Function at 0x14000bba0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1130
call fcn.14002f640
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x1118], rax
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
lea rbx, [0x140054a50]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.140028f14
lea rdi, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cdd0
mov r8d, 0x104
mov rcx, rdi
mov rdx, rbx
call fcn.140028f14
lea rdx, str.updater.ini
mov rcx, rdi
call fcn.14003dcc0
test eax, eax
je 0x14000bd3f
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bd6d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bd9b
lea rdx, [0x14004a06a]
lea rcx, [rsp + 0x8d0]
call fcn.140017380
test rax, rax
jne 0x14000bd0e
lea rdx, [0x14004a064]
lea rcx, [rsp + 0x8d0]
call fcn.140017380
test rax, rax
jne 0x14000bd0e
lea rdx, [0x140049f9e]
lea rcx, [rsp + 0x8d0]
call fcn.140017380
test rax, rax
jne 0x14000bd0e
lea rdx, [0x140049fa4]
lea rcx, [rsp + 0x8d0]
call fcn.140017380
test rax, rax
je 0x14000bdf7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c0b5
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_contains_disallowed_characters
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c074
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_INI_path
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c0f6
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeRelPath
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c137
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeArg
call fcn.140013a80
xor esi, esi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.14002cd90
mov eax, esi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x14000be45
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x14000be45
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c418
lea rdx, str.LaunchWinPostProcess_failed_because_first_character_is_invalid
jmp 0x14000bdc7
lea rdi, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cdd0
lea rdx, [0x140054a50]
mov r8d, 0x104
mov rcx, rdi
call fcn.140028f14
lea rdx, [rsp + 0x8d0]
mov rcx, rdi
call fcn.14003dcc0
test eax, eax
je 0x14000bf32
lea rcx, [rsp + 0x4b0]
call fcn.140013cd0
test al, al
je 0x14000bf63
cmp byte [0x140054a48], 0
je 0x14000bebd
lea rcx, [rsp + 0x4b0]
call fcn.140013fe0
test eax, eax
je 0x14000bf94
lea rcx, [rsp + 0x4b0]
call fcn.140028a4c
cmp rax, 0x104
ja 0x14000bf01
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.140028f14
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000bfc5
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c4db
lea rdx, str.LaunchWinPostProcess_failed_because_dlogFile_path_is_unavailable
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c459
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_full_executable_path
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c49a
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_is_not_a_valid__full_path
jmp 0x14000bdc7
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c51c
lea rdx, str.LaunchWinPostProcess_failed_because_the_binary_doesnt_match_the_allowed_certificates
jmp 0x14000bdc7
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.14003dcc0
test eax, eax
je 0x14000bf01
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.14003cdd0
cmp byte [0x140054a49], 1
jne 0x14000c178
lea rcx, [rsp + 0x90]
call fcn.1400136a0
test eax, eax
je 0x14000c043
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cdd0
lea rcx, [0x140049c90]
mov rdx, rdi
call fcn.1400137a0
test eax, eax
jne 0x14000c1eb
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c55d
lea rdx, str.LaunchWinPostProcess_failed_because_a_secure_slogFile_path_is_unavailable
jmp 0x14000bdc7
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bd64
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bd64
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bd33
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bd33
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bd92
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bd92
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bdc0
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bdc0
lea rdx, [0x140054210]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.140028f14
cmp byte [0x140054c59], 0
lea rax, str.update.log
lea rdx, [0x140049c72]
cmove rdx, rax
mov rcx, rdi
call fcn.14003dcc0
test eax, eax
jne 0x14000c208
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c620
lea rdx, str.LaunchWinPostProcess_failed_because_slogFile_path_is_unavailable
jmp 0x14000bdc7
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
call fcn.14003dcc0
test eax, eax
je 0x14000c043
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.140028f14
lea rcx, [rsp + 0x6c0]
call fcn.140028a4c
mov rbx, rax
mov rcx, rdi
call fcn.140028a4c
mov r15, rax
lea r14, [rax + rbx]
lea rcx, [r14*2 + 2]
call fcn.1400278f8
test rax, rax
je 0x14000c3b6
mov rdi, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.140028f14
lea rdx, [rsp + 0x6c0]
mov rcx, rdi
call fcn.1400289cc
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor ebx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rbx
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x14004a0e2]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.140027244
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test esi, esi
setne sil
je 0x14000c3f6
cmp eax, ecx
jg 0x14000c59e
lea rdx, str.LaunchWinPostProcess___Waiting_for_process_to_complete
call fcn.140013a80
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c5df
lea rdx, str.LaunchWinPostProcess___Process_completed
call fcn.140013a80
jmp 0x14000bdce
lea rsi, [r15 + rbx]
inc rsi
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c661
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_allocate__zu_wchars_for_cmdline
mov r8, rsi
call fcn.140013a80
jmp 0x14000bdcc
cmp eax, ecx
jg 0x14000c6a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LaunchWinPostProcess___CreateProcessW_failed:__lu
mov r8d, eax
call fcn.140013a80
jmp 0x14000bdce
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000be3c
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000be3c
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bf57
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bf57
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bf88
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bf88
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bf26
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bf26
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bfb9
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000bfb9
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c068
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c068
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c34f
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c34f
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c3a5
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c3a5
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c1df
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c1df
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c3e2
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c3e2
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c3fe
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c3fe