Function at 0x1400065f0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf98
movaps xmmword [rsp + 0xf80], xmm6
mov rdi, rdx
mov r14, rcx
mov r12, qword [0x14003da78]
mov rax, qword [r12]
xor rax, rsp
mov qword [rsp + 0xf78], rax
xor ebx, ebx
lea rsi, [rsp + 0xd60]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov rcx, rsi
mov rdx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea r15, [rsp + 0xb50]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov rcx, r15
mov rdx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea rdx, str.updater.ini
mov rcx, r15
call fcn.1400171d0
test eax, eax
je 0x140006781
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor ebx, ebx
lea r9, [rsp + 0x940]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140006781
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor ebx, ebx
lea r9, [rsp + 0x730]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140006781
lea rdx, [0x14003e1ca]
lea rcx, [rsp + 0x940]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x14000677f
lea rdx, [0x14003e1d0]
lea rcx, [rsp + 0x940]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x14000677f
lea rdx, [0x14003e1d6]
lea rcx, [rsp + 0x940]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x14000677f
lea rdx, [0x14003e1dc]
lea rcx, [rsp + 0x940]
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsstr
test rax, rax
jne 0x14000677f
movzx eax, word [rsp + 0x940]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x1400067b4
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x1400067b4
xor ebx, ebx
mov rax, qword [rsp + 0xf78]
xor rax, rsp
mov rcx, qword [r12]
cmp rcx, rax
jne 0x1400069f7
mov eax, ebx
movaps xmm6, xmmword [rsp + 0xf80]
add rsp, 0xf98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
lea r15, [rsp + 0x520]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov rcx, r15
mov rdx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea rdx, [rsp + 0x940]
mov rcx, r15
call fcn.1400171d0
test eax, eax
je 0x140006781
lea rcx, [rsp + 0x520]
call fcn.140016bb0
test al, al
je 0x14000677f
lea r8, [0x14003e1e0]
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x520]
call fcn.140016cd0
xor ebx, ebx
test eax, eax
je 0x140006781
lea r14, [rsp + 0x100]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, 0x104
mov rcx, r14
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea rdx, str.update.log
mov rcx, r14
call fcn.1400171d0
test eax, eax
je 0x140006781
xorps xmm6, xmm6
movups xmmword [rsp + 0xec], xmm6
movaps xmmword [rsp + 0xe0], xmm6
lea rdx, str.argv0ignored
lea rdi, [rsp + 0xe0]
mov r8d, 0xd
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea rcx, [rsp + 0x730]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r14, rax
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rbx, rax
add rbx, r14
lea rcx, [rbx + rbx]
add rcx, 2
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000677f
mov rdi, rax
lea rdx, [rsp + 0xe0]
mov rcx, rax
mov r8, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
lea rdx, [rsp + 0x730]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x310]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x70], 0x68
lea rax, [0x14003e23e]
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x520]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test esi, esi
setne bl
je 0x140006781
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x140006781
call fcn.140018700
int3