Function at 0x140006f30
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1130
call fcn.14002a6a0
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x1118], rax
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
lea rbx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.14001549c
lea rdi, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400170d0
mov r8d, 0x104
mov rcx, rdi
mov rdx, rbx
call fcn.14001549c
lea rdx, str.updater.ini
mov rcx, rdi
call fcn.140037390
test eax, eax
je 0x1400070cf
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1400070fd
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000712b
lea rdx, [0x14004411c]
lea rcx, [rsp + 0x8d0]
call fcn.1400174bc
test rax, rax
jne 0x14000709e
lea rdx, [0x140044116]
lea rcx, [rsp + 0x8d0]
call fcn.1400174bc
test rax, rax
jne 0x14000709e
lea rdx, [0x140044050]
lea rcx, [rsp + 0x8d0]
call fcn.1400174bc
test rax, rax
jne 0x14000709e
lea rdx, [0x140044056]
lea rcx, [rsp + 0x8d0]
call fcn.1400174bc
test rax, rax
je 0x140007187
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007445
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_contains_disallowed_characters
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007404
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_INI_path
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007486
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeRelPath
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400074c7
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeArg
call fcn.1400137e0
xor esi, esi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.140027f60
mov eax, esi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x1400071d5
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x1400071d5
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400077a8
lea rdx, str.LaunchWinPostProcess_failed_because_first_character_is_invalid
jmp 0x140007157
lea rdi, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400170d0
lea rdx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rdi
call fcn.14001549c
lea rdx, [rsp + 0x8d0]
mov rcx, rdi
call fcn.140037390
test eax, eax
je 0x1400072c2
lea rcx, [rsp + 0x4b0]
call fcn.140013a30
test al, al
je 0x1400072f3
cmp byte [0x14004ea38], 0
je 0x14000724d
lea rcx, [rsp + 0x4b0]
call fcn.140013d40
test eax, eax
je 0x140007324
lea rcx, [rsp + 0x4b0]
call fcn.140015368
cmp rax, 0x104
ja 0x140007291
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.14001549c
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140007355
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000786b
lea rdx, str.LaunchWinPostProcess_failed_because_dlogFile_path_is_unavailable
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400077e9
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_full_executable_path
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000782a
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_is_not_a_valid__full_path
jmp 0x140007157
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400078ac
lea rdx, str.LaunchWinPostProcess_failed_because_the_binary_doesnt_match_the_allowed_certificates
jmp 0x140007157
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.140037390
test eax, eax
je 0x140007291
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.1400170d0
cmp byte [0x14004ea39], 1
jne 0x140007508
lea rcx, [rsp + 0x90]
call fcn.140013400
test eax, eax
je 0x1400073d3
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400170d0
lea rcx, [0x140043d68]
mov rdx, rdi
call fcn.140013500
test eax, eax
jne 0x14000757b
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400078ed
lea rdx, str.LaunchWinPostProcess_failed_because_a_secure_slogFile_path_is_unavailable
jmp 0x140007157
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400070f4
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400070f4
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400070c3
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400070c3
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007122
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007122
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007150
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007150
lea rdx, [0x14004e200]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.14001549c
cmp byte [0x14004ec49], 0
lea rax, str.update.log
lea rdx, [0x140043d4a]
cmove rdx, rax
mov rcx, rdi
call fcn.140037390
test eax, eax
jne 0x140007598
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400079b0
lea rdx, str.LaunchWinPostProcess_failed_because_slogFile_path_is_unavailable
jmp 0x140007157
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
call fcn.140037390
test eax, eax
je 0x1400073d3
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.14001549c
lea rcx, [rsp + 0x6c0]
call fcn.140015368
mov rbx, rax
mov rcx, rdi
call fcn.140015368
mov r15, rax
lea r14, [rax + rbx]
lea rcx, [r14*2 + 2]
call fcn.140023188
test rax, rax
je 0x140007746
mov rdi, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.14001549c
lea rdx, [rsp + 0x6c0]
mov rcx, rdi
call fcn.140023fc0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor ebx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rbx
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x140044194]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.140022c14
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test esi, esi
setne sil
je 0x140007786
cmp eax, ecx
jg 0x14000792e
lea rdx, str.LaunchWinPostProcess___Waiting_for_process_to_complete
call fcn.1400137e0
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000796f
lea rdx, str.LaunchWinPostProcess___Process_completed
call fcn.1400137e0
jmp 0x14000715e
lea rsi, [r15 + rbx]
inc rsi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400079f1
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_allocate__zu_wchars_for_cmdline
mov r8, rsi
call fcn.1400137e0
jmp 0x14000715c
cmp eax, ecx
jg 0x140007a32
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LaunchWinPostProcess___CreateProcessW_failed:__lu
mov r8d, eax
call fcn.1400137e0
jmp 0x14000715e
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400071cc
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400071cc
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400072e7
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400072e7
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007318
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007318
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400072b6
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400072b6
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007349
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007349
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400073f8
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400073f8
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400076df
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x1400076df
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007735
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007735
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000756f
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x14000756f
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007772
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007772
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000778e
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x14000778e