Function at 0x14000baa0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1130
call fcn.14002a720
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x1118], rax
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016ea0
lea rbx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.1400243c8
lea rdi, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140016ea0
mov r8d, 0x104
mov rcx, rdi
mov rdx, rbx
call fcn.1400243c8
lea rdx, str.updater.ini
mov rcx, rdi
call fcn.1400374a0
test eax, eax
je 0x14000bc3f
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bc6d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bc9b
lea rdx, [0x14004411a]
lea rcx, [rsp + 0x8d0]
call fcn.140017308
test rax, rax
jne 0x14000bc0e
lea rdx, [0x140044114]
lea rcx, [rsp + 0x8d0]
call fcn.140017308
test rax, rax
jne 0x14000bc0e
lea rdx, [0x14004404e]
lea rcx, [rsp + 0x8d0]
call fcn.140017308
test rax, rax
jne 0x14000bc0e
lea rdx, [0x140044054]
lea rcx, [rsp + 0x8d0]
call fcn.140017308
test rax, rax
je 0x14000bcf7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bfb5
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_contains_disallowed_characters
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bf74
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_INI_path
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bff6
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeRelPath
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c037
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeArg
call fcn.140013970
xor esi, esi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.140027fe0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x14000bd45
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x14000bd45
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c318
lea rdx, str.LaunchWinPostProcess_failed_because_first_character_is_invalid
jmp 0x14000bcc7
lea rdi, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140016ea0
lea rdx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rdi
call fcn.1400243c8
lea rdx, [rsp + 0x8d0]
mov rcx, rdi
call fcn.1400374a0
test eax, eax
je 0x14000be32
lea rcx, [rsp + 0x4b0]
call fcn.140013bc0
test al, al
je 0x14000be63
cmp byte [0x14004ea38], 0
je 0x14000bdbd
lea rcx, [rsp + 0x4b0]
call fcn.140013ed0
test eax, eax
je 0x14000be94
lea rcx, [rsp + 0x4b0]
call fcn.140023f00
cmp rax, 0x104
ja 0x14000be01
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.1400243c8
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000bec5
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c3db
lea rdx, str.LaunchWinPostProcess_failed_because_dlogFile_path_is_unavailable
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c359
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_full_executable_path
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c39a
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_is_not_a_valid__full_path
jmp 0x14000bcc7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c41c
lea rdx, str.LaunchWinPostProcess_failed_because_the_binary_doesnt_match_the_allowed_certificates
jmp 0x14000bcc7
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.1400374a0
test eax, eax
je 0x14000be01
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.140016ea0
cmp byte [0x14004ea39], 1
jne 0x14000c078
lea rcx, [rsp + 0x90]
call fcn.140013590
test eax, eax
je 0x14000bf43
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140016ea0
lea rcx, [0x140043d66]
mov rdx, rdi
call fcn.140013690
test eax, eax
jne 0x14000c0eb
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c45d
lea rdx, str.LaunchWinPostProcess_failed_because_a_secure_slogFile_path_is_unavailable
jmp 0x14000bcc7
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bc64
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bc64
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bc33
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bc33
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bc92
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bc92
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bcc0
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bcc0
lea rdx, [0x14004e200]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.1400243c8
cmp byte [0x14004ec49], 0
lea rax, str.update.log
lea rdx, [0x140043d48]
cmove rdx, rax
mov rcx, rdi
call fcn.1400374a0
test eax, eax
jne 0x14000c108
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c520
lea rdx, str.LaunchWinPostProcess_failed_because_slogFile_path_is_unavailable
jmp 0x14000bcc7
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
call fcn.1400374a0
test eax, eax
je 0x14000bf43
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.1400243c8
lea rcx, [rsp + 0x6c0]
call fcn.140023f00
mov rbx, rax
mov rcx, rdi
call fcn.140023f00
mov r15, rax
lea r14, [rax + rbx]
lea rcx, [r14*2 + 2]
call fcn.140023040
test rax, rax
je 0x14000c2b6
mov rdi, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.1400243c8
lea rdx, [rsp + 0x6c0]
mov rcx, rdi
call fcn.140023e80
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor ebx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rbx
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x140044192]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.140022acc
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test esi, esi
setne sil
je 0x14000c2f6
cmp eax, ecx
jg 0x14000c49e
lea rdx, str.LaunchWinPostProcess___Waiting_for_process_to_complete
call fcn.140013970
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c4df
lea rdx, str.LaunchWinPostProcess___Process_completed
call fcn.140013970
jmp 0x14000bcce
lea rsi, [r15 + rbx]
inc rsi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c561
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_allocate__zu_wchars_for_cmdline
mov r8, rsi
call fcn.140013970
jmp 0x14000bccc
cmp eax, ecx
jg 0x14000c5a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LaunchWinPostProcess___CreateProcessW_failed:__lu
mov r8d, eax
call fcn.140013970
jmp 0x14000bcce
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bd3c
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bd3c
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000be57
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000be57
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000be88
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000be88
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000be26
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000be26
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000beb9
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000beb9
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000bf68
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000bf68
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000c24f
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000c24f
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000c2a5
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000c2a5
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000c0df
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000c0df
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000c2e2
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000c2e2
lea rcx, [0x14004fe88]
call fcn.140015430
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000c2fe
mov qword [0x14004fc78], 0
lea rcx, [0x140008490]
call fcn.1400155c8
lea rcx, [0x14004fe88]
call fcn.140015498
jmp 0x14000c2fe