Function at 0x14000bb20
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1130
call fcn.14002f5b0
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x1118], rax
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cd40
lea rbx, [0x140054a50]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.140028e84
lea rdi, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cd40
mov r8d, 0x104
mov rcx, rdi
mov rdx, rbx
call fcn.140028e84
lea rdx, str.updater.ini
mov rcx, rdi
call fcn.14003dbc0
test eax, eax
je 0x14000bcbf
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bced
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000bd1b
lea rdx, [0x14004a024]
lea rcx, [rsp + 0x8d0]
call fcn.1400172f0
test rax, rax
jne 0x14000bc8e
lea rdx, [0x14004a01e]
lea rcx, [rsp + 0x8d0]
call fcn.1400172f0
test rax, rax
jne 0x14000bc8e
lea rdx, [0x140049f58]
lea rcx, [rsp + 0x8d0]
call fcn.1400172f0
test rax, rax
jne 0x14000bc8e
lea rdx, [0x140049f5e]
lea rcx, [rsp + 0x8d0]
call fcn.1400172f0
test rax, rax
je 0x14000bd77
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c035
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_contains_disallowed_characters
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000bff4
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_INI_path
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c076
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeRelPath
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c0b7
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeArg
call fcn.1400139f0
xor esi, esi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.14002cd00
mov eax, esi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x14000bdc5
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x14000bdc5
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c398
lea rdx, str.LaunchWinPostProcess_failed_because_first_character_is_invalid
jmp 0x14000bd47
lea rdi, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cd40
lea rdx, [0x140054a50]
mov r8d, 0x104
mov rcx, rdi
call fcn.140028e84
lea rdx, [rsp + 0x8d0]
mov rcx, rdi
call fcn.14003dbc0
test eax, eax
je 0x14000beb2
lea rcx, [rsp + 0x4b0]
call fcn.140013c40
test al, al
je 0x14000bee3
cmp byte [0x140054a48], 0
je 0x14000be3d
lea rcx, [rsp + 0x4b0]
call fcn.140013f50
test eax, eax
je 0x14000bf14
lea rcx, [rsp + 0x4b0]
call fcn.1400289bc
cmp rax, 0x104
ja 0x14000be81
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.140028e84
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000bf45
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c45b
lea rdx, str.LaunchWinPostProcess_failed_because_dlogFile_path_is_unavailable
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c3d9
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_full_executable_path
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c41a
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_is_not_a_valid__full_path
jmp 0x14000bd47
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c49c
lea rdx, str.LaunchWinPostProcess_failed_because_the_binary_doesnt_match_the_allowed_certificates
jmp 0x14000bd47
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.14003dbc0
test eax, eax
je 0x14000be81
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.14003cd40
cmp byte [0x140054a49], 1
jne 0x14000c0f8
lea rcx, [rsp + 0x90]
call fcn.140013610
test eax, eax
je 0x14000bfc3
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.14003cd40
lea rcx, [0x140049c70]
mov rdx, rdi
call fcn.140013710
test eax, eax
jne 0x14000c16b
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c4dd
lea rdx, str.LaunchWinPostProcess_failed_because_a_secure_slogFile_path_is_unavailable
jmp 0x14000bd47
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bce4
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bce4
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bcb3
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bcb3
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bd12
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bd12
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bd40
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bd40
lea rdx, [0x140054210]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.140028e84
cmp byte [0x140054c59], 0
lea rax, str.update.log
lea rdx, [0x140049c52]
cmove rdx, rax
mov rcx, rdi
call fcn.14003dbc0
test eax, eax
jne 0x14000c188
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c5a0
lea rdx, str.LaunchWinPostProcess_failed_because_slogFile_path_is_unavailable
jmp 0x14000bd47
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
call fcn.14003dbc0
test eax, eax
je 0x14000bfc3
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.140028e84
lea rcx, [rsp + 0x6c0]
call fcn.1400289bc
mov rbx, rax
mov rcx, rdi
call fcn.1400289bc
mov r15, rax
lea r14, [rax + rbx]
lea rcx, [r14*2 + 2]
call fcn.140027868
test rax, rax
je 0x14000c336
mov rdi, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.140028e84
lea rdx, [rsp + 0x6c0]
mov rcx, rdi
call fcn.14002893c
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor ebx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rbx
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x14004a09c]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.1400271b4
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test esi, esi
setne sil
je 0x14000c376
cmp eax, ecx
jg 0x14000c51e
lea rdx, str.LaunchWinPostProcess___Waiting_for_process_to_complete
call fcn.1400139f0
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c55f
lea rdx, str.LaunchWinPostProcess___Process_completed
call fcn.1400139f0
jmp 0x14000bd4e
lea rsi, [r15 + rbx]
inc rsi
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c5e1
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_allocate__zu_wchars_for_cmdline
mov r8, rsi
call fcn.1400139f0
jmp 0x14000bd4c
cmp eax, ecx
jg 0x14000c622
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LaunchWinPostProcess___CreateProcessW_failed:__lu
mov r8d, eax
call fcn.1400139f0
jmp 0x14000bd4e
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bdbc
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bdbc
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bed7
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bed7
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bf08
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bf08
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bea6
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bea6
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bf39
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bf39
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000bfe8
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000bfe8
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c2cf
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000c2cf
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c325
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000c325
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c15f
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000c15f
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c362
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000c362
lea rcx, [0x140055e98]
call fcn.140015744
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c37e
mov qword [0x140055c88], 0
lea rcx, [0x140008510]
call fcn.140015828
lea rcx, [0x140055e98]
call fcn.1400157bc
jmp 0x14000c37e