Function at 0x140005780
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf98
movaps xmmword [rsp + 0xf80], xmm6
mov rax, qword [0x140049030]
xor rax, rsp
mov qword [rsp + 0xf78], rax
xor edi, edi
lea rsi, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400155d0
lea r14, [0x14004bba0]
mov r8d, 0x104
mov rcx, rsi
mov rdx, r14
call fcn.14001399c
lea rbx, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.1400155d0
mov r8d, 0x104
mov rcx, rbx
mov rdx, r14
call fcn.14001399c
lea rdx, str.updater.ini
mov rcx, rbx
call fcn.140035970
test eax, eax
je 0x14000590a
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor edi, edi
lea r9, [rsp + 0x940]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000590a
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor edi, edi
lea r9, [rsp + 0x730]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000590a
lea rdx, [0x14004141a]
lea rcx, [rsp + 0x940]
call fcn.1400159bc
test rax, rax
jne 0x140005908
lea rdx, [0x140041414]
lea rcx, [rsp + 0x940]
call fcn.1400159bc
test rax, rax
jne 0x140005908
lea rdx, [0x14004134e]
lea rcx, [rsp + 0x940]
call fcn.1400159bc
test rax, rax
jne 0x140005908
lea rdx, [0x140041354]
lea rcx, [rsp + 0x940]
call fcn.1400159bc
test rax, rax
jne 0x140005908
movzx eax, word [rsp + 0x940]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x140005931
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140005931
xor edi, edi
mov rcx, qword [rsp + 0xf78]
xor rcx, rsp
call fcn.140026460
mov eax, edi
movaps xmm6, xmmword [rsp + 0xf80]
add rsp, 0xf98
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
lea rbx, [rsp + 0x520]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.1400155d0
lea rdx, [0x14004bba0]
mov r8d, 0x104
mov rcx, rbx
call fcn.14001399c
lea rdx, [rsp + 0x940]
mov rcx, rbx
call fcn.140035970
test eax, eax
je 0x14000590a
lea rcx, [rsp + 0x520]
call fcn.140011d00
test al, al
je 0x140005908
cmp byte [0x14004bb98], 0
je 0x1400059b0
lea rcx, [0x14004bba0]
lea rdx, [rsp + 0x520]
mov r8d, 1
call fcn.140010c30
test eax, eax
je 0x140005908
lea r8, str.uninstall.update
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x520]
call fcn.140012010
test eax, eax
je 0x140005908
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.1400155d0
cmp byte [0x14004bb99], 1
jne 0x140005b65
lea rcx, [0x14004b360]
lea rdx, [0x140041066]
lea r8, [rsp + 0x100]
call fcn.140012230
test eax, eax
je 0x140005908
xorps xmm6, xmm6
lea rdi, [rsp + 0xe0]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.14001399c
lea rcx, [rsp + 0x730]
call fcn.140013868
mov rbx, rax
mov rcx, rdi
call fcn.140013868
mov r14, rax
add r14, rbx
lea rcx, [r14 + r14]
add rcx, 2
call fcn.140021688
xor edi, edi
test rax, rax
je 0x14000590a
mov rbx, rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
mov r8, r14
call fcn.14001399c
lea rdx, [rsp + 0x730]
mov rcx, rbx
call fcn.1400224c0
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0x70]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rdi
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x140041492]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x520]
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rbx
call fcn.140021114
test esi, esi
setne dil
je 0x14000590a
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x14000590a
lea rdx, [0x14004b360]
lea rdi, [rsp + 0x100]
mov r8d, 0x104
mov rcx, rdi
call fcn.14001399c
lea rdx, [0x14004105a]
mov rcx, rdi
call fcn.140035970
jmp 0x140005a11