Function at 0x14000c2a0
Capabilities:
Delete file
Shutdown system

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402fcb80]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rcx
xor r13d, r13d
mov rcx, qword [0x140311f50]
test rcx, rcx
je 0x14000c2f8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140311f50], r13
mov r14d, 1
mov rdx, qword [0x1403154e8]
test rdx, rdx
je 0x14000c33f
lea rcx, str.SetupShadowDlg_44258D85_1D7C_43A9_9F7F_63C62CC24090
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [0x1403154e0]
test rcx, rcx
je 0x14000c32b
mov rax, qword [rcx]
mov edx, r14d
call qword [rax]
mov rcx, qword [0x1403154f8]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov qword [0x1403154e8], r13
mov rcx, qword [rsi + 0x178]
test rcx, rcx
je 0x14000c358
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x178], r13
call fcn.140040150
call fcn.140069614
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c37d
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.140069614
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c3af
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x21], rax
lea rax, vtable.CUtlCommonPath.0
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x19], r13d
xor dil, dil
lea r15, [rsi + 0x1a0]
lea r8, [0x1402964b8]
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.140053520
nop
mov rcx, qword [rsp + 0x30]
movsxd rbx, dword [rcx - 0x10]
test ebx, ebx
jns 0x14000c406
mov ecx, 0x80070057
call fcn.140011b60
int3
mov edx, r14d
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebx
or eax, edx
jge 0x14000c426
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140011b00
mov rcx, qword [rsp + 0x30]
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.1401f4a20
mov rax, qword [rsp + 0x30]
cmp ebx, dword [rax - 0xc]
jg 0x14000ca9a
mov dword [rax - 0x10], ebx
mov rax, qword [rsp + 0x30]
mov word [rax + rbx*2], r13w
mov rcx, r13
mov rdx, qword [rsp + 0x30]
lea r8, str.force
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000c47a
cmp rcx, 6
jne 0x14000c460
mov eax, r13d
jmp 0x14000c47f
sbb eax, eax
or eax, 1
test eax, eax
movzx r12d, dil
cmove r12d, r14d
mov bl, 1
lea r8, str.SkipIPTracking
lea rdx, [rbp - 0x69]
mov rcx, r15
call fcn.140053520
nop
mov rax, qword [rbp - 0x69]
movzx ecx, word [rax]
cmp cx, word [0x140297184]
jne 0x14000c4c1
movzx ecx, word [rax + 2]
cmp cx, word [0x140297186]
jne 0x14000c4c1
mov ecx, r13d
jmp 0x14000c4c6
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x14000c4e4
movzx ecx, word [rax]
cmp cx, word [0x140296e0c]
jne 0x14000c4db
mov ecx, r13d
jmp 0x14000c4e0
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x14000c4e6
xor bl, bl
lea rdx, [rax - 0x18]
or rdi, 0xffffffffffffffff
lock add dword [rdx + 0x10], edi
jg 0x14000c4fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
jne 0x14000c521
lea rbx, [rsi + 0x1c8]
mov r8b, 1
mov edx, dword [rsi + 0x220]
mov rcx, rbx
call fcn.1400248b0
mov rcx, rbx
call fcn.140024790
mov r8d, dword [rsi + 0x220]
lea rdx, [0x14029709c]
mov ecx, 0xd000000
call fcn.14002b1e0
lea r8, str.ICA.ARP.Mode
lea rdx, [rbp - 0x79]
mov rcx, r15
call fcn.140053520
mov rcx, qword [rax]
movzx eax, word [rcx]
cmp ax, word [reloc.msi.dll_MsiGetFeatureCostA]
jne 0x14000c56d
movzx eax, word [rcx + 2]
cmp ax, word [0x1402964f6]
jne 0x14000c56d
mov eax, r13d
jmp 0x14000c572
sbb eax, eax
or eax, 1
test eax, eax
sete bl
mov rdx, qword [rbp - 0x79]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c58f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000c887
lea r8, [0x1402964f8]
lea rdx, [rbp - 0x61]
mov rcx, r15
call fcn.140053520
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x38]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000c604
cmp dword [rbx + 0x10], 0
jl 0x14000c5f5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000c5f5
call fcn.1400116e0
mov r14, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14000c5ea
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x38], rax
jmp 0x14000c604
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140011b80
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c61c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rbp - 0x19], r13d
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x14000c62f
mov eax, r13d
jmp 0x14000c63c
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14000c632
mov r8d, eax
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, str.Lang
lea rcx, [rbp - 0x29]
call fcn.14003c240
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x29]
call fcn.14003c180
nop
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x29]
call fcn.14003d550
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c68f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rbp - 0x19], r13d
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x14000c6a2
mov eax, r13d
jmp 0x14000c6af
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c6a5
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, [0x140296528]
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c6e6
mov eax, r13d
jmp 0x14000c6fa
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c6f0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, str.SetupARP.exe
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c731
mov eax, r13d
jmp 0x14000c73e
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c734
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, [0x140296568]
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c775
mov eax, r13d
jmp 0x14000c78a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c780
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, str.SetupSN.dll
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c7c1
mov eax, r13d
jmp 0x14000c7ce
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c7c4
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, str.SerChck.dll
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c805
mov eax, r13d
jmp 0x14000c81a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c810
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, str.Setup.xml
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rbp - 0x19], r13d
test rbx, rbx
jne 0x14000c851
mov eax, r13d
jmp 0x14000c85e
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000c854
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140011b80
lea rdx, [0x1402965c8]
lea rcx, [rbp - 0x29]
call fcn.14003c240
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x51]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::constructor_void____ptr64]
lea r14, vtable.CUtlX.0
mov qword [rbp - 0x51], r14
mov edx, 4
lea rcx, [rbp - 0x51]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::SetFileIndex_enum_XMLFILENAMES____ptr64]
lea r8, str.CORE_PROPERTIES_XML
lea rdx, [rbp - 0x59]
mov rcx, r15
call fcn.140053520
nop
mov rdx, qword [rax]
lea rcx, [rbp - 0x51]
call qword [sym.imp.SetupXML.dll_public:_long_int___cdecl_CXMLFileManagerInterface::CreateXML_wchar_t_const____ptr64____ptr64]
test eax, eax
sete bl
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c8e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14000c9c7
call fcn.140069614
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c911
mov ecx, 0x80004005
call fcn.140011b60
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8d, dword [rsi + 0x220]
lea rdx, [0x14029709c]
lea rcx, [rsp + 0x40]
call fcn.140011640
mov edx, 4
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::SetFileIndex_enum_XMLFILENAMES____ptr64]
mov r8, qword [rsp + 0x40]
lea rdx, str.CHAINER_RETURN_CODE
mov rcx, r15
call fcn.1400536a0
xor edx, edx
lea rcx, [rsi + 0x1a8]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::SetFileIndex_enum_XMLFILENAMES____ptr64]
lea r8, str.CORE_PROPERTIES_XML
lea rdx, [rbp - 0x71]
mov rcx, r15
call fcn.140053520
nop
xor r8d, r8d
mov rdx, qword [rax]
lea rcx, [rbp - 0x51]
call qword [sym.imp.SetupXML.dll_public:_long_int___cdecl_CXMLFileManagerInterface::Saveit_wchar_t_const____ptr64__bool____ptr64]
nop
mov rdx, qword [rbp - 0x71]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c9ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c9c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsi + 0x180]
call qword [sym.imp.SetupXML.dll_public:_void___cdecl_CXMLFileManagerInterface::UnInitialize_void____ptr64]
mov rcx, qword [rsi + 0x228]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x228], r13
test r12b, r12b
je 0x14000ca21
call fcn.1400108d0
test al, al
jne 0x14000ca21
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
mov rcx, rsi
call fcn.140069e70
mov ebx, dword [rsi + 0x220]
mov qword [rbp - 0x51], r14
lea rcx, [rbp - 0x51]
call qword [sym.imp.SetupXML.dll_public_virtual:_void___cdecl_CXMLFileManagerInterface::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ca58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rax, vtable.CUtlCommonPath.0
mov qword [rbp - 0x29], rax
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ca7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000ca96
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x14000caa5
mov ecx, 0x80070057
call fcn.140011b60
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401f3080
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret