Function at 0x14000d880
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x590
mov r14, rcx
mov rax, qword [0x140038010]
xor rax, rsp
mov qword [rsp + 0x588], rax
xor esi, esi
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14000d9bf
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14000d9bf
xor esi, esi
lea r9, [rsp + 0xdc]
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000d917
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000d9e0
mov ebx, dword [rsp + 0xdc]
mov rcx, rbx
call fcn.14000e5ac
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call fcn.1400101a0
lea r9, [rsp + 0xdc]
mov rcx, rdi
mov rdx, r15
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x14000d9b7
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor esi, esi
lea rcx, [rsp + 0x370]
mov r8d, 0x20a
xor edx, edx
call fcn.1400101a0
mov rdi, qword [r15 + 0x10]
mov rcx, rdi
call fcn.1400176d8
cmp rax, 0x104
ja 0x14000d9b7
lea rbx, [rsp + 0x370]
mov r8d, 0x105
mov rcx, rbx
mov rdx, rdi
call fcn.140017ba0
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x14000d9ed
mov rcx, r15
call fcn.14000e5b4
mov rcx, qword [rsp + 0x588]
xor rcx, rsp
call fcn.1400195d0
mov eax, esi
add rsp, 0x590
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x14000d9bf
lea rdx, str.maintenanceservice_tmp.exe
lea rcx, [rsp + 0x370]
call int.14000e350
test eax, eax
je 0x14000d9b7
mov rcx, r14
call fcn.1400176d8
cmp rax, 0x104
ja 0x14000d9b7
xor esi, esi
lea rdi, [rsp + 0x160]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.1400101a0
mov r8d, 0x104
mov rcx, rdi
mov rdx, r14
call fcn.140017ba0
lea rdx, [0x140031152]
mov rcx, rdi
call int.14000e350
lea rdx, [rsp + 0x370]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000d9b7
lea rdx, [rsp + 0x370]
mov rcx, r14
mov r8d, 1
call fcn.14000c370
test eax, eax
je 0x14000dbb4
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x70], 0x68
lea rax, [0x140031470]
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
lea rdx, str.dummyparam.exe_upgrade
lea rsi, [rsp + 0xe0]
mov r8d, 0x3f
mov rcx, rsi
call fcn.140017ba0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x370]
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x14000d9b7
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
jmp 0x14000d9b7
lea rcx, [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14000d9b7