Function at 0x1400089bc
Capabilities:
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x58], 0
lea r9, [rbp + 0x58]
xor r14d, r14d
mov r15, rcx
and dword [rbp - 0x10], r14d
lea rcx, [0x140011da0]
and dword [rbp - 0xc], r14d
xor r8d, r8d
and qword [rbp - 8], r14
xor edx, edx
and qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x140008c33
mov rcx, qword [rbp + 0x58]
lea r9, [rbp + 0x50]
lea rdx, str.USOSharedLogs
call fcn.140009404
mov edi, eax
test eax, eax
jns 0x140008a3d
mov ecx, eax
call fcn.14000b708
mov r14, qword [rbp + 0x50]
jmp 0x140008c3a
mov r14, qword [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
or r13d, 0xffffffff
mov ebx, eax
cmp eax, r13d
je 0x140008a63
shr ebx, 4
and ebx, 1
jmp 0x140008a65
xor ebx, ebx
xor ecx, ecx
call fcn.14000b77c
xor ecx, ecx
call fcn.14000b77c
test ebx, ebx
jne 0x140008a89
mov rcx, r14
call fcn.14000953c
mov edi, eax
test eax, eax
js 0x140008c33
xor esi, esi
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140008ac4
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.14000b77c
and qword [rbp + 0x48], 0
inc esi
lea r9, str.DirectToUpdate
mov r8, r14
mov dword [rsp + 0x20], esi
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.14000ab78
mov edi, eax
test eax, eax
js 0x140008c33
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.1400092cc
mov edi, eax
test eax, eax
js 0x140008c33
cmp esi, 0x32
jb 0x140008a8b
mov rsi, qword [rbp - 8]
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008b32
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008b34
xor ebx, ebx
xor ecx, ecx
call fcn.14000b77c
xor ecx, ecx
call fcn.14000b77c
test ebx, ebx
je 0x140008b89
mov rcx, qword [rsi + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140008b89
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x140008b74
mov edi, 0x80004005
jmp 0x140008b82
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x140008c35
mov edi, 0x188
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008bb0
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008bb2
xor ebx, ebx
xor ecx, ecx
call fcn.14000b77c
xor ecx, ecx
call fcn.14000b77c
test ebx, ebx
je 0x140008bdd
mov rdx, qword [rsi + rdi]
mov rcx, qword [rsi + rdi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x140008b5d
sub rdi, 8
jne 0x140008b8e
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, r13d
je 0x140008c03
shr ebx, 4
not ebx
and ebx, 1
jmp 0x140008c05
xor ebx, ebx
xor ecx, ecx
call fcn.14000b77c
xor ecx, ecx
call fcn.14000b77c
xor edi, edi
test ebx, ebx
je 0x140008c28
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov rax, qword [rsi]
and qword [rsi], rdi
mov qword [r15], rax
jmp 0x140008c3a
mov ecx, eax
call fcn.14000b708
mov ecx, edi
call fcn.14000b77c
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140008c75
lea rbx, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.14000b77c
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.140009aac
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x140008ca9
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
test r14, r14
je 0x140008cd6
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.14000b77c
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140008ceb
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret