Function at 0xcd7037
Capabilities:
Check if file exists
Copy file
Delete file
Query or enumerate registry value
Write file on windows

Disassembly:
push 0x97c
mov eax, 0xbd0d4d
call fcn.00bc132b
mov byte [ebp - 0x95b], dl
mov edi, ecx
test dword [0xd0a5c0], 0x2000
je 0xcd7069
mov edx, 0xb3d5c8
mov ecx, 0xd08200
call fcn.00b8e628
push 0x82
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push 2
push 0xb48d68
mov edx, 0xb27250
mov byte [ebp - 0x95a], bl
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x959], bl
call fcn.00bbc0f1
test eax, eax
js 0xcd73b6
mov byte [ebp - 0x95a], 1
mov dword [ebp - 0x974], ebx
mov dword [ebp - 0x970], ebx
mov dword [ebp - 0x96c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x980], ebx
mov dword [ebp - 0x97c], ebx
mov dword [ebp - 0x978], ebx
lea ecx, [ebp - 0x980]
mov byte [ebp - 4], 1
call fcn.00b7a9bd
or esi, 0xffffffff
lea ecx, [ebp - 0x974]
mov dword [ebp - 0x97c], esi
mov dword [ebp - 0x978], esi
call fcn.00b7a9bd
lea eax, [ebp - 0x980]
mov dword [ebp - 0x970], esi
push eax
lea edx, [ebp - 0x974]
mov dword [ebp - 0x96c], esi
lea ecx, [ebp - 0x11c]
call fcn.00cab278
test eax, eax
js 0xcd73a0
mov dword [ebp - 0x968], ebx
mov dword [ebp - 0x964], ebx
mov dword [ebp - 0x960], ebx
lea ecx, [ebp - 0x968]
mov byte [ebp - 4], 2
call fcn.00b7a9bd
mov ecx, dword [ebp - 0x974]
lea eax, [ebp - 0x968]
push eax
mov dword [ebp - 0x964], esi
mov dword [ebp - 0x960], esi
call fcn.00cf6a7b
test eax, eax
js 0xcd7395
lea eax, [ebp - 0x984]
mov byte [ebp - 0x959], 1
push eax
lea eax, [ebp - 0x958]
mov dword [ebp - 0x984], 0x10
push eax
push ebx
push 8
push 0xb48e48
push 0xb2dbc8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
test eax, eax
jle 0xcd71ae
movzx eax, ax
or eax, 0x80070000
mov esi, 0xb27854
test eax, eax
jns 0xcd71c1
mov edx, 0xca9
jmp 0xcd7245
push 0xb48e28
push dword [ebp - 0x968]
lea eax, [ebp - 0x324]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
test eax, eax
jns 0xcd71e9
mov edx, 0xcad
jmp 0xcd7245
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
jne 0xcd72b4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0xcd7235
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xcd7239
movzx eax, ax
or eax, 0x80070000
jmp 0xcd7237
mov eax, ebx
test eax, eax
jns 0xcd7251
mov esi, 0xb27854
mov edx, 0xcb2
mov ecx, dword [ebp + 4]
push eax
push esi
call fcn.00b913f8
jmp 0xcd72b4
push ebx
lea eax, [ebp - 0x988]
push eax
push 0x10
lea eax, [ebp - 0x958]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0xcd72a8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xcd7281
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xcd7288
mov eax, 0x80004005
mov ecx, dword [ebp + 4]
mov edx, 0xcb5
push eax
push 0xb27854
call fcn.00b913f8
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov esi, 0xb27854
push 0x104
lea eax, [ebp - 0x52c]
push eax
push 0xb48de8
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_SHExpandEnvironmentStringsW]
test eax, eax
jne 0xcd72e2
mov ecx, dword [ebp + 4]
mov edx, 0xcc2
push esi
call fcn.00c2616d
jmp 0xcd7395
mov dword [ebp - 0x948], 0xb48dc8
mov dword [ebp - 0x944], 0xb48ec8
mov dword [ebp - 0x940], 0xb48ea8
push dword [ebp + ebx*4 - 0x948]
lea eax, [ebp - 0x52c]
push eax
push 0x104
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
mov esi, eax
test esi, esi
jns 0xcd733d
mov ecx, dword [ebp + 4]
mov edx, 0xcc8
push esi
push 0xb27854
call fcn.00b913f8
test esi, esi
js 0xcd738b
push dword [ebp + ebx*4 - 0x948]
lea eax, [ebp - 0x734]
push dword [ebp - 0x968]
push 0x104
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
test eax, eax
jns 0xcd7375
mov ecx, dword [ebp + 4]
mov edx, 0xccb
push eax
push 0xb27854
call fcn.00b913f8
jmp 0xcd738b
push 1
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
inc ebx
cmp ebx, 3
jb 0xcd7300
lea ecx, [ebp - 0x968]
call fcn.00b7a9bd
lea ecx, [ebp - 0x980]
call fcn.00b7a9bd
lea ecx, [ebp - 0x974]
call fcn.00b7a9bd
cmp byte [ebp - 0x95b], 0
je 0xcd73d4
lea eax, [ebp - 0x959]
mov ecx, edi
push eax
lea eax, [ebp - 0x95a]
push eax
call fcn.00cbf8a6
test dword [0xd0a5c0], 0x2000
je 0xcd73ef
mov edx, 0xb3d5a8
mov ecx, 0xd08200
call fcn.00b8e628
call fcn.00bc12da
ret