Function at 0x140005830
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf98
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xf90], rax
xor edi, edi
lea r14, [rsp + 0xd80]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.140016100
lea rsi, [0x140047f30]
mov r8d, 0x104
mov rcx, r14
mov rdx, rsi
call fcn.1400225b0
lea rbx, [rsp + 0xb70]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.140016100
mov r8d, 0x104
mov rcx, rbx
mov rdx, rsi
call fcn.1400225b0
lea rdx, str.updater.ini
mov rcx, rbx
call fcn.140010110
test eax, eax
je 0x1400059ed
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor edi, edi
lea r9, [rsp + 0x960]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1400059ed
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor edi, edi
lea r9, [rsp + 0x750]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1400059ed
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0xa
lea rcx, str.PostUpdateWin
lea rdx, str.ExeAsync
lea r8, [0x14003d91c]
lea r9, [rsp + 0x730]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1400059eb
lea rdx, [0x14003d9ec]
lea rcx, [rsp + 0x960]
call fcn.1400165b0
test rax, rax
jne 0x1400059eb
lea rdx, [0x14003d9e6]
lea rcx, [rsp + 0x960]
call fcn.1400165b0
test rax, rax
jne 0x1400059eb
lea rdx, [0x14003d916]
lea rcx, [rsp + 0x960]
call fcn.1400165b0
test rax, rax
jne 0x1400059eb
lea rdx, [0x14003d926]
lea rcx, [rsp + 0x960]
call fcn.1400165b0
test rax, rax
jne 0x1400059eb
mov eax, dword [rsp + 0x960]
add eax, 0xffffffd2
cmp ax, 0x2e
ja 0x140005a0c
movzx eax, ax
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140005a0c
xor edi, edi
mov rcx, qword [rsp + 0xf90]
xor rcx, rsp
call fcn.140023fe0
mov eax, edi
add rsp, 0xf98
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
lea rsi, [rsp + 0x520]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016100
lea rdx, [0x140047f30]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400225b0
lea rdx, [rsp + 0x960]
mov rcx, rsi
call fcn.140010110
test eax, eax
je 0x1400059ed
lea rcx, [rsp + 0x520]
call fcn.14000ee80
test al, al
je 0x1400059eb
cmp byte [0x140047f28], 0
je 0x140005a8b
lea rcx, [0x140047f30]
lea rdx, [rsp + 0x520]
mov r8d, 1
call fcn.14000e200
test eax, eax
je 0x1400059eb
lea r8, str.uninstall.update
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x520]
call fcn.14000f1b0
test eax, eax
je 0x1400059eb
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.140016100
cmp byte [0x140047f29], 1
jne 0x140005cdf
lea rcx, [0x1400476f0]
lea rdx, [0x14003d618]
lea r8, [rsp + 0x100]
call fcn.14000f3d0
test eax, eax
je 0x1400059eb
xorps xmm0, xmm0
movups xmmword [rsp + 0xec], xmm0
movaps xmmword [rsp + 0xe0], xmm0
lea rdx, str.argv0ignored
lea rsi, [rsp + 0xe0]
mov r8d, 0xd
mov rcx, rsi
call fcn.1400225b0
lea rcx, [rsp + 0x750]
call fcn.1400220e8
mov rdi, rax
mov rcx, rsi
call fcn.1400220e8
mov rbx, rax
add rbx, rdi
lea rcx, [rbx + rbx]
add rcx, 2
call fcn.14002171c
test rax, rax
je 0x1400059eb
mov rdi, rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
mov r8, rbx
call fcn.1400225b0
lea rdx, [rsp + 0x750]
mov rcx, rdi
call fcn.140022068
cmp byte [0x140047f28], 0
je 0x140005c94
xor ebx, ebx
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x70], 0x68
lea rax, [0x14003da6a]
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x520]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.140021244
test esi, esi
setne dil
je 0x1400059ed
test bl, bl
jne 0x140005c7a
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x1400059ed
lea rdx, str.false
lea rcx, [rsp + 0x730]
mov r8d, 6
call fcn.14001f35c
test eax, eax
je 0x140005b8b
lea rdx, [0x14003d9da]
lea rcx, [rsp + 0x730]
mov r8d, 2
call fcn.14001f35c
mov bl, 1
test eax, eax
jne 0x140005b8d
jmp 0x140005b8b
lea rdx, [0x1400476f0]
lea rsi, [rsp + 0x100]
mov r8d, 0x104
mov rcx, rsi
call fcn.1400225b0
lea rdx, [0x14003d60c]
mov rcx, rsi
call fcn.140010110
test eax, eax
jne 0x140005af4
jmp 0x1400059eb