Function at 0x14001dce0
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov r13, rcx
xor r14d, r14d
mov qword [rbp - 0x20], r14
xor edi, edi
mov qword [rbp + 0x58], rdi
xor r15d, r15d
mov qword [rbp - 0x30], r15
xor esi, esi
mov qword [rbp + 0x60], rsi
and qword [rbp - 0x38], rsi
xor ebx, ebx
test rcx, rcx
jne 0x14001dd32
mov r12d, 0x80070057
mov ecx, r12d
jmp 0x14001e121
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x14001dd88
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14001dd75
mov r12d, 0x80004005
jmp 0x14001dd2a
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
jmp 0x14001dd2a
mov r9d, 1
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, r13
call fcn.140019084
mov r12d, eax
test eax, eax
js 0x14001e11f
lea r9, [rbp - 0x20]
lea r8, str.CmdLine
lea rdx, str.SYSTEMSetupMoSetup
call fcn.140023a00
mov r14, qword [rbp - 0x20]
test eax, eax
js 0x14001dea2
test r14, r14
je 0x14001dea2
mov r9, r14
mov r8, qword [r13]
lea rdx, str._s__s
lea rcx, [rbp + 0x58]
call fcn.140002c14
mov r12d, eax
test eax, eax
jns 0x14001de02
mov ecx, eax
call fcn.140025d30
mov rdi, qword [rbp + 0x58]
jmp 0x14001e126
mov rdi, qword [rbp + 0x58]
lea rdx, [rbp + 0x48]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov r12, rax
test rbx, rbx
je 0x14001de30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, r12
mov qword [rbp - 0x28], rbx
test r12, r12
je 0x14001dea2
xor r9d, r9d
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, r13
call fcn.140019084
test eax, eax
js 0x14001dea2
mov rcx, rdi
mov qword [rbp + 0x50], rcx
xor edi, edi
mov qword [rbp + 0x58], rdi
mov r12, qword [r13]
test r12, r12
je 0x14001de95
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r12 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
mov rcx, qword [rbp + 0x50]
xor eax, eax
test rcx, rcx
cmovne rax, rcx
mov qword [r13], rax
mov rax, qword [r13 + 0x110]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x14001df06
lea rdx, [rbp + 0x50]
mov rcx, rax
call fcn.140029fcc
mov r12d, eax
test eax, eax
jns 0x14001dece
mov ecx, eax
call fcn.140025d30
jmp 0x14001def0
lea r8, [rbp + 0x60]
mov edx, dword [rbp + 0x50]
mov rcx, qword [rbp - 0x18]
call fcn.140028308
mov r12d, eax
test eax, eax
jns 0x14001deec
mov ecx, eax
call fcn.140025d30
mov rsi, qword [rbp + 0x60]
mov ecx, r12d
call fcn.140025d50
test r12d, r12d
jns 0x14001df8e
jmp 0x14001dd2a
mov eax, dword [r13 + 0x108]
sub eax, 5
cmp eax, 1
ja 0x14001e0bd
lea rdx, [rbp - 0x38]
lea rcx, str._systemdrive_UsersDefaultAppDataLocalMicrosoftWindowsWSUSSetupConfig.ini
call fcn.140024a30
mov r12d, eax
test eax, eax
js 0x14001e11f
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov r12d, eax
cmp eax, 0xffffffff
je 0x14001df59
shr r12d, 4
not r12d
and r12d, 1
jmp 0x14001df5c
xor r12d, r12d
xor ecx, ecx
call fcn.140025d50
xor ecx, ecx
call fcn.140025d50
test r12d, r12d
je 0x14001e0bd
mov rsi, qword [rbp - 0x38]
and qword [rbp - 0x38], 0
test rsi, rsi
jne 0x14001df8a
mov qword [rbp + 0x60], rsi
jmp 0x14001e0bd
mov qword [rbp + 0x60], rsi
test rsi, rsi
je 0x14001e0bd
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.14001d814
mov r12d, eax
test eax, eax
jns 0x14001dfba
mov ecx, eax
call fcn.140025d30
mov r15, qword [rbp - 0x30]
jmp 0x14001e126
test rdi, rdi
je 0x14001dfec
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rdi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
and qword [rbp + 0x58], 0
mov r15, qword [rbp - 0x30]
mov r9, r15
mov r8, qword [r13]
lea rdx, str._s__s
lea rcx, [rbp + 0x58]
call fcn.140002c14
mov r12d, eax
test eax, eax
js 0x14001ddf2
mov rdi, qword [rbp + 0x58]
lea rdx, [rbp + 0x48]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov r12, rax
test rbx, rbx
je 0x14001e040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, r12
mov qword [rbp - 0x28], rbx
test r12, r12
je 0x14001dd5d
xor r9d, r9d
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, r13
call fcn.140019084
mov r12d, eax
test eax, eax
js 0x14001e11f
mov rcx, rdi
mov qword [rbp + 0x50], rcx
xor edi, edi
mov qword [rbp + 0x58], rdi
mov r12, qword [r13]
test r12, r12
je 0x14001e0b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r12 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
mov rcx, qword [rbp + 0x50]
xor eax, eax
test rcx, rcx
cmovne rax, rcx
mov qword [r13], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov r12, rax
test rbx, rbx
je 0x14001e0f3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, r12
mov qword [rbp - 0x28], rbx
test r12, r12
je 0x14001dd5d
mov r9d, 1
mov r8d, dword [rbp + 0x48]
mov rdx, rbx
mov rcx, r13
call fcn.140019084
mov r12d, eax
test eax, eax
jns 0x14001e126
mov ecx, eax
call fcn.140025d30
mov ecx, r12d
call fcn.140025d50
nop
test rbx, rbx
je 0x14001e144
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
nop
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x14001e179
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test rsi, rsi
je 0x14001e1a7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rsi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test r15, r15
je 0x14001e1d5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r15 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test rdi, rdi
je 0x14001e203
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rdi - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
nop
test r14, r14
je 0x14001e230
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea r8, [r14 - 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
xor ecx, ecx
call fcn.140025d50
mov eax, r12d
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret