Function at 0x1400b8fd0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x3c8
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov dword [rsp + 0x2c8], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov word [rsp + 0x248], ax
lea rcx, [rsp + 0x30]
call fcn.1400caab0
mov rax, qword [rsp + 0x30]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x2cc], eax
cmp dword [rsp + 0x2cc], 0
jne 0x1400b9050
mov dword [rsp + 0x390], 1
jmp 0x1400b905b
mov dword [rsp + 0x390], 0
movzx eax, byte [rsp + 0x390]
test eax, eax
jne 0x1400b90aa
or dword [rsp + 0x2c8], 1
or dword [rsp + 0x2c8], 2
lea rdx, [0x1403113dc]
lea rcx, [rsp + 0x270]
call fcn.140001eb0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x278]
call fcn.14000f920
mov qword [rsp + 0x398], rax
jmp 0x1400b90d6
or dword [rsp + 0x2c8], 4
lea rdx, [0x14042f270]
lea rcx, [rsp + 0x280]
call fcn.1400021f0
lea rax, [rsp + 0x280]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0x268], rax
mov rdx, qword [rsp + 0x268]
lea rcx, [rsp + 0x260]
call fcn.140002230
lea rdx, [0x1403113cc]
lea rcx, [rsp + 0x258]
call fcn.140001eb0
mov qword [rsp + 0x3a0], rax
lea rdx, [0x1403116c0]
lea rcx, [rsp + 0x288]
call fcn.140001eb0
mov qword [rsp + 0x3a8], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call fcn.140001eb0
lea r8, [0x14031140c]
mov rdx, rax
lea rcx, [rsp + 0x298]
call fcn.14001db30
lea r8, [0x1403116e0]
mov rdx, rax
lea rcx, [rsp + 0x2a0]
call fcn.14001db30
lea r8, [0x1403113f4]
mov rdx, rax
lea rcx, [rsp + 0x2a8]
call fcn.14001db30
mov rcx, qword [rsp + 0x3a8]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x2b0]
call fcn.14000f920
lea r8, [rsp + 0x260]
mov rdx, rax
lea rcx, [rsp + 0x2b8]
call fcn.14000f920
mov rcx, qword [rsp + 0x3a0]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.14000f920
lea r8, str.AppSettings.xml
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.14001db30
mov rax, qword [rsp + 0x2c0]
sub rax, 0x18
mov qword [rsp + 0x310], rax
mov rcx, qword [rsp + 0x310]
call fcn.140001000
mov rax, qword [rsp + 0x2b8]
sub rax, 0x18
mov qword [rsp + 0x318], rax
mov rcx, qword [rsp + 0x318]
call fcn.140001000
mov rax, qword [rsp + 0x2b0]
sub rax, 0x18
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x320]
call fcn.140001000
mov rax, qword [rsp + 0x2a8]
sub rax, 0x18
mov qword [rsp + 0x328], rax
mov rcx, qword [rsp + 0x328]
call fcn.140001000
mov rax, qword [rsp + 0x2a0]
sub rax, 0x18
mov qword [rsp + 0x330], rax
mov rcx, qword [rsp + 0x330]
call fcn.140001000
mov rax, qword [rsp + 0x298]
sub rax, 0x18
mov qword [rsp + 0x338], rax
mov rcx, qword [rsp + 0x338]
call fcn.140001000
mov rax, qword [rsp + 0x290]
sub rax, 0x18
mov qword [rsp + 0x340], rax
mov rcx, qword [rsp + 0x340]
call fcn.140001000
lea rcx, [rsp + 0x288]
call fcn.140203610
lea rcx, [rsp + 0x260]
call fcn.140203610
lea rcx, [rsp + 0x258]
call fcn.140203610
mov eax, dword [rsp + 0x2c8]
and eax, 4
test eax, eax
je 0x1400b9320
and dword [rsp + 0x2c8], 0xfffffffb
lea rcx, [rsp + 0x280]
call fcn.140203610
mov eax, dword [rsp + 0x2c8]
and eax, 2
test eax, eax
je 0x1400b9343
and dword [rsp + 0x2c8], 0xfffffffd
lea rcx, [rsp + 0x278]
call fcn.140203610
mov eax, dword [rsp + 0x2c8]
and eax, 1
test eax, eax
je 0x1400b9366
and dword [rsp + 0x2c8], 0xfffffffe
lea rcx, [rsp + 0x270]
call fcn.140203610
mov rax, qword [rsp + 0x3d0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x378], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x250]
call fcn.140203610
lea rcx, [rsp + 0x30]
call fcn.140203610
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x3c8
ret