Function at 0x140006c90
Capabilities:
Copy file
Create process on windows
Read .ini file

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1138
call fcn.140028630
sub rsp, rax
movaps xmmword [rsp + 0x1120], xmm6
mov rax, qword [0x140048030]
xor rax, rsp
mov qword [rsp + 0x1118], rax
xor edi, edi
lea rsi, [rsp + 0xcf0]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015060
lea r14, [0x14004aa40]
mov r8d, 0x104
mov rcx, rsi
mov rdx, r14
call fcn.140013424
lea rbx, [rsp + 0xae0]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.140015060
mov r8d, 0x104
mov rcx, rbx
mov rdx, r14
call fcn.140013424
lea rdx, str.updater.ini
mov rcx, rbx
call fcn.140035400
test eax, eax
je 0x140006e20
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeRelPath
xor edi, edi
lea r9, [rsp + 0x8d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140006e20
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x105
lea rcx, str.PostUpdateWin
lea rdx, str.ExeArg
xor edi, edi
lea r9, [rsp + 0x6c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x140006e20
lea rdx, [0x140040572]
lea rcx, [rsp + 0x8d0]
call fcn.14001544c
test rax, rax
jne 0x140006e1e
lea rdx, [0x14004056c]
lea rcx, [rsp + 0x8d0]
call fcn.14001544c
test rax, rax
jne 0x140006e1e
lea rdx, [0x1400404a6]
lea rcx, [rsp + 0x8d0]
call fcn.14001544c
test rax, rax
jne 0x140006e1e
lea rdx, [0x1400404ac]
lea rcx, [rsp + 0x8d0]
call fcn.14001544c
test rax, rax
jne 0x140006e1e
movzx eax, word [rsp + 0x8d0]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x140006e47
movabs rcx, 0x400000000003
bt rcx, rax
jae 0x140006e47
xor edi, edi
mov rcx, qword [rsp + 0x1118]
xor rcx, rsp
call fcn.140025ef0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x1120]
add rsp, 0x1138
pop rbx
pop rdi
pop rsi
pop r14
ret
xor edi, edi
lea rbx, [rsp + 0x4b0]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call fcn.140015060
lea rdx, [0x14004aa40]
mov r8d, 0x104
mov rcx, rbx
call fcn.140013424
lea rdx, [rsp + 0x8d0]
mov rcx, rbx
call fcn.140035400
test eax, eax
je 0x140006e20
lea rcx, [rsp + 0x4b0]
call fcn.140012b30
test al, al
je 0x140006e1e
cmp byte [0x14004aa38], 0
je 0x140006eb9
lea rcx, [rsp + 0x4b0]
call fcn.140011740
test eax, eax
je 0x140006e1e
lea rcx, [rsp + 0x4b0]
call fcn.1400132f0
cmp rax, 0x104
ja 0x140006e1e
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x4b0]
mov r8d, 0x105
mov rcx, rdi
call fcn.140013424
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140006e1e
lea rdx, str.uninstall.update
lea rcx, [rsp + 0x2a0]
call fcn.140035400
test eax, eax
je 0x140006e1e
lea rcx, [rsp + 0x90]
mov r8d, 0x20a
xor edx, edx
call fcn.140015060
cmp byte [0x14004aa39], 1
jne 0x140006f91
lea rcx, [rsp + 0x90]
call fcn.140012e40
test eax, eax
je 0x140006e1e
lea rdi, [rsp + 0xf00]
mov r8d, 0x20a
mov rcx, rdi
xor edx, edx
call fcn.140015060
lea rcx, [0x1400401be]
mov rdx, rdi
call fcn.140012f40
test eax, eax
je 0x140006e1e
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf00]
jmp 0x140006fb8
lea rdx, [0x14004a200]
lea rdi, [rsp + 0x90]
mov r8d, 0x104
mov rcx, rdi
call fcn.140013424
lea rdx, [0x1400401b2]
mov rcx, rdi
call fcn.140035400
test eax, eax
je 0x140006e1e
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movups xmmword [rdi + 0xc], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.argv0ignored
mov r8d, ntohl
mov rcx, rdi
call fcn.140013424
lea rcx, [rsp + 0x6c0]
call fcn.1400132f0
mov rbx, rax
mov rcx, rdi
call fcn.1400132f0
mov r14, rax
add r14, rbx
lea rcx, [r14 + r14]
add rcx, 2
call fcn.140021118
xor edi, edi
test rax, rax
je 0x140006e20
mov rbx, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r8, r14
call fcn.140013424
lea rdx, [rsp + 0x6c0]
mov rcx, rbx
call fcn.140021f50
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2a0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rax, [rsp + 0xf00]
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x10], xmm6
mov qword [rax + 0x60], rdi
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x20], xmm6
mov dword [rax], 0x68
lea rcx, [0x1400405ea]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rdi
movaps xmmword [rcx], xmm6
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x4b0]
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rcx, rbx
call fcn.140020ba4
test esi, esi
setne dil
je 0x140006e20
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
jmp 0x140006e20