Function at 0x10004115c
Capabilities:
Copy file
Delete file
Get common file path
Get file attributes
Move file
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
mov r13d, r9d
mov dword [rsp + 0x40], r9d
mov edi, r8d
mov rsi, rdx
mov r12, rcx
cmp rdx, rbx
jne 0x1000411a3
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r12
call fcn.1000400f0
cmp eax, ebx
jne 0x1000411c1
sub rbx, rsi
neg rbx
sbb eax, eax
and eax, 0x80070002
jmp 0x10004166d
mov r14d, 4
mov r15d, 0x208
lea ebp, [r14 - 2]
cmp rsi, rbx
je 0x1000413a1
cmp edi, ebx
je 0x100041275
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x1000411f5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rax, [rsp + 0x38]
lea rdx, [0x1000234c0]
mov r9d, ebp
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, ebx
jne 0x100041264
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x100023528]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x100041275
lea rdx, [0x100023560]
mov r8d, edi
mov ecx, ebp
call fcn.10004575c
mov rcx, r15
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rdi, rax
cmp rax, rbx
jne 0x10004128f
mov eax, 0x8007000e
jmp 0x10004166d
mov r14d, 0x104
cmp rax, rsi
je 0x1000412d3
mov r8, rsi
mov rdx, r14
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x1000412c8
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x1000412c8
mov word [rcx], ax
add rcx, rbp
sub rdx, 1
jne 0x1000412a6
cmp rdx, rbx
jne 0x1000412d0
sub rcx, rbp
mov word [rcx], bx
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rbx
je 0x1000412ec
mov word [rax + 2], bx
jmp 0x1000412ef
mov word [rdi], bx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [0x10004d40c]
lea r8, [0x1000235a8]
lea rcx, [rsp + 0x50]
mov r9, rdi
mov rdx, r14
mov dword [rsp + 0x20], eax
call fcn.10002e570
inc dword [0x10004d40c]
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x100041335
lea rcx, [rsp + 0x50]
call fcn.1000400f0
jmp 0x100041337
mov eax, ebx
cmp eax, ebx
jne 0x1000412f8
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
lea rdx, [rsp + 0x50]
mov r8d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, ebx
jne 0x1000413e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r9, [rsp + 0x50]
cmp eax, ebx
lea rdx, [0x1000235d0]
mov r8, r12
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call fcn.10004575c
mov eax, 0x80004005
jmp 0x10004166d
lea rax, [rsp + 0x50]
mov r14d, 0x104
lea rcx, [rsp + 0x50]
sub r12, rax
mov rdx, r14
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x1000413d9
movzx eax, word [r12 + rcx]
cmp ax, bx
je 0x1000413d9
mov word [rcx], ax
add rcx, rbp
sub rdx, 1
jne 0x1000413b7
cmp rdx, rbx
jne 0x1000413e1
sub rcx, rbp
mov word [rcx], bx
mov rcx, r15
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r15d, 0x80004005
mov r12, rax
cmp rax, rbx
je 0x100041568
mov rdx, rax
mov ecx, r14d
mov edi, r15d
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
je 0x100041552
mov rcx, r12
call fcn.100040118
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r11d, ebx
mov dword [0x10004d40c], ebx
lea r8, [0x1000235a8]
lea rcx, [rsp + 0x260]
mov r9, r12
mov rdx, r14
mov dword [rsp + 0x20], r11d
call fcn.10002e570
mov r11d, dword [0x10004d40c]
lea rax, [rsp + 0x260]
inc r11d
mov dword [0x10004d40c], r11d
cmp rax, rbx
je 0x100041485
lea rcx, [rsp + 0x260]
call fcn.1000400f0
mov r11d, dword [0x10004d40c]
jmp 0x100041487
mov eax, ebx
cmp eax, ebx
jne 0x100041432
lea rdx, [rsp + 0x260]
cmp rsi, rbx
je 0x1000414dc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
je 0x100041552
mov rcx, rsi
call fcn.1000400f0
cmp eax, ebx
je 0x1000414c9
lea rdx, [0x100023620]
mov r8, rsi
mov ecx, 1
call fcn.10004575c
lea rcx, [rsp + 0x50]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r13d, eax
jmp 0x100041507
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
je 0x100041552
lea r8, [rsp + 0x50]
lea rdx, [0x100023668]
mov ecx, 4
call fcn.10004575c
mov r13d, 1
lea rax, [rsp + 0x260]
cmp rax, rbx
jne 0x10004151b
mov edi, 0x80004003
jmp 0x100041552
lea rcx, [rsp + 0x260]
call fcn.100041cd4
mov edi, eax
cmp eax, 0xd2af9
jne 0x100041552
or dword [0x10004bd88], ebp
lea r8, [rsp + 0x260]
lea rdx, [0x100023350]
mov ecx, ebp
mov edi, 0xd2af8
call fcn.10004575c
mov rcx, r12
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
cmp r13d, ebx
jne 0x10004166b
mov r13d, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov r8d, 5
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp eax, ebx
je 0x100041631
cmp rsi, rbx
je 0x1000415be
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
je 0x1000415be
lea edx, [rax + 0x5c]
cmp word [rsi + rcx*2 - 2], dx
sete al
cmp eax, ebx
je 0x1000415be
lea rdx, [0x1000236a8]
mov r8, rsi
mov ecx, ebp
call fcn.10004575c
lea r8, [rsp + 0x50]
lea rdx, [0x1000236d0]
mov ecx, ebp
call fcn.10004575c
lea rcx, [0x100023340]
lea r8, [rsp + 0x50]
cmp r13d, ebx
je 0x10004160a
or dword [0x10004bd88], 8
lea rdx, [rsp + 0x50]
cmp rdx, rbx
lea rdx, [0x100023380]
cmove r8, rcx
mov ecx, ebp
call fcn.10004575c
mov eax, 0xd2af9
jmp 0x10004166d
or dword [0x10004bd88], ebp
lea rax, [rsp + 0x50]
lea rdx, [0x100023350]
cmp rax, rbx
cmove r8, rcx
mov ecx, ebp
call fcn.10004575c
mov eax, 0xd2af8
jmp 0x10004166d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r8, [rsp + 0x50]
cmp eax, ebx
lea rdx, [0x100023700]
cmove eax, ecx
mov ecx, ebp
movzx edi, ax
or edi, 0x80070000
cmp eax, ebx
cmovle edi, eax
cmp edi, ebx
cmovge edi, r15d
mov r9d, edi
call fcn.10004575c
mov eax, edi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret