Function at 0x14000bfec
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x780
xor ebx, ebx
mov r15, r9
mov r14, rcx
test rdx, rdx
je 0x14000c2d2
test r8d, r8d
je 0x14000c2d2
test rcx, rcx
je 0x14000c2d2
call fcn.14000d99c
test eax, eax
je 0x14000c2c5
mov rdx, qword [0x14002fa70]
lea rdi, [rbp + 0x270]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rbp + 0x270]
add rdx, 0x47c
call fcn.140001af4
lea rdx, str.update.msu
lea rcx, [rbp + 0x270]
call fcn.140001ab8
xor eax, eax
mov qword [rsp + 0x38], rbx
mov r12d, 0x100
mov qword [rsp + 0x30], rbx
lea rdi, [rsp + 0x70]
mov ecx, r12d
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
or r9d, 0xffffffff
lea r13d, [r12 - 2]
xor edx, edx
mov dword [rsp + 0x28], r13d
lea r8, [rbp + 0x270]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14000c2c5
mov rcx, qword [0x14002fa70]
lea edx, [rbx + 8]
mov r8d, 0x338
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x14000c2c5
lea rcx, [rax + 0x12e]
test rcx, rcx
je 0x14000c126
lea rax, [rsp + 0x70]
cmp rcx, rax
je 0x14000c126
mov al, byte [rsp + 0x70]
test al, al
je 0x14000c124
lea rdx, [rsp + 0x70]
sub rdx, rcx
mov byte [rcx], al
inc rcx
mov al, byte [rdx + rcx]
test al, al
jne 0x14000c118
mov byte [rcx], bl
mov qword [rsp + 0x60], rbx
lea rax, [rsi + 0xc]
mov qword [rsp + 0x58], rax
lea r9, [0x140002db8]
mov dword [rax], 0x7fffffff
lea r8, [0x140002d9c]
lea rax, [0x140003058]
mov rcx, rsi
mov qword [rsp + 0x50], rax
lea rdx, [0x140002f8c]
lea rax, [0x140002f54]
mov qword [rsp + 0x48], rax
lea rax, [0x140002f18]
mov qword [rsp + 0x40], rax
lea rax, [fcn.140002ee0]
mov qword [rsp + 0x38], rax
lea rax, [0x140002ea0]
mov qword [rsp + 0x30], rax
lea rax, [0x140002e60]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140002ddc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rsi + 0x330], rax
test rax, rax
je 0x14000c2af
test r15, r15
jne 0x14000c1cc
mov rcx, r14
call fcn.140001a84
mov r15, rax
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x170]
mov rcx, r12
mov dword [rsp + 0x28], r13d
rep stosb byte [rdi], al
lea rax, [rbp + 0x170]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r12, [0x140002f8c]
lea r13, [0x140002f8c]
test eax, eax
je 0x14000c28d
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdi, [rbp + 0x70]
mov ecx, 0x100
mov dword [rsp + 0x28], 0xfe
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
xor ecx, ecx
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14000c28d
mov rcx, qword [rsi + 0x330]
lea rax, [0x140002f90]
mov word [rsp + 0x38], bx
lea r8, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r13
call qword [sym.imp.Cabinet.dll_FCIAddFile]
mov ebx, eax
mov rcx, qword [rsi + 0x330]
mov r9, r12
mov r8, r13
xor edx, edx
call qword [sym.imp.Cabinet.dll_FCIFlushCabinet]
mov rcx, qword [rsi + 0x330]
call qword [sym.imp.Cabinet.dll_FCIDestroy]
mov rcx, qword [0x14002fa70]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x14000c2d4
xor eax, eax
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret