Function at 0x140062790
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x16c0
call fcn.1401456d0
sub rsp, rax
mov rax, qword [0x1401c5538]
xor rax, rsp
mov qword [rsp + 0x16b0], rax
mov rsi, rcx
xor r14d, r14d
lea rdx, [rsp + 0x120]
call fcn.1400625c0
nop
cmp qword [rsp + 0x130], r14
jne 0x140062864
call fcn.1400726a0
lea rdx, str.UpdateUsingCurl.doUpdate:_Build_FTP_URL_failed.
mov rcx, rax
call fcn.140072400
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x14006283a
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062835
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062ef8
call fcn.1401452fc
mov rcx, qword [rsp + 0x16b0]
xor rcx, rsp
call fcn.1401453a0
lea r11, [rsp + 0x16c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov byte [rsp + 0x270], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x271]
call fcn.140147800
lea rdx, [rsp + 0x270]
lea rcx, [0x14017e180]
call fcn.14006c680
mov byte [rsp + 0x490], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x491]
call fcn.140147800
lea rdx, [rsp + 0x490]
lea rcx, [0x14017e190]
call fcn.14006c680
lea rdx, [rsp + 0x270]
mov ecx, 0x135
call fcn.14004a430
test eax, eax
jne 0x1400628ed
call fcn.1400726a0
lea rdx, str.UpdateUsingCurl.doUpdate:_Extract_curl.exe_failed
jmp 0x1400627ee
lea rdx, [rsp + 0x490]
mov ecx, 0x136
call fcn.14004a430
test eax, eax
jne 0x140062914
call fcn.1400726a0
lea rdx, str.UpdateUsingCurl.doUpdate:_Extract_bundle_cert_failed
jmp 0x1400627ee
mov byte [rsp + 0x160], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x161]
call fcn.140147800
mov r8d, 0x104
lea rdx, [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x160]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140062960
test rax, rax
je 0x140062980
nop
cmp byte [rsp + rax + 0x160], 0x5c
je 0x1400629be
sub rax, 1
jne 0x140062970
mov byte [rsp + 0x380], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x381]
call fcn.140147800
lea rbx, [rsi + 0x28]
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 4
jb 0x140062efe
jmp 0x1400629d7
inc rax
cmp rax, 0x104
jae 0x140062f04
mov byte [rsp + rax + 0x160], 0
jmp 0x140062980
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400629e4
mov r9, qword [rbx]
mov qword [rsp + 0x30], 4
lea rax, [0x14017e210]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rbx
movzx edx, byte [rsp + 0x54]
lea rcx, [rsp + 0x100]
call fcn.140062490
nop
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rcx, qword [rsp + 0x100]
lea rdx, [rsp + 0x380]
call fcn.14006c680
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [rsp + 0x6b0], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x6b1]
call fcn.140147800
lea rdx, [rsp + 0x120]
cmp qword [rsp + 0x138], 0x10
cmovae rdx, qword [rsp + 0x120]
lea rcx, [rsi + 0x68]
cmp qword [rcx + 0x18], 0x10
jb 0x140062a8e
mov rcx, qword [rcx]
lea rax, [rsi + 0x48]
cmp qword [rax + 0x18], 0x10
jb 0x140062a9c
mov rax, qword [rax]
lea r8, [rsp + 0x380]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x270]
lea r8, str.__s___u__s:_s__s__o___s_
mov edx, 0x1000
lea rcx, [rsp + 0x6b0]
call fcn.140017490
call fcn.1400726a0
lea r8, [rsp + 0x6b0]
lea rdx, str.UpdateUsingCurl.doUpdate:_cmd_s
mov rcx, rax
call fcn.1400723d0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xe4], xmm0
mov dword [rsp + 0xf4], eax
mov dword [rsp + 0x90], WSASetLastError
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x6b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140062c0f
call fcn.1400726a0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.UpdateUsingCurl.doUpdate:_Run_curl_failed___d
mov rcx, rbx
call fcn.140072400
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140062bf1
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062bec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062f10
call fcn.1401452fc
movdqa xmm0, xmmword [0x140173f50]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
jmp 0x1400627f7
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 7
mov qword [rsp + 0x158], reloc.WS2_32.dll_ntohs
mov rax, qword [0x14017e290]
mov dword [rsp + 0x140], eax
movzx eax, word [0x14017e294]
mov word [rsp + 0x144], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x146], al
mov byte [rsp + 0x147], 0
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140062cf0
mov qword [rsp + 0x150], 6
mov eax, dword [str.Failed]
mov dword [rsp + 0x140], eax
movzx eax, word [0x14017e29c]
mov word [rsp + 0x144], ax
mov byte [rsp + 0x146], 0
call fcn.1400726a0
mov r8d, dword [rsp + 0x50]
lea rdx, str.UpdateUsingCurl.doUpdate:_Download_failed___d
mov rcx, rax
call fcn.140072400
mov ecx, dword [rsp + 0x50]
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
call fcn.14001c8a0
mov rdx, rax
mov rcx, qword [0x1401c9cb8]
call fcn.140020e10
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [rsp + 0x50], 0
jne 0x140062e16
call fcn.1400726a0
lea rdx, str.UpdateUsingCurl.doUpdate:_Download_success.
mov rcx, rax
call fcn.140072600
cmp byte [rsi], 0
jne 0x140062dd0
lea rcx, [rsp + 0x78]
call fcn.140023860
nop
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140061a50
cmp qword [rbx + 0x18], 0x10
jb 0x140062d8d
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140061a80
nop
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x140062dd0
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140062dd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140062dd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
nop
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.140147800
lea r9, [rsp + 0x380]
lea r8, [0x140177600]
mov edx, 0x104
lea rcx, [rsp + 0x5a0]
call fcn.140017490
xor edx, edx
lea rcx, [rsp + 0x5a0]
call fcn.140071740
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x140062e5a
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062e54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062f0a
call fcn.1401452fc
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x140062e99
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062e94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140062f10
call fcn.1401452fc
movdqa xmm0, xmmword [0x140173f50]
movdqu xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x100], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x14006283a
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062835
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140062835
call fcn.14014bf64
nop
call fcn.140002ae0
int3
call fcn.140145970
nop
call fcn.14014bf64
nop
call fcn.14014bf64
int3