call fcn.004238b0
add esp, 0xc
push 0x3fe
lea ecx, [ebp - 0x1836]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x1838], ax
call fcn.004238b0
add esp, 0xc
push 0x7fe
lea eax, [ebp - 0x3836]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x3838], dx
call fcn.004238b0
add esp, 0xc
push 0x7fe
lea edx, [ebp - 0x3036]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x3038], cx
call fcn.004238b0
add esp, 0xc
push 0x7fe
lea ecx, [ebp - 0x2836]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x2838], ax
call fcn.004238b0
mov edx, dword [0xb69a6b]
mov eax, dword [0x442973]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0xc28]
push ecx
push ebx
mov dword [0xc369d0], edx
mov dword [0xc35784], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
jmp 0x40f6d0
movzx ecx, word [ebp + eax - 0xc28]
mov word [ebp + eax - 0xe30], cx
add eax, 2
cmp cx, bx
jne 0x40f6d0
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0xc28]
mov word [ebp + eax - 0x1238], cx
add eax, 2
cmp cx, bx
jne 0x40f6f0
lea edx, [ebp - 0xc28]
push 0x5c
push edx
call fcn.0041c291
add esp, 8
test eax, eax
je 0x40f7a3
lea eax, [ebp - 0xc28]
push 0x5c
push eax
call fcn.0041c291
add eax, 2
lea edx, [ebp - 0x210]
add esp, 8
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x40f740
xor eax, eax
jmp 0x40f760
movzx ecx, word [ebp + eax - 0x210]
mov word [ebp + eax - 0xa20], cx
add eax, 2
cmp cx, bx
jne 0x40f760
lea ecx, [ebp - 0xa20]
push 0x2e
push ecx
call fcn.0041c291
add esp, 8
test eax, eax
je 0x40f7a3
lea edx, [ebp - 0xa20]
push 0x2e
push edx
call fcn.0041c291
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0xe30]
push 0x5c
push edx
call fcn.0041c291
add esp, 8
test eax, eax
je 0x40f7ce
lea eax, [ebp - 0xe30]
push 0x5c
push eax
call fcn.0041c291
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0xa20]
push edx
lea eax, [ebp - 0xe30]
push eax
lea ecx, [ebp - 0x418]
push str._s_s.dat
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x3844]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x3840]
push eax
mov dword [ebp - 0x3848], ebx
mov dword [ebp - 0x3844], ebx
mov dword [ebp - 0x3840], ebx
mov word [ebp - 0x383c], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40f84c
mov edx, dword [ebp - 0x3844]
lea ecx, [ebp - 0x3848]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40f852
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x3844]
cmp eax, ebx
je 0x40f863
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x3848], ebx
jne 0x40fe20
lea eax, [ebp - 0xa20]
push str.setup
push eax
call fcn.0041be77
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 8
test eax, eax
jne 0x40f89b
push str._ManualUpdate__Elevate_setup_
call edi
xor esi, esi
call fcn.00409540
lea ecx, [ebp - 0x418]
push ebx
push ecx
call fcn.0041c33e
add esp, 8
test eax, eax
jne 0x40f909
push str._ManualUpdate__Read_Out_Dat_1_
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x418]
push edx
push 0x3fe
lea eax, [ebp - 0x3838]
push eax
push 0x4321e4
push 0x4388b4
push str.Config
call esi
lea ecx, [ebp - 0x418]
push ecx
push 0x3fe
lea edx, [ebp - 0x3038]
push edx
push 0x4321e4
push str.Passphrase
push str.Config
call esi
jmp 0x40faf2
cmp dword [0xc369d0], ebx
jbe 0x40fae4
cmp dword [0xc35784], ebx
jbe 0x40fae4
push str._ManualUpdate__Read_Install_Dat_2_
call edi
push 0x206
lea ecx, [ebp - 0x20e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x210], ax
call fcn.004238b0
add esp, 0xc
xor eax, eax
jmp 0x40f950
movzx ecx, word [eax + str.C:Users]
mov word [ebp + eax - 0x210], cx
add eax, 2
cmp cx, bx
jne 0x40f950
lea edx, [ebp - 0x210]
push edx
call fcn.0041e06c
add esp, 4
cmp eax, 0xffffffff
jne 0x40f98a
lea eax, [ebp - 0x210]
push eax
call fcn.0041d598
add esp, 4
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x40f993
mov ecx, dword [str.Public]
mov edx, dword [0x439f08]
mov dword [eax], ecx
mov ecx, dword [0x439f0c]
mov dword [eax + 4], edx
mov edx, dword [0x439f10]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [ebp - 0x210]
push eax
call fcn.0041e06c
add esp, 4
cmp eax, 0xffffffff
jne 0x40f9e5
lea ecx, [ebp - 0x210]
push ecx
call fcn.0041d598
add esp, 4
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x40f9f0
mov edx, dword [str.SMR7]
mov ecx, dword [0x435a54]
mov dword [eax], edx
mov edx, dword [0x435a58]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [ebp - 0x210]
push eax
call fcn.0041e06c
add esp, 4
cmp eax, 0xffffffff
jne 0x40fa39
lea ecx, [ebp - 0x210]
push ecx
call fcn.0041d598
add esp, 4
lea edx, [ebp - 0xa20]
push edx
lea eax, [ebp - 0x418]
push str.C:UsersPublicSMR7_s.dat
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xc800
mov edx, str.A.K.S..
lea ecx, [ebp - 0x418]
call fcn.00408d90
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x1f4
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x418]
push ecx
push 0x3fe
lea edx, [ebp - 0x3838]
push edx
push 0x4321e4
push 0x4388b4
push str.Config
call edi
lea eax, [ebp - 0x418]
push eax
push 0x3fe
lea ecx, [ebp - 0x3038]
push ecx
push 0x4321e4
push str.Passphrase
push str.Config
call edi
push 0x1f4
call esi
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40faf2
push str._ManualUpdate__Elevate_Exception_Type_
call edi
xor esi, esi
call fcn.00409540
lea eax, [ebp - 0x3838]
lea edx, [eax + 2]
jmp 0x40fb00
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fb00
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x40fb67
lea eax, [ebp - 0x3038]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fb20
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x40fb67
push str._ManualUpdate__Have_to_Using_CPWL_Run...
call edi
lea edi, [ebp - 0x2038]
lea esi, [ebp - 0x3838]
call fcn.004040c0
lea edi, [ebp - 0x1c38]
lea esi, [ebp - 0x3038]
call fcn.004040c0
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40fb75
push str._ManualUpdate__Elevate_Dat_size_Error_or_Empty_
call edi
xor esi, esi
call fcn.00409540
xor eax, eax
jmp 0x40fb80
movzx ecx, word [ebp + eax - 0x2038]
mov word [ebp + eax - 0x1838], cx
add eax, 2
cmp cx, bx
jne 0x40fb80
lea eax, [ebp - 0x1838]
push 0x5c
push eax
call fcn.0041c291
add esp, 8
lea ecx, [ebp - 0x1838]
test eax, eax
je 0x40fc03
push 0x5c
push ecx
call fcn.0041c291
add eax, 2
push pe_nt_image_headers32
push eax
lea edx, [ebp - 0x818]
push edx
call fcn.0041d0af
add esp, 0x14
lea eax, [ebp - 0x1838]
push 0x5c
push eax
call fcn.0041c291
xor ecx, ecx
push pe_nt_image_headers32
lea edx, [ebp - 0x1838]
mov word [eax], cx
push edx
lea eax, [ebp - 0x618]
push eax
call fcn.0041d0af
add esp, 0x14
jmp 0x40fc37
push pe_nt_image_headers32
push ecx
lea edx, [ebp - 0x818]
push edx
call fcn.0041d0af
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x431904]
mov word [ebp + eax - 0x618], cx
add eax, 2
cmp cx, bx
jne 0x40fc20
lea eax, [ebp - 0x1438]
push eax
lea ecx, [ebp - 0x1030]
push ecx
call fcn.00409840
lea eax, [ebp - 0x1c38]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fc56
sub eax, edx
sar eax, 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea edx, [ebp - 0x1030]
push edx
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x1438]
push ecx
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x2838]
push str._ManualUpdate__GetProcessInfo___s___s_____s___s_____u___lu_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea ecx, [ebp - 0x2838]
push ecx
call edi
push 1
lea edx, [ebp - 0x618]
push 0x431904
push edx
call fcn.0041de69
add esp, 0xc
test eax, eax
jne 0x40fcf2
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x1030]
push ecx
call fcn.0041be77
add esp, 8
test eax, eax
jne 0x40fceb
push str._ManualUpdate__DAT_Using_Local__Account_Match__Elevate__
call edi
xor esi, esi
call fcn.00409540
push str._ManualUpdate__DAT_Using_Local__Account_MisMatch__Create...
jmp 0x40fd39
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x1030]
push eax
call fcn.0041be77
add esp, 8
test eax, eax
jne 0x40fd34
lea ecx, [ebp - 0x618]
push ecx
lea edx, [ebp - 0x1438]
push edx
call fcn.0041be77
add esp, 8
test eax, eax
jne 0x40fd34
push str._ManualUpdate__DAT_Using_Domain__All_Match__Elevate__
call edi
xor esi, esi
call fcn.00409540
push str._ManualUpdate__DAT_Using_Domain__MisMatch__Create...
call edi
xor eax, eax
push 0x40
mov dword [ebp - 0x3854], eax
mov dword [ebp - 0x3850], eax
mov dword [ebp - 0x384c], eax
lea eax, [ebp - 0x389c]
push ebx
push eax
mov dword [ebp - 0x3858], ebx
call fcn.004238b0
add esp, 0xc
lea ecx, [ebp - 0x3858]
push ecx
lea edx, [ebp - 0x38a0]
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1238]
push eax
push ebx
lea ecx, [ebp - 0x1c38]
push ecx
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x818]
push eax
mov dword [ebp - 0x38a0], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov edi, eax
lea eax, [ebp - 0x1c38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40fdb1
sub eax, edx
sar eax, 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x1238]
push ecx
push esi
lea edx, [ebp - 0x818]
push edx
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x2838]
push str._ManualUpdate__CreateProcess___s_s___u___s___lu___lu_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea edx, [ebp - 0x2838]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x3858]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x3854]
push ecx
call esi
push ebx
call fcn.0041dbfe
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bcde
mov esp, ebp
pop ebp
ret