Function at 0x14001ea20
Capabilities:
Delete file
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400363c0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbx, qword [rbp + 0x3f8]
xor r12d, r12d
mov byte [rsp + 0x30], r12b
movdqa xmm0, xmmword [0x14002b1a0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
mov dword [rbx], r12d
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x170]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rdx, [rsp + 0x60]
mov edi, 0x104
mov ecx, edi
call qword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
cmp eax, edi
jb 0x14001ead8
lea edx, [rdi + 0x6c]
lea r8, str.onecoreenduserupgradeenablers_shellhelpersdownloadhelper.cpp
mov rcx, qword [rbp + 0x3c8]
call fcn.140006fb0
mov edi, eax
jmp 0x14001eb24
lea r9, [rbp + 0x170]
xor r8d, r8d
lea rdx, str.sedpack_
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetTempFileNameW]
test eax, eax
jne 0x14001eaff
mov edx, 0x171
jmp 0x14001eac1
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.14000e7e4
lea rdx, str..cab
lea rcx, [rsp + 0x40]
call fcn.14000e7e4
mov edi, r12d
test edi, edi
jns 0x14001eb30
or dword [rbx], 1
jmp 0x14001ec4a
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r9, rsi
call fcn.14001ec78
mov edi, eax
test eax, eax
jns 0x14001eb57
or dword [rbx], 2
jmp 0x14001ec4a
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, r14
call fcn.14001eedc
mov edi, eax
test eax, eax
jns 0x14001eb83
or dword [rbx], 4
jmp 0x14001ec4a
cmp byte [rsp + 0x30], r12b
jne 0x14001eb97
mov edi, 0x80070143
or dword [rbx], 8
jmp 0x14001ec4a
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.14001f098
mov edi, eax
test eax, eax
jns 0x14001ebbb
or dword [rbx], 0x10
jmp 0x14001ec4a
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov r9, r15
lea r8, [0x14001f200]
xor edx, edx
call qword [sym.imp.ext_ms_win_setupapi_classinstallers_l1_1_2.dll_SetupIterateCabinetW]
test eax, eax
jne 0x14001ebfc
mov rcx, qword [rbp + 0x3c8]
lea r8, str.onecoreenduserupgradeenablers_shellhelpersdownloadhelper.cpp
mov edx, 0x14f
call fcn.140006fb0
jmp 0x14001ebff
mov eax, r12d
test eax, eax
jns 0x14001ec06
or dword [rbx], 0x20
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x14001ec3d
mov rcx, qword [rbp + 0x3c8]
lea r8, str.onecoreenduserupgradeenablers_shellhelpersdownloadhelper.cpp
mov edx, 0x155
call fcn.140006fb0
mov edi, eax
jmp 0x14001ec40
mov edi, r12d
test edi, edi
jns 0x14001ec4a
or dword [rbx], 0x40
mov edi, r12d
lea rcx, [rsp + 0x40]
call fcn.140009aa4
mov eax, edi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14001f510
add rsp, 0x490
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret