Function at 0x10000a1cc
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0xf0
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0xe0], rax
and qword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
mov rbx, rdx
mov edi, ecx
test ecx, ecx
je 0x10000a444
test rdx, rdx
je 0x10000a444
mov esi, 9
lea rdx, [rsp + 0x50]
mov ecx, esi
call fcn.100002294
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, edi
call fcn.10000a494
test eax, eax
jne 0x10000a256
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x60]
call fcn.10000d760
lea edi, [rsi - 8]
jmp 0x10000a26a
mov edi, 1
cmp dword [rsp + 0x40], edi
jne 0x10000a27b
mov ecx, esi
call fcn.100002d78
xor edi, edi
lea rcx, [rsp + 0x50]
call fcn.10000230c
mov eax, edi
jmp 0x10000a463
mov r9d, dword [rsp + 0xd4]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
or r9d, 0x20019
xor r8d, r8d
mov ebp, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x10000a3d2
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x10000a2cc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and qword [rsp + 0x30], 0
mov r12, qword [rsp + 0xa8]
and dword [rsp + 0x28], 0
mov rcx, r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0010000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x10000a354
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 0xce
xor ecx, ecx
call fcn.10000d950
xor r8d, r8d
mov edx, 0xcf
xor ecx, ecx
mov rbx, rax
call fcn.10000d950
mov rsi, rax
mov r9d, dword [rsp + 0x68]
mov r8, rbx
mov rdx, r12
mov rcx, rsi
call fcn.10000239c
cmp eax, 2
jg 0x10000a32e
sub eax, edi
neg eax
sbb ebx, ebx
and ebx, 0x4c7
jmp 0x10000a36a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10000a363
xor ebx, ebx
jmp 0x10000a36e
xor ebp, ebp
mov ebx, 0x322
test ebx, ebx
jne 0x10000a3e2
mov rcx, r12
mov qword [rsp + 0xb0], r12
call fcn.1000033a8
mov rsi, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x10000a395
mov ebx, 0x322
jmp 0x10000a3ee
mov r8d, dword [rsp + 0xd4]
mov rdx, qword [rsp + 0xa0]
mov rcx, rax
call fcn.10000c6c8
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10000a3c7
xor ebp, ebp
mov ebx, 0x322
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10000a3de
cmp eax, 6
jne 0x10000a3de
xor ebp, ebp
mov ebx, 0x321
test ebx, ebx
je 0x10000a424
cmp ebx, 0x4c7
je 0x10000a424
test ebp, ebp
jne 0x10000a404
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call fcn.10000d950
mov rcx, rax
call fcn.10000d498
jmp 0x10000a40b
mov ecx, ebx
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000d760
jmp 0x10000a26a
mov ecx, ebx
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x30]
call fcn.10000d760
jmp 0x10000a268
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
call fcn.10000d71c
mov eax, 1
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.100010090
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret