Function at 0x140005780
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf90
movaps xmmword [rsp + 0xf80], xmm6
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xf78], rax
xor edi, edi
lea r15, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.140015b80
lea rsi, [0x140047a90]
mov r8d, 0x104
mov rcx, r15
mov rdx, rsi
call fcn.140013870
lea rbx, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.140015b80
mov r8d, 0x104
mov rcx, rbx
mov rdx, rsi
call fcn.140013870
lea rdx, str.updater.ini
mov rcx, rbx
call fcn.140032d30
test eax, eax
je 0x14000590f
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor edi, edi
lea r9, [rsp + 0x940]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000590f
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor edi, edi
lea r9, [rsp + 0x730]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000590f
lea rdx, [0x14003db72]
lea rcx, [rsp + 0x940]
call fcn.140015f9c
test rax, rax
jne 0x14000590d
lea rdx, [0x14003db6c]
lea rcx, [rsp + 0x940]
call fcn.140015f9c
test rax, rax
jne 0x14000590d
lea rdx, [0x14003daa6]
lea rcx, [rsp + 0x940]
call fcn.140015f9c
test rax, rax
jne 0x14000590d
lea rdx, [0x14003daac]
lea rcx, [rsp + 0x940]
call fcn.140015f9c
test rax, rax
jne 0x14000590d
mov eax, dword [rsp + 0x940]
add eax, 0xffffffd2
cmp ax, 0x2e
ja 0x140005938
movzx eax, ax
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140005938
xor edi, edi
mov rcx, qword [rsp + 0xf78]
xor rcx, rsp
call fcn.140023af0
mov eax, edi
movaps xmm6, xmmword [rsp + 0xf80]
add rsp, 0xf90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor edi, edi
lea rsi, [rsp + 0x520]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015b80
lea rdx, [0x140047a90]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
lea rdx, [rsp + 0x940]
mov rcx, rsi
call fcn.140032d30
test eax, eax
je 0x14000590f
lea rcx, [rsp + 0x520]
call fcn.140011b60
test al, al
je 0x14000590d
cmp byte [0x140047a88], 0
je 0x1400059b7
lea rcx, [0x140047a90]
lea rdx, [rsp + 0x520]
mov r8d, 1
call fcn.140010bb0
test eax, eax
je 0x14000590d
lea r8, str.uninstall.update
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x520]
call fcn.140011e70
test eax, eax
je 0x14000590d
lea rcx, [rsp + 0x100]
mov r8d, 0x20a
xor edx, edx
call fcn.140015b80
cmp byte [0x140047a89], 1
jne 0x140005b6c
lea rcx, [0x140047250]
lea rdx, [0x14003d7be]
lea r8, [rsp + 0x100]
call fcn.140012090
test eax, eax
je 0x14000590d
xorps xmm6, xmm6
lea rsi, [rsp + 0xe0]
movups xmmword [rsi + 0xc], xmm6
movaps xmmword [rsi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rsi
call fcn.140013870
lea rcx, [rsp + 0x730]
call fcn.1400136b0
mov rdi, rax
mov rcx, rsi
call fcn.1400136b0
mov rbx, rax
add rbx, rdi
lea rcx, [rbx + rbx]
add rcx, 2
call fcn.140021290
xor edi, edi
test rax, rax
je 0x14000590f
mov r14, rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
mov r8, rbx
call fcn.140013870
lea rdx, [rsp + 0x730]
mov rcx, r14
call fcn.140021d48
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0x70]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rdi
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x14003dbea]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x520]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, r14
call fcn.140020db8
test esi, esi
setne dil
je 0x14000590f
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x14000590f
lea rdx, [0x140047250]
lea rsi, [rsp + 0x100]
mov r8d, 0x104
mov rcx, rsi
call fcn.140013870
lea rdx, [0x14003d7b2]
mov rcx, rsi
call fcn.140032d30
jmp 0x140005a18