Function at 0x140006340
Capabilities:
Copy file
Create directory
Delete file

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0xbc0]
mov eax, 0xcc0
call fcn.1400100f0
sub rsp, rax
mov rax, qword [0x14001b018]
xor rax, rsp
mov qword [rbp + 0xba0], rax
mov rdi, rdx
mov r14d, ecx
cmp ecx, 3
jge 0x140006391
call fcn.1400010f0
lea rdx, str.Not_enough_command_line_arguments_to_execute_a_service_command
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d4f
xor edx, edx
mov qword [rsp + 0xcb8], rsi
mov r8d, 0x20a
lea rcx, [rbp + 0x990]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x990]
call fcn.140008860
test eax, eax
je 0x1400063de
call fcn.1400010f0
mov r8, qword [rdi + 0x10]
lea r9, [rbp + 0x990]
lea rdx, str.Executing_service_command__ls__ID:__ls
mov rcx, rax
call fcn.140007a50
jmp 0x1400063f6
call fcn.1400010f0
mov r8, qword [rdi + 0x10]
lea rdx, str.Executing_service_command__ls
mov rcx, rax
call fcn.140007a50
mov rcx, qword [rdi + 0x10]
lea rdx, str.software_update
mov qword [rsp + 0xcf0], rbx
xor esi, esi
mov qword [rsp + 0xcb0], r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140006cf1
cmp r14d, 4
jle 0x140006cd9
mov rcx, qword [rdi + 0x20]
call fcn.140008170
test al, al
je 0x140006cd9
mov rcx, qword [rdi + 0x20]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x140006450
cmp rax, 0xa
jae 0x14000647a
call fcn.1400010f0
lea rdx, str.The_patch_directory_path_length_is_not_valid_for_this_application.
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d37
lea rcx, [rcx + rax*2]
mov r8d, 0xa
add rcx, 0xffffffffffffffec
lea rdx, str.updates0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1400064b4
call fcn.1400010f0
lea rdx, str.The_patch_directory_path_subdirectory_is_not_valid_for_this_application.
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d37
mov rsi, qword [rdi + 0x20]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [0x140015dd8]
call fcn.140008ee0
test eax, eax
je 0x1400064ed
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, str..status
call fcn.140008ee0
test eax, eax
je 0x140006510
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, str..log
call fcn.140008ee0
test eax, eax
je 0x140006533
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov rsi, qword [rdi + 0x20]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
call fcn.140008860
test eax, eax
je 0x1400065c2
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x360]
mov rcx, rsi
lea rdx, [0x140015dd8]
call fcn.140008ee0
test eax, eax
je 0x1400065c2
lea rdx, [0x140015de0]
lea rcx, [rbp + 0x360]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rsi, rax
test rax, rax
je 0x1400065c2
lea r8, [rsp + 0x40]
mov rcx, rax
lea rdx, str._ls_n
call fcn.140007730
mov rcx, rsi
cmp eax, ebx
jne 0x1400065dd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call fcn.1400010f0
lea rdx, str.Unable_to_write_to_secure_ID_file.
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d37
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp r14d, 5
jle 0x140006c9b
mov rcx, qword [rdi + 0x28]
call fcn.140008170
test al, al
je 0x140006c9b
mov rcx, qword [rdi + 0x28]
call fcn.140007e30
test al, al
je 0x140006c9b
lea rdx, [rdi + 0x18]
lea ecx, [r14 - 3]
call fcn.140005490
test al, al
jne 0x140006759
cmp r14d, 6
jle 0x14000673b
mov rcx, qword [rdi + 0x30]
call fcn.140008170
test al, al
je 0x14000673b
mov rdx, qword [rdi + 0x28]
mov r8d, 0x104
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140006759
cmp r14d, 7
jle 0x14000671d
mov rcx, qword [rdi + 0x38]
cmp word [rcx], 0x2d
jne 0x14000667d
cmp word [rcx + 2], 0x31
jne 0x14000667d
cmp word [rcx + 4], 0
je 0x140006693
lea rdx, str._replace
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000671d
mov r9, qword [rdi + 0x30]
lea r8, [0x1400152d0]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.140005210
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400066e6
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_remove_file_spec_when_attempting_to_verify_the_working_directory_path.____lu_
mov rcx, rbx
mov r8d, eax
call fcn.140007b80
mov edx, 0x47
jmp 0x140006cb4
mov rdx, qword [rdi + 0x28]
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140006759
call fcn.1400010f0
lea rdx, str.The_apply_to_directory_must_be_the_same_as_or_a_child_of_the_installation_directory__Exiting.
mov rcx, rax
call fcn.140007b80
mov edx, 0x34
jmp 0x140006cb4
call fcn.1400010f0
lea rdx, str.Installation_directory_and_working_directory_must_be_the_same_for_non_staged_updates._Exiting.
mov rcx, rax
call fcn.140007b80
mov edx, 0x36
jmp 0x140006cb4
call fcn.1400010f0
lea rdx, str.The_working_directory_path_is_not_valid_for_this_application.
mov rcx, rax
call fcn.140007b80
mov edx, 0x38
jmp 0x140006cb4
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0x780]
lea rdx, [rdi + 0x18]
lea ecx, [r14 - 3]
call fcn.140005520
test eax, eax
jne 0x1400067a3
call fcn.1400010f0
lea rdx, str.Could_not_get_the_installation_directory
mov rcx, rax
call fcn.140007b80
mov edx, 0x21
jmp 0x140006cb4
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARELibreOfficeMaintenanceService3932ecacee736d366d6436db0f55bce4
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000685a
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x780]
call fcn.14000d980
test eax, eax
je 0x140006c94
call fcn.1400010f0
lea r8, [rbp + 0x360]
mov rcx, rax
lea rdx, str.Checking_for_Maintenance_Service_registry._key:__ls
call fcn.140007a50
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x360]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000685a
call fcn.1400010f0
lea rdx, str.The_maintenance_service_registry_key_does_not_exist.
mov rcx, rax
call fcn.140007b80
mov edx, 0x39
jmp 0x140006cb4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
add byte [rax], al
mov r8d, 0x104
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x570]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rbp + 0x570]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400068a0
add rax, 0x13
cmp rax, 0x104
jae 0x1400068ce
lea rdx, str.programupdater.exe
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x1400068e2
call fcn.1400010f0
lea rdx, str.Install_directory_updater_could_not_be_determined.
mov rcx, rax
call fcn.140007b80
mov r8, qword [rdi + 0x20]
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x570]
call fcn.140005a60
xor edx, edx
movzx esi, al
mov r8d, 0x20a
lea rcx, [rbp + 0x150]
call sub.VCRUNTIME140.dll_memset
test esi, esi
je 0x140006c34
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000694b
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_module_filename_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x140006c27
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140006976
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_remove_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
jmp 0x140006c27
lea rcx, [rbp + 0x150]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006980
add rax, 6
cmp rax, 0x104
jae 0x140006c12
lea rdx, str.update
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140006c12
xor edx, edx
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp + 0x150]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400069d0
add rax, 0xb
cmp rax, 0x104
jae 0x140006c12
lea rdx, str.updater.exe
lea rcx, [rbp + 0x150]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140006c12
call fcn.1400010f0
mov r8, qword [rdi + 0x18]
lea rcx, [rbp + 0x150]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x570]
mov rcx, rax
lea rdx, str.Passed_in_path:__ls__ignored___Install_dir_has:__ls__Using_this_path_for_updating:__ls.
call fcn.140007a50
lea rcx, [rbp + 0x150]
call fcn.1400061d0
xor r8d, r8d
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
je 0x140006c34
lea rax, [rbp + 0x150]
xor edx, edx
mov r8d, 0x20a
mov qword [rdi + 0x18], rax
lea rcx, [rbp + 0x360]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x150]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006aa0
cmp rax, 0x104
ja 0x140006bf5
mov r8d, 0x105
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140006bf5
lea rcx, [rsp + 0x40]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006af0
add rax, 0xb
cmp rax, 0x104
jae 0x140006bf5
lea rdx, str.updater.ini
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140006bf5
lea rcx, [rbp + 0x570]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140006b30
cmp rax, 0x104
ja 0x140006bf5
mov r8d, 0x105
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x360]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140006bf5
lea rax, [rbp + 0x360]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140006b80
add rbx, 0xb
cmp rbx, 0x104
jae 0x140006bf5
lea rdx, str.updater.ini
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x140006bf5
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140006bf5
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8, [rbp + 0x360]
mov dword [rsp + 0x20], eax
lea rdx, str.Could_not_copy_updater.ini_from:__ls_to__ls.____lu_
call fcn.140007b80
lea ecx, [r14 - 3]
lea rdx, [rdi + 0x18]
call fcn.140005e60
lea rcx, [rbp + 0x150]
mov esi, eax
call fcn.1400061d0
jmp 0x140006c7a
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_append_file_spec_when_attempting_to_use_a_secure_updater_path.____lu_
mov r8d, eax
mov rcx, rbx
call fcn.140007b80
xor esi, esi
call fcn.1400010f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_copy_path_to_secure_location.____lu_
mov rcx, rbx
mov r8d, eax
call fcn.140007b80
mov rcx, qword [rdi + 0x20]
mov edx, 0x31
call fcn.140009890
test eax, eax
jne 0x140006c7a
call fcn.1400010f0
lea rdx, str.Could_not_write_update.status_could_not_copy_updater_error
mov rcx, rax
call fcn.140007b80
call fcn.1400010f0
mov r8, qword [rdi + 0x10]
lea rdx, str.Service_command__ls_complete.
mov rcx, rax
call fcn.140007a50
jmp 0x140006d09
mov edx, 0x35
jmp 0x140006cb4
call fcn.1400010f0
lea rdx, str.The_install_directory_path_is_not_valid_for_this_application.
mov rcx, rax
call fcn.140007b80
mov edx, 0x37
mov rcx, qword [rdi + 0x20]
call fcn.140009890
test eax, eax
jne 0x140006cd5
call fcn.1400010f0
lea rdx, str.Could_not_write_update.status_for_previous_failure.
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d37
call fcn.1400010f0
lea rdx, str.The_patch_directory_path_is_not_valid_for_this_application.
mov rcx, rax
call fcn.140007b80
xor eax, eax
jmp 0x140006d37
call fcn.1400010f0
mov r8, qword [rdi + 0x10]
lea rdx, str.Service_command_not_recognized:__ls.
mov rcx, rax
call fcn.140007b80
call fcn.1400010f0
mov r8, qword [rdi + 8]
lea rcx, str.Success
test esi, esi
lea r9, str.Failure
lea rdx, str.service_command__ls_complete_with_result:__ls.
cmovne r9, rcx
mov rcx, rax
call fcn.140007a50
mov eax, esi
mov rbx, qword [rsp + 0xcf0]
mov r15, qword [rsp + 0xcb0]
mov rsi, qword [rsp + 0xcb8]
mov rcx, qword [rbp + 0xba0]
xor rcx, rsp
call fcn.14000e7a0
add rsp, 0xcc0
pop r14
pop rdi
pop rbp
ret