Function at 0x14000c1e0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x780
xor ebx, ebx
mov r15, r9
mov r14, rcx
test rdx, rdx
je 0x14000c4c6
test r8d, r8d
je 0x14000c4c6
test rcx, rcx
je 0x14000c4c6
call fcn.14000dba4
test eax, eax
je 0x14000c4b9
mov rdx, qword [0x1400262a0]
lea rdi, [rbp + 0x270]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rbp + 0x270]
add rdx, 0x47c
call fcn.140001af0
lea rdx, str.update.msu
lea rcx, [rbp + 0x270]
call fcn.140001ab4
xor eax, eax
mov qword [rsp + 0x38], rbx
mov r12d, pe_nt_image_headers64
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x70]
mov ecx, r12d
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
or r9d, 0xffffffff
lea r13d, [r12 - 2]
xor edx, edx
mov dword [rsp + 0x28], r13d
lea r8, [rbp + 0x270]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14000c4b9
mov rcx, qword [0x1400262a0]
lea edx, [rbx + 8]
mov r8d, 0x338
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x14000c4b9
lea rcx, [rax + 0x12e]
test rcx, rcx
je 0x14000c31a
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x14000c31a
mov al, byte [rsp + 0x70]
test al, al
je 0x14000c318
lea rdx, [rsp + 0x70]
sub rdx, rcx
mov byte [rcx], al
inc rcx
mov al, byte [rdx + rcx]
test al, al
jne 0x14000c30c
mov byte [rcx], bl
mov qword [rsp + 0x60], rbx
lea rax, [rsi + 0xc]
mov qword [rsp + 0x58], rax
lea r9, [0x140002dc0]
mov dword [rax], 0x7fffffff
lea r8, [0x140002da4]
lea rax, [0x140003060]
mov rcx, rsi
mov qword [rsp + 0x50], rax
lea rdx, [0x140002f94]
lea rax, [0x140002f5c]
mov qword [rsp + 0x48], rax
lea rax, [0x140002f20]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140002ee8]
mov qword [rsp + 0x38], rax
lea rax, [0x140002ea8]
mov qword [rsp + 0x30], rax
lea rax, [0x140002e68]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140002de4]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rsi + 0x330], rax
test rax, rax
je 0x14000c4a3
test r15, r15
jne 0x14000c3c0
mov rcx, r14
call fcn.140001a80
mov r15, rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x170]
mov rcx, r12
mov dword [rsp + 0x28], r13d
rep stosb byte [rdi], al
lea rax, [rbp + 0x170]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r12, [0x140002f94]
lea r13, [0x140002f94]
test eax, eax
je 0x14000c481
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x70]
mov ecx, pe_nt_image_headers64
mov dword [rsp + 0x28], 0xfe
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14000c481
mov rcx, qword [rsi + 0x330]
lea rax, [0x140002f98]
mov word [rsp + 0x38], bx
lea r8, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.Cabinet.dll_FCIAddFile]
mov ebx, eax
mov rcx, qword [rsi + 0x330]
mov r9, r12
mov r8, r13
xor edx, edx
call qword [sym.imp.Cabinet.dll_FCIFlushCabinet]
mov rcx, qword [rsi + 0x330]
call qword [sym.imp.Cabinet.dll_FCIDestroy]
mov rcx, qword [0x1400262a0]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x14000c4c8
xor eax, eax
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret