Function at 0x140004d70
Capabilities:
Create process on windows
Read file on windows
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
mov rdi, r9
mov r13, rdx
mov ebx, ecx
mov rax, qword [0x140033138]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov dword [r9], 0
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005402
lea rcx, [0x140033c68]
lea rdx, str.Starting_update_process_as_the_service_in_session_0.
call fcn.140008610
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x68
lea rax, str.winsta0Default
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x58]
mov edx, ebx
mov r8, r13
xor r9d, r9d
call fcn.140002180
cmp ebx, 4
jne 0x140004e7e
mov rcx, qword [r13 + 0x18]
lea rdx, [0x14002d366]
call fcn.1400142e8
test eax, eax
jne 0x140004e85
mov ebp, 2
jmp 0x140004eca
mov ebp, 3
jl 0x140004eca
mov rcx, qword [r13 + 0x18]
lea rdx, str._replace
call fcn.14000ce78
mov ebp, 2
test rax, rax
jne 0x140004eca
mov rsi, qword [r13 + 0x18]
nop word cs:[rax + rax]
nop dword [rax]
movzx ecx, word [rsi]
test cx, cx
je 0x140004eca
add rsi, 2
call fcn.140013fcc
test eax, eax
jne 0x140004eb0
mov ebp, 3
cmp ebp, ebx
jg 0x140004eef
lea rax, [0x14002d396]
mov qword [rsp + 0x90], rax
or byte [rsp + 0xbc], 1
mov word [rsp + 0xc0], 0
lea rcx, str.MOZ_USING_SERVICE1
call fcn.140011f84
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005444
mov r8, qword [rsp + 0x58]
lea rcx, [0x140033c68]
lea rdx, str.Starting_service_with_cmdline:__ls
call fcn.140008610
mov rdx, qword [rsp + 0x58]
mov rcx, qword [r13]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rdi], eax
test eax, eax
je 0x140004fef
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005486
lea rcx, [0x140033c68]
lea rdx, str.Process_was_started..._waiting_on_result.
call fcn.140008610
mov rcx, qword [rsp + 0x60]
mov edx, 0xdbba0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r14d, eax
cmp eax, 0x102
jne 0x140005044
mov rcx, qword [rsp + 0x60]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r15d, r15d
xor r12d, r12d
jmp 0x1400050d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400054c8
mov r9, qword [rsp + 0x58]
mov r8, qword [r13]
mov dword [rsp + 0x20], edi
lea rcx, [0x140033c68]
lea rdx, str.Could_not_create_process_as_current_user__updaterPath:__ls__cmdLine:__ls.____lu_
call fcn.140008690
xor r12d, r12d
jmp 0x14000537f
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [0x140033e78]
mov edx, dword [0x140033ed8]
mov rbp, qword gs:[0x58]
mov rdx, qword [rbp + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x1400050b2
cmp ecx, edx
jg 0x14000554c
mov r8d, dword [rsp + 0x110]
lea rcx, [0x140033c68]
lea rdx, str.Process_finished_with_return_code__lu.
call fcn.140008610
xor r12d, r12d
cmp dword [rsp + 0x110], 0
sete r12b
xor r15d, r15d
jmp 0x1400050d6
cmp ecx, edx
jg 0x140005612
lea rcx, [0x140033c68]
lea rdx, str.Process_finished_but_could_not_obtain_return_code.
call fcn.140008690
xor r12d, r12d
mov r15d, 1
mov rcx, qword [rsp + 0x60]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x68]
call rsi
mov rbx, qword [r13 + 8]
lea rbp, [rsp + 0x110]
mov r8d, 0x20a
mov rcx, rbp
xor edx, edx
call fcn.14000cba0
lea rdx, str..status
mov rcx, rbx
mov r8, rbp
call fcn.140009050
test eax, eax
je 0x1400051c8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x110]
mov edx, 0x80000000
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005205
xorps xmm0, xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xf0]
lea r9, [rsp + 0xec]
mov rcx, rbx
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000523a
movabs rax, 0x676e69796c707061
xor ebp, ebp
cmp qword [rsp + 0xf0], rax
sete bpl
mov edi, 1
jmp 0x140005276
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000550a
lea rcx, [0x140033c68]
lea rdx, str.Could_not_get_path_for_the_secure_update_status_file
call fcn.140008690
jmp 0x14000537f
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000558e
lea rcx, [0x140033c68]
lea rdx, str.Could_not_open_update.status_file
jmp 0x14000526d
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005654
lea rcx, [0x140033c68]
lea rdx, str.Could_not_read_from_update.status_file
call fcn.140008690
xor ebp, ebp
xor edi, edi
mov rax, rbx
add rax, 1
cmp rax, 2
jae 0x14000528c
test edi, edi
jne 0x14000529d
jmp 0x14000537f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000537f
test ebp, ebp
je 0x14000537f
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test r12d, r12d
je 0x140005335
cmp eax, ecx
jg 0x1400055d0
lea rcx, [0x140033c68]
lea rdx, str.update.status_is_still_applying_even_though_update_was_successful.
call fcn.140008610
mov rcx, qword [r13 + 8]
mov edx, 0x1d
call fcn.140009930
xor r12d, r12d
test eax, eax
jne 0x14000537f
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400056d8
lea rcx, [0x140033c68]
lea rdx, str.Could_not_write_update.status_still_applying_on_success_error.
jmp 0x1400051fb
cmp eax, ecx
jg 0x140005696
lea rcx, [0x140033c68]
lea rdx, str.update.status_is_still_applying_and_update_was_not_successful.
call fcn.140008690
cmp r14d, 0x102
mov eax, 0x32
mov ecx, 0x1e
cmove ecx, eax
test r15d, r15d
mov edx, 0x33
cmove edx, ecx
mov rcx, qword [r13 + 8]
call fcn.140009930
xor r12d, r12d
test eax, eax
je 0x1400053ca
lea rcx, str.MOZ_USING_SERVICE
call fcn.140011f84
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], 0
test rcx, rcx
je 0x1400053a3
call fcn.14000a928
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14000acd0
mov eax, r12d
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x140033e78]
mov ecx, dword [0x140033ed8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000571a
lea rcx, [0x140033c68]
lea rdx, str.Could_not_write_update.status_still_applying_on_failure_error.
jmp 0x1400051fb
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x140004dc9
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x140004dc9
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x140004f20
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x140004f20
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x140004fa7
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x140004fa7
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x14000501c
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x14000501c
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x1400051ed
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x1400051ed
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x140005083
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x140005083
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x14000522a
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x14000522a
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x1400052d1
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x1400052d1
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x1400050ba
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x1400050ba
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x14000525f
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x14000525f
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x14000533d
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x14000533d
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x140005322
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x140005322
lea rcx, [0x140033e78]
call fcn.14000aa90
cmp dword [0x140033e78], 0xffffffff
jne 0x1400053ef
lea rcx, [0x140033c68]
call fcn.140008560
lea rcx, [0x140002160]
call fcn.14000acf4
lea rcx, [0x140033e78]
call fcn.14000aaf8
jmp 0x1400053ef