Function at 0x140009c50
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
lea r9, [rbp + 0x58]
and dword [rbp - 0x18], ebx
mov r12, rcx
and dword [rbp - 0x14], ebx
lea rcx, [0x14001d698]
and qword [rbp - 0x10], rbx
xor r15d, r15d
and qword [rbp + 0x48], rbx
xor r8d, r8d
and qword [rbp + 0x58], rbx
xor edx, edx
mov qword [rbp + 0x50], rbx
mov qword [rbp - 0x20], r15
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test eax, eax
jns 0x140009ca9
mov ecx, eax
call fcn.1400091d8
jmp 0x140009cce
mov r8, qword [rbp + 0x58]
lea rdx, str._s_rempl
lea rcx, [rbp + 0x50]
call fcn.140005c5c
mov esi, eax
test eax, eax
jns 0x140009cca
mov ecx, eax
call fcn.1400091d8
mov rbx, qword [rbp + 0x50]
mov ecx, esi
call fcn.1400091f4
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140009ce4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test esi, esi
jns 0x140009cef
mov ecx, esi
jmp 0x140009ecf
lea r9, [rbp - 0x20]
mov rcx, rbx
call fcn.14000aa9c
mov esi, eax
test eax, eax
jns 0x140009d11
mov ecx, eax
call fcn.1400091d8
mov r15, qword [rbp - 0x20]
jmp 0x140009ed4
mov r15, qword [rbp - 0x20]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140009d2d
shr edi, 4
and edi, 1
jmp 0x140009d2f
xor edi, edi
xor ecx, ecx
call fcn.1400091f4
xor ecx, ecx
call fcn.1400091f4
test edi, edi
jne 0x140009d53
mov rcx, r15
call fcn.14000abbc
mov esi, eax
test eax, eax
js 0x140009ecd
xor r14d, r14d
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140009d83
lea rdi, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.1400091f4
and qword [rbp + 0x48], 0
inc r14d
lea r9, str.ServiceRemediation
mov r8, r15
mov dword [rsp + 0x20], r14d
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.140005c5c
mov esi, eax
test eax, eax
js 0x140009ecd
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400090a4
mov esi, eax
test eax, eax
js 0x140009ecd
cmp r14d, 0x32
jb 0x140009d56
mov r14, qword [rbp - 0x10]
mov rcx, qword [r14 + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140009dee
shr edi, 4
not edi
and edi, 1
jmp 0x140009df0
xor edi, edi
xor ecx, ecx
call fcn.1400091f4
xor ecx, ecx
call fcn.1400091f4
test edi, edi
je 0x140009e3a
mov rcx, qword [r14 + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140009e3a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x140009e27
mov esi, 0x80004005
jmp 0x140009ce8
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140009ce8
mov esi, 0x188
mov rcx, qword [r14 + rsi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140009e5b
shr edi, 4
not edi
and edi, 1
jmp 0x140009e5d
xor edi, edi
xor ecx, ecx
call fcn.1400091f4
xor ecx, ecx
call fcn.1400091f4
test edi, edi
je 0x140009e82
mov rdx, qword [r14 + rsi]
mov rcx, qword [r14 + rsi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
test eax, eax
je 0x140009e13
sub rsi, 8
jne 0x140009e3f
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x140009ea2
shr edi, 4
not edi
and edi, 1
jmp 0x140009ea4
xor edi, edi
xor ecx, ecx
call fcn.1400091f4
xor ecx, ecx
call fcn.1400091f4
xor esi, esi
test edi, edi
je 0x140009ec1
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rax, qword [r14]
and qword [r14], rsi
mov qword [r12], rax
jmp 0x140009ed4
mov ecx, eax
call fcn.1400091d8
mov ecx, esi
call fcn.1400091f4
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x140009f03
lea rdi, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.1400091f4
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.14000afb0
mov rdi, qword [rbp - 0x10]
test rdi, rdi
je 0x140009f2b
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test r15, r15
je 0x140009f4c
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
lea r8, [r15 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.1400091f4
test rbx, rbx
je 0x140009f6d
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.1400091f4
mov eax, esi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret