Function at 0x1400093d0
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x588
mov rdi, rcx
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x580], rax
xor esi, esi
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x140009700
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
je 0x140009700
xor esi, esi
lea r9, [rsp + 0xdc]
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140009468
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400096dd
mov r15d, dword [rsp + 0xdc]
mov rcx, r15
call fcn.14000a950
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000c660
lea r9, [rsp + 0xdc]
mov rcx, r14
mov rdx, rbx
mov r8d, r15d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebp, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
je 0x1400096f8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor esi, esi
lea rcx, [rsp + 0x370]
mov r8d, 0x20a
xor edx, edx
call fcn.14000c660
mov r14, qword [rbx + 0x10]
mov rcx, r14
call fcn.1400148ac
cmp rax, 0x104
ja 0x1400096f8
lea r15, [rsp + 0x370]
mov r8d, 0x105
mov rcx, r15
mov rdx, r14
call fcn.140014d74
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1400096f8
lea rdx, str.maintenanceservice_tmp.exe
lea rcx, [rsp + 0x370]
call fcn.140009d70
test eax, eax
je 0x1400096f8
mov rcx, rdi
call fcn.1400148ac
cmp rax, 0x104
ja 0x1400096f8
xor esi, esi
lea r14, [rsp + 0x160]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000c660
mov r8d, 0x104
mov rcx, r14
mov rdx, rdi
call fcn.140014d74
lea rdx, [0x14002f7f8]
mov rcx, r14
call fcn.140009d70
lea rdx, [rsp + 0x370]
mov rcx, r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400096f8
lea rdx, [rsp + 0x370]
mov rcx, rdi
mov r8d, 1
call fcn.140007980
test eax, eax
je 0x1400096ea
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x70], 0x68
lea rax, [0x14002fad0]
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
lea rdx, str.dummyparam.exe_upgrade
lea rsi, [rsp + 0xe0]
mov r8d, 0x3f
mov rcx, rsi
call fcn.140014d74
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x370]
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x1400096f8
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
jmp 0x1400096f8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x140009700
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call fcn.14000a958
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.14000ac40
mov eax, esi
add rsp, 0x588
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret