Function at 0x140018858
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Move file
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor edi, edi
mov r12, r9
mov esi, r8d
mov rbx, rdx
mov r14, rcx
test rdx, rdx
jne 0x1400188a6
test r9, r9
jne 0x1400188a6
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r14
call fcn.140017488
test eax, eax
jne 0x1400188c4
sub rdi, rbx
neg rdi
sbb eax, eax
and eax, 0x80070002
jmp 0x140018ce7
mov r13d, 2
lea r15d, [r13 + 2]
test rbx, rbx
je 0x140018a62
test esi, esi
je 0x140018969
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov r9d, r13d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140018957
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], r15d
lea rdx, str.AllowProtectedRenames
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x140018969
mov r8d, esi
lea rdx, str.ERROR:_Could_not_set_AllowProtectedRename_flag_for_SFP.__Error:_0x_x_r_n
mov ecx, r13d
call fcn.1400168a8
mov ecx, 0x208
call fcn.14003c460
mov rsi, rax
test rax, rax
jne 0x140018985
mov eax, 0x8007000e
jmp 0x140018ce7
mov r15d, 0x104
mov rdx, rsi
mov r8d, r15d
mov rcx, rbx
call fcn.140016af0
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test r12, r12
je 0x1400189c5
mov r9, rsi
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.140001734
jmp 0x140018a00
mov eax, dword [0x1400516ec]
lea r8, str._ssetb_lu.tmp
mov r9, rsi
mov dword [rsp + 0x20], eax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140001734
inc dword [0x1400516ec]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018a00
test al, 0x10
je 0x1400189c5
mov rcx, rsi
call fcn.14003c408
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140018a78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r9, [rsp + 0x40]
test eax, eax
lea rdx, str.ERROR:_ReplaceFileOnReboot:_Could_not_move_file__S_to__S.__Error_0x_x._r_n
mov r8, r14
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call fcn.1400168a8
mov eax, 0x80004005
jmp 0x140018ce7
mov r15d, 0x104
lea rcx, [rsp + 0x40]
mov edx, r15d
mov r8, r14
call fcn.140001470
mov ecx, 0x208
call fcn.14003c460
mov r14, rax
mov esi, 0x80004005
test rax, rax
je 0x140018c06
mov rdx, rax
mov ecx, r15d
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140018be7
mov rcx, r14
call fcn.1400174b4
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, edi
mov dword [0x1400516ec], eax
test r12, r12
je 0x140018b3a
mov r9, r14
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov rdx, r15
lea rcx, [rbp + 0x150]
call fcn.140001734
lea rdx, [rbp + 0x150]
test rbx, rbx
je 0x140018b83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140018be7
mov rcx, rbx
call fcn.140017488
test eax, eax
je 0x140018b27
mov r8, rbx
lea rdx, str.ERROR:_Replace_file_in_place_failed_for__S.__File_still_exists._r_n
mov ecx, 1
call fcn.1400168a8
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r13d, eax
jmp 0x140018bae
mov r9, r14
mov dword [rsp + 0x20], eax
lea r8, str._ssetb_lu.tmp
mov rdx, r15
lea rcx, [rbp + 0x150]
call fcn.140001734
inc dword [0x1400516ec]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018ae6
test al, 0x10
jne 0x140018ae6
mov eax, dword [0x1400516ec]
jmp 0x140018b3a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140018be7
lea r8, [rsp + 0x40]
mov ecx, 4
lea rdx, str.__Moved_file__S_to_temp_location_for_clean_up_upon_reboot._r_n
call fcn.1400168a8
mov r13d, 1
lea rcx, [rbp + 0x150]
call fcn.140019450
mov esi, eax
cmp eax, 0xd2af9
jne 0x140018be7
or dword [0x140050558], 2
lea r8, [rbp + 0x150]
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
mov ecx, 2
mov esi, 0xd2af8
call fcn.1400168a8
mov rcx, r14
call fcn.14003c408
test r13d, r13d
je 0x140018bfb
mov eax, esi
jmp 0x140018ce7
mov esi, 0x80004005
mov r13d, 2
mov r8d, 5
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140018cab
test rbx, rbx
je 0x140018c53
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140018c2b
test rax, rax
je 0x140018c53
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x140018c53
mov r8, rbx
lea rdx, str.ERROR:_Bad_file_destination__S._r_n
mov ecx, r13d
call fcn.1400168a8
lea r8, [rsp + 0x40]
mov ecx, r13d
lea rdx, str.WARNING:_Reboot_required_due_to_file__S._r_n
call fcn.1400168a8
lea r8, [rsp + 0x40]
mov ecx, r13d
cmp dword [rbp + 0x3d0], edi
je 0x140018c91
or dword [0x140050558], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
call fcn.1400168a8
mov eax, 0xd2af9
jmp 0x140018ce7
or dword [0x140050558], r13d
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
call fcn.1400168a8
mov eax, 0xd2af8
jmp 0x140018ce7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r8, [rsp + 0x40]
test eax, eax
lea rdx, str.ERROR:_MoveFileEx_failed_for_file__S.__Error:_0x_x._r_n
cmove eax, ecx
mov ecx, r13d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov r9d, ebx
call fcn.1400168a8
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret