Function at 0x140006eb0
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1130
call fcn.14002a5e0
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x1118], rax
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140017010
lea rbx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rsi
mov rdx, rbx
call fcn.1400153dc
lea rdi, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140017010
mov r8d, 0x104
mov rcx, rdi
mov rdx, rbx
call fcn.1400153dc
lea rdx, str.updater.ini
mov rcx, rdi
call fcn.1400372d0
test eax, eax
je 0x14000704f
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000707d
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1400070ab
lea rdx, [0x14004411c]
lea rcx, [rsp + 0x8d0]
call fcn.1400173fc
test rax, rax
jne 0x14000701e
lea rdx, [0x140044116]
lea rcx, [rsp + 0x8d0]
call fcn.1400173fc
test rax, rax
jne 0x14000701e
lea rdx, [0x140044050]
lea rcx, [rsp + 0x8d0]
call fcn.1400173fc
test rax, rax
jne 0x14000701e
lea rdx, [0x140044056]
lea rcx, [rsp + 0x8d0]
call fcn.1400173fc
test rax, rax
je 0x140007107
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400073c5
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_contains_disallowed_characters
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007384
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_INI_path
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007406
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeRelPath
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007447
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_retrieve_ExeArg
call fcn.140013720
xor esi, esi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.140027ea0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x140007155
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140007155
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007728
lea rdx, str.LaunchWinPostProcess_failed_because_first_character_is_invalid
jmp 0x1400070d7
lea rdi, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140017010
lea rdx, [0x14004ea40]
mov r8d, 0x104
mov rcx, rdi
call fcn.1400153dc
lea rdx, [rsp + 0x8d0]
mov rcx, rdi
call fcn.1400372d0
test eax, eax
je 0x140007242
lea rcx, [rsp + 0x4b0]
call fcn.140013970
test al, al
je 0x140007273
cmp byte [0x14004ea38], 0
je 0x1400071cd
lea rcx, [rsp + 0x4b0]
call fcn.140013c80
test eax, eax
je 0x1400072a4
lea rcx, [rsp + 0x4b0]
call fcn.1400152a8
cmp rax, 0x104
ja 0x140007211
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.1400153dc
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400072d5
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400077eb
lea rdx, str.LaunchWinPostProcess_failed_because_dlogFile_path_is_unavailable
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007769
lea rdx, str.LaunchWinPostProcess_failed_because_PathAppendSafe_failed_when_getting_full_executable_path
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400077aa
lea rdx, str.LaunchWinPostProcess_failed_because_executable_path_is_not_a_valid__full_path
jmp 0x1400070d7
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000782c
lea rdx, str.LaunchWinPostProcess_failed_because_the_binary_doesnt_match_the_allowed_certificates
jmp 0x1400070d7
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.1400372d0
test eax, eax
je 0x140007211
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.140017010
cmp byte [0x14004ea39], 1
jne 0x140007488
lea rcx, [rsp + 0x90]
call fcn.140013340
test eax, eax
je 0x140007353
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140017010
lea rcx, [0x140043d68]
mov rdx, rdi
call fcn.140013440
test eax, eax
jne 0x1400074fb
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000786d
lea rdx, str.LaunchWinPostProcess_failed_because_a_secure_slogFile_path_is_unavailable
jmp 0x1400070d7
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007074
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007074
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007043
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007043
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400070a2
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400070a2
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400070d0
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400070d0
lea rdx, [0x14004e200]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.1400153dc
cmp byte [0x14004ec49], 0
lea rax, str.update.log
lea rdx, [0x140043d4a]
cmove rdx, rax
mov rcx, rdi
call fcn.1400372d0
test eax, eax
jne 0x140007518
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007930
lea rdx, str.LaunchWinPostProcess_failed_because_slogFile_path_is_unavailable
jmp 0x1400070d7
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
call fcn.1400372d0
test eax, eax
je 0x140007353
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.1400153dc
lea rcx, [rsp + 0x6c0]
call fcn.1400152a8
mov rbx, rax
mov rcx, rdi
call fcn.1400152a8
mov r15, rax
lea r14, [rax + rbx]
lea rcx, [r14*2 + 2]
call fcn.1400230c8
test rax, rax
je 0x1400076c6
mov rdi, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.1400153dc
lea rdx, [rsp + 0x6c0]
mov rcx, rdi
call fcn.140023f00
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor ebx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rbx
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x140044194]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rbx
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rdi
call fcn.140022b54
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test esi, esi
setne sil
je 0x140007706
cmp eax, ecx
jg 0x1400078ae
lea rdx, str.LaunchWinPostProcess___Waiting_for_process_to_complete
call fcn.140013720
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400078ef
lea rdx, str.LaunchWinPostProcess___Process_completed
call fcn.140013720
jmp 0x1400070de
lea rsi, [r15 + rbx]
inc rsi
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007971
lea rdx, str.LaunchWinPostProcess_failed_due_to_failure_to_allocate__zu_wchars_for_cmdline
mov r8, rsi
call fcn.140013720
jmp 0x1400070dc
cmp eax, ecx
jg 0x1400079b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LaunchWinPostProcess___CreateProcessW_failed:__lu
mov r8d, eax
call fcn.140013720
jmp 0x1400070de
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000714c
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x14000714c
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007267
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007267
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007298
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007298
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007236
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007236
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400072c9
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400072c9
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007378
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x140007378
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000765f
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x14000765f
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400076b5
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400076b5
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400074ef
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400074ef
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x1400076f2
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x1400076f2
lea rcx, [0x14004fe88]
call fcn.1400155a0
cmp dword [0x14004fe88], 0xffffffff
jne 0x14000770e
mov qword [0x14004fc78], 0
lea rcx, [0x140003a70]
call fcn.140015738
lea rcx, [0x14004fe88]
call fcn.140015608
jmp 0x14000770e