Function at 0x14000944c
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x780
xor ebx, ebx
mov r15, r9
mov r14, rcx
test rdx, rdx
je 0x140009732
test r8d, r8d
je 0x140009732
test rcx, rcx
je 0x140009732
call fcn.14000a018
test eax, eax
je 0x140009725
mov rdx, qword [0x1400268c8]
lea rdi, [rbp + 0x270]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rbp + 0x270]
add rdx, 0x474
call fcn.140001a5c
lea rdx, str.update.msu
lea rcx, [rbp + 0x270]
call fcn.140001a20
xor eax, eax
mov qword [rsp + 0x38], rbx
mov r12d, 0x100
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x70]
mov ecx, r12d
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
or r9d, 0xffffffff
lea r13d, [r12 - 2]
xor edx, edx
mov dword [rsp + 0x28], r13d
lea r8, [rbp + 0x270]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140009725
mov rcx, qword [0x1400268c8]
lea edx, [rbx + 8]
mov r8d, 0x338
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x140009725
lea rcx, [rax + 0x12e]
test rcx, rcx
je 0x140009586
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x140009586
mov al, byte [rsp + 0x70]
test al, al
je 0x140009584
lea rdx, [rsp + 0x70]
sub rdx, rcx
mov byte [rcx], al
inc rcx
mov al, byte [rdx + rcx]
test al, al
jne 0x140009578
mov byte [rcx], bl
mov qword [rsp + 0x60], rbx
lea rax, [rsi + 0xc]
mov qword [rsp + 0x58], rax
lea r9, [0x140002a80]
mov dword [rax], 0x7fffffff
lea r8, [0x140002a64]
lea rax, [0x140002d20]
mov rcx, rsi
mov qword [rsp + 0x50], rax
lea rdx, [0x140002c54]
lea rax, [0x140002c1c]
mov qword [rsp + 0x48], rax
lea rax, [0x140002be0]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140002ba8]
mov qword [rsp + 0x38], rax
lea rax, [0x140002b68]
mov qword [rsp + 0x30], rax
lea rax, [0x140002b28]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140002aa4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rsi + 0x330], rax
test rax, rax
je 0x14000970f
test r15, r15
jne 0x14000962c
mov rcx, r14
call fcn.140001980
mov r15, rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x170]
mov rcx, r12
mov dword [rsp + 0x28], r13d
rep stosb byte [rdi], al
lea rax, [rbp + 0x170]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r12, [0x140002c54]
lea r13, [0x140002c54]
test eax, eax
je 0x1400096ed
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x70]
mov ecx, 0x100
mov dword [rsp + 0x28], 0xfe
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400096ed
mov rcx, qword [rsi + 0x330]
lea rax, [0x140002c58]
mov word [rsp + 0x38], bx
lea r8, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.Cabinet.dll_FCIAddFile]
mov ebx, eax
mov rcx, qword [rsi + 0x330]
mov r9, r12
mov r8, r13
xor edx, edx
call qword [sym.imp.Cabinet.dll_FCIFlushCabinet]
mov rcx, qword [rsi + 0x330]
call qword [sym.imp.Cabinet.dll_FCIDestroy]
mov rcx, qword [0x1400268c8]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x140009734
xor eax, eax
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret