Function at 0x140005b70
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf90
movaps xmmword [rsp + 0xf80], xmm6
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xf78], rax
xor edi, edi
lea r15, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.140015960
lea rsi, [0x140047aa0]
mov r8d, 0x104
mov rcx, r15
mov rdx, rsi
call fcn.140013508
lea rbx, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.140015960
mov r8d, 0x104
mov rcx, rbx
mov rdx, rsi
call fcn.140013508
lea rdx, str.updater.ini
mov rcx, rbx
call fcn.140032820
test eax, eax
je 0x140005cff
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor edi, edi
lea r9, [rsp + 0x940]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140005cff
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor edi, edi
lea r9, [rsp + 0x730]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140005cff
lea rdx, [0x14003db3e]
lea rcx, [rsp + 0x940]
call fcn.140015d7c
test rax, rax
jne 0x140005cfd
lea rdx, [0x14003db38]
lea rcx, [rsp + 0x940]
call fcn.140015d7c
test rax, rax
jne 0x140005cfd
lea rdx, [0x14003da72]
lea rcx, [rsp + 0x940]
call fcn.140015d7c
test rax, rax
jne 0x140005cfd
lea rdx, [0x14003da78]
lea rcx, [rsp + 0x940]
call fcn.140015d7c
test rax, rax
jne 0x140005cfd
mov eax, dword [rsp + 0x940]
add eax, 0xffffffd2
cmp ax, 0x2e
ja 0x140005d28
movzx eax, ax
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140005d28
xor edi, edi
mov rcx, qword [rsp + 0xf78]
xor rcx, rsp
call fcn.140023680
mov eax, edi
movaps xmm6, xmmword [rsp + 0xf80]
add rsp, 0xf90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
lea rsi, [rsp + 0x520]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015960
lea rdx, [0x140047aa0]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013508
lea rdx, [rsp + 0x940]
mov rcx, rsi
call fcn.140032820
test eax, eax
je 0x140005cff
lea rcx, [rsp + 0x520]
call fcn.1400117f0
test al, al
je 0x140005cfd
cmp byte [0x140047a98], 0
je 0x140005da7
lea rcx, [0x140047aa0]
lea rdx, [rsp + 0x520]
mov r8d, 1
call fcn.140010840
test eax, eax
je 0x140005cfd
lea r8, str.uninstall.update
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x520]
call fcn.140011b00
test eax, eax
je 0x140005cfd
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.140015960
cmp byte [0x140047a99], 1
jne 0x140005f5c
lea rcx, [0x140047260]
lea rdx, [0x14003d78a]
lea r8, [rsp + 0x100]
call fcn.140011d20
test eax, eax
je 0x140005cfd
xorps xmm6, xmm6
lea rsi, [rsp + 0xe0]
movups xmmword [rsi + 0xc], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.argv0ignored
mov r8d, 0xd
mov rcx, rsi
call fcn.140013508
lea rcx, [rsp + 0x730]
call fcn.140013348
mov rdi, rax
mov rcx, rsi
call fcn.140013348
mov rbx, rax
add rbx, rdi
lea rcx, [rbx + rbx]
add rcx, 2
call fcn.140020e74
xor edi, edi
test rax, rax
je 0x140005cff
mov r14, rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
mov r8, rbx
call fcn.140013508
lea rdx, [rsp + 0x730]
mov rcx, r14
call fcn.140021928
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0x70]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rdi
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x14003dbb6]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x520]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, r14
call fcn.14002099c
test esi, esi
setne dil
je 0x140005cff
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x140005cff
lea rdx, [0x140047260]
lea rsi, [rsp + 0x100]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013508
lea rdx, [0x14003d77e]
mov rcx, rsi
call fcn.140032820
jmp 0x140005e08