Function at 0x402979
Capabilities:
Create process on windows
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x41a0a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0x10]
push edi
push str.Starting_update_process_as_the_service_in_session_0.
mov dword [ebp - 0x430], eax
call fcn.0040101c
mov esi, eax
call fcn.004040cc
pop ecx
push 0x40
xor esi, esi
lea eax, [ebp - 0x498]
push esi
push eax
call fcn.004056c0
mov dword [ebp - 0x454], esi
xor eax, eax
lea edi, [ebp - 0x450]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push ebx
push dword [ebp - 0x43c]
mov dword [ebp - 0x49c], 0x44
mov dword [ebp - 0x494], str.winsta0Default
stosd dword es:[edi], eax
call fcn.00403a5a
cmp dword [ebp - 0x43c], 2
pop ecx
pop ecx
mov dword [ebp - 0x438], eax
jl 0x402a2b
or dword [ebp - 0x470], 1
xor eax, eax
mov dword [ebp - 0x494], 0x416550
mov word [ebp - 0x46c], ax
push str.updater.ini
push dword [ebx]
lea edi, [ebp - 0x42c]
mov dword [ebp - 0x440], esi
call fcn.00404198
pop ecx
pop ecx
test eax, eax
je 0x402a79
push str.updater.tmp
push dword [ebx]
lea edi, [ebp - 0x21c]
call fcn.00404198
pop ecx
pop ecx
test eax, eax
je 0x402a79
push 1
mov eax, edi
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x440], eax
push str.MOZ_USING_SERVICE1
call fcn.00405c05
pop ecx
push dword [ebp - 0x438]
push str.Starting_service_with_cmdline:__ls
call fcn.0040101c
mov esi, eax
call fcn.004040cc
pop ecx
pop ecx
lea eax, [ebp - 0x454]
push eax
xor edi, edi
lea eax, [ebp - 0x49c]
push eax
push edi
push edi
push 0x4000000
push edi
push edi
push edi
push dword [ebp - 0x438]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp - 0x430]
push str.MOZ_USING_SERVICE
mov dword [esi], eax
call fcn.00405c05
pop ecx
mov dword [ebp - 0x434], edi
cmp dword [esi], edi
je 0x402c2d
push str.Process_was_started..._waiting_on_result.
call fcn.0040101c
mov esi, eax
call fcn.004040cc
mov dword [esp], 0xdbba0
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402b21
push 1
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x402b75
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x402b63
push dword [ebp - 0x430]
push str.Process_finished_with_return_code__d.
call fcn.0040101c
mov esi, eax
call fcn.004040cc
xor eax, eax
cmp dword [ebp - 0x430], edi
pop ecx
sete al
mov dword [ebp - 0x434], eax
jmp 0x402b74
push str.Process_finished_but_could_not_obtain_return_code.
call fcn.0040101c
mov esi, eax
call fcn.004040f1
pop ecx
push dword [ebp - 0x454]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x450]
call esi
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x430], edi
call fcn.0040276b
pop ecx
test eax, eax
je 0x402c50
cmp dword [ebp - 0x430], edi
je 0x402c50
cmp dword [ebp - 0x434], edi
je 0x402bf8
push str.update.status_is_still_applying_even_know_update__was_successful.
call fcn.0040101c
mov esi, eax
call fcn.004040cc
pop ecx
mov ecx, dword [ebx + 4]
push 0x1d
call fcn.00404672
pop ecx
test eax, eax
jne 0x402bf0
push str.Could_not_write_update.status_still_applying_on_success_error.
call fcn.0040101c
mov esi, eax
call fcn.004040f1
pop ecx
mov dword [ebp - 0x434], edi
jmp 0x402c50
push str.update.status_is_still_applying_and_update_was_not_successful.
call fcn.0040101c
mov esi, eax
call fcn.004040f1
pop ecx
mov ecx, dword [ebx + 4]
push 0x1e
call fcn.00404672
pop ecx
test eax, eax
jne 0x402c50
push str.Could_not_write_update.status_still_applying_on_success_error.
call fcn.0040101c
mov esi, eax
call fcn.004040f1
pop ecx
jmp 0x402c50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x438]
push dword [ebx]
push str.Could_not_create_process_as_current_user__updaterPath:__ls__cmdLine:__ls.____d_
call fcn.0040101c
mov esi, eax
call fcn.004040f1
add esp, 0x10
cmp dword [ebp - 0x440], edi
je 0x402cd2
push 1
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x434], edi
je 0x402cd2
cmp dword [ebp - 0x43c], 2
jle 0x402cd2
push dword [ebp - 0x43c]
mov edi, dword [ebx + 4]
mov eax, ebx
call fcn.004028d5
pop ecx
test al, al
jne 0x402cd2
push str.Launching_post_update_process_as_the_service_in_session_0.
call fcn.0040101c
mov esi, eax
call fcn.004040cc
pop ecx
mov ecx, dword [ebp - 0x444]
push edi
call fcn.004041f2
pop ecx
test eax, eax
jne 0x402cd2
push edi
push dword [ebp - 0x444]
push str.The_post_update_process_could_not_be_launched._installDir:__ls__updateInfoDir:__ls
call fcn.0040101c
mov esi, eax
call fcn.004040f1
add esp, 0xc
push dword [ebp - 0x438]
call fcn.00405912
mov eax, dword [ebp - 0x434]
pop ecx
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00404ed1
leave
ret