Function at 0x180038d20
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xae0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xb18], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, r8
mov r12, rcx
call fcn.18001c0c0
lea rcx, [rax + 1]
call fcn.18001c020
test rbx, rbx
je 0x180039097
xor esi, esi
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov edx, 0x80058000
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmovs rcx, rsi
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x180039084
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov ebp, eax
cmp dword [0x180108d44], esi
je 0x180039018
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, str.EnableFileBackup
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180039018
cmp dword [rsp + 0x40], 4
jne 0x180039018
cmp dword [rsp + 0x38], eax
je 0x180039018
lea rcx, str.BackupOnDelete
call fcn.180003e10
test al, al
je 0x180039018
test ebp, ebp
je 0x180038fec
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x180039018
lea r13, [0x180039350]
test r13, r13
je 0x180039018
movzx eax, word [rbx + 2]
cmp ax, 0x3a
je 0x180038ea2
cmp ax, 0x5c
je 0x180038ea2
mov word [rsp + 0x6c0], si
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x6c2]
call fcn.18009e990
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, rbx
lea rcx, [rsp + 0x6c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, [rsp + 0x6c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180039018
test al, 0x10
je 0x180039018
mov rdx, rbx
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1800d1804]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180039018
lea rdx, [0x1800d34d8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180038fcb
lea rdx, [0x1800d1a48]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180038fcb
cmp dword [rsp + 0x50], 0xffffffff
je 0x180038fcb
mov rdx, rbx
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x180038f94
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r13
lea edx, [r9 + 1]
lea rcx, [rsp + 0x2a0]
call fcn.18004fd0c
cmp eax, 2
je 0x180038fe1
jmp 0x180038fcb
mov r8b, 1
lea rdx, [0x1800d1a98]
lea rcx, [rsp + 0x2a0]
call fcn.180036520
test eax, eax
je 0x180038fcb
cmp eax, 3
je 0x180038fcb
mov r8d, eax
lea rdx, [rsp + 0x2a0]
lea rcx, str.backup_on_delete_failed:__s__d
call fcn.18005c5d0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180038f02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x180039018
mov r8b, 1
lea rdx, [0x1800d1a98]
mov rcx, qword [rsp + 0x30]
call fcn.180036520
test eax, eax
je 0x180039018
mov r8d, eax
mov rdx, qword [rsp + 0x30]
lea rcx, str.backup_on_delete_failed:__s__d
call fcn.18005c5d0
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov ecx, sendto
call fcn.18009a960
mov rbx, rax
test rax, rax
je 0x180039057
test ebp, ebp
jne 0x18003904f
mov rcx, qword [rsp + 0x30]
call fcn.1800504b4
mov rsi, rax
mov dword [rbx], ebp
mov qword [rbx + 8], rsi
jmp 0x18003905a
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
lea rcx, [r12 + 0x38]
lea rdx, [rsp + 0x38]
call fcn.18003b730
mov qword [rax], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180039093
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
jmp 0x180039099
xor eax, eax
jmp 0x180039099
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0xb18]
add rsp, 0xae0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret