Function at 0x14000b088
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Move file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
lea r9, [rbp + 0x58]
and dword [rbp - 0x18], ebx
mov r12, rcx
and dword [rbp - 0x14], ebx
lea rcx, [0x14001c500]
and qword [rbp - 0x10], rbx
xor r15d, r15d
and qword [rbp + 0x48], rbx
xor r8d, r8d
and qword [rbp + 0x58], rbx
xor edx, edx
mov qword [rbp + 0x50], rbx
mov qword [rbp - 0x20], r15
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test eax, eax
jns 0x14000b0e1
mov ecx, eax
call fcn.140009328
jmp 0x14000b106
mov r8, qword [rbp + 0x58]
lea rdx, str._s_rempl
lea rcx, [rbp + 0x50]
call fcn.14000609c
mov esi, eax
test eax, eax
jns 0x14000b102
mov ecx, eax
call fcn.140009328
mov rbx, qword [rbp + 0x50]
mov ecx, esi
call fcn.140009344
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000b11c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test esi, esi
jns 0x14000b127
mov ecx, esi
jmp 0x14000b307
lea r9, [rbp - 0x20]
mov rcx, rbx
call fcn.14000bf54
mov esi, eax
test eax, eax
jns 0x14000b149
mov ecx, eax
call fcn.140009328
mov r15, qword [rbp - 0x20]
jmp 0x14000b30c
mov r15, qword [rbp - 0x20]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000b165
shr edi, 4
and edi, 1
jmp 0x14000b167
xor edi, edi
xor ecx, ecx
call fcn.140009344
xor ecx, ecx
call fcn.140009344
test edi, edi
jne 0x14000b18b
mov rcx, r15
call fcn.14000c074
mov esi, eax
test eax, eax
js 0x14000b305
xor r14d, r14d
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x14000b1bb
lea rdi, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140009344
and qword [rbp + 0x48], 0
inc r14d
lea r9, str.LauncherRemediation
mov r8, r15
mov dword [rsp + 0x20], r14d
lea rdx, str._s_s._03d.etl
lea rcx, [rbp + 0x48]
call fcn.14000609c
mov esi, eax
test eax, eax
js 0x14000b305
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400091f4
mov esi, eax
test eax, eax
js 0x14000b305
cmp r14d, 0x32
jb 0x14000b18e
mov r14, qword [rbp - 0x10]
mov rcx, qword [r14 + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000b226
shr edi, 4
not edi
and edi, 1
jmp 0x14000b228
xor edi, edi
xor ecx, ecx
call fcn.140009344
xor ecx, ecx
call fcn.140009344
test edi, edi
je 0x14000b272
mov rcx, qword [r14 + 0x188]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x14000b272
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x14000b25f
mov esi, 0x80004005
jmp 0x14000b120
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14000b120
mov esi, 0x188
mov rcx, qword [r14 + rsi - 8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000b293
shr edi, 4
not edi
and edi, 1
jmp 0x14000b295
xor edi, edi
xor ecx, ecx
call fcn.140009344
xor ecx, ecx
call fcn.140009344
test edi, edi
je 0x14000b2ba
mov rdx, qword [r14 + rsi]
mov rcx, qword [r14 + rsi - 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_MoveFileW]
test eax, eax
je 0x14000b24b
sub rsi, 8
jne 0x14000b277
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000b2da
shr edi, 4
not edi
and edi, 1
jmp 0x14000b2dc
xor edi, edi
xor ecx, ecx
call fcn.140009344
xor ecx, ecx
call fcn.140009344
xor esi, esi
test edi, edi
je 0x14000b2f9
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rax, qword [r14]
and qword [r14], rsi
mov qword [r12], rax
jmp 0x14000b30c
mov ecx, eax
call fcn.140009328
mov ecx, esi
call fcn.140009344
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x14000b33b
lea rdi, [rax - 4]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140009344
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.14000c468
mov rdi, qword [rbp - 0x10]
test rdi, rdi
je 0x14000b363
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test r15, r15
je 0x14000b384
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
lea r8, [r15 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140009344
test rbx, rbx
je 0x14000b3a5
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
call fcn.140009344
mov eax, esi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret