Function at 0x10504a5
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa04
mov eax, dword [0x1099a38]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x95c], eax
push ebx
lea eax, [ebp - 0x94c]
mov dword [ebp - 0x950], eax
push esi
xor esi, esi
mov eax, str.ArchiveHighEncryptTSClient32Files
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x9c0], eax
mov dword [ebp - 0x9b0], eax
push edi
mov eax, str.ArchiveHighEncryptTSClient16Files
mov dword [ebp - 0x9a0], eax
mov dword [ebp - 0x990], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x61c]
xor ecx, ecx
inc ecx
push eax
push esi
mov dword [ebp - 0x94c], esi
mov dword [ebp - 0x9f0], str.ArchiveHighEncryptSystem32Files
mov dword [ebp - 0x9ec], str.SystemRoot_system32
mov dword [ebp - 0x9e8], ecx
mov dword [ebp - 0x9e4], ecx
mov dword [ebp - 0x9e0], str.ArchiveHighEncryptDriverFiles
mov dword [ebp - 0x9dc], str.SystemRoot_system32drivers
mov dword [ebp - 0x9d8], ecx
mov dword [ebp - 0x9d4], ecx
mov dword [ebp - 0x9cc], edx
mov dword [ebp - 0x9c8], esi
mov dword [ebp - 0x9c4], esi
mov dword [ebp - 0x9bc], str.SystemRoot_system32clients_tsclient_netwin32
mov dword [ebp - 0x9b8], esi
mov dword [ebp - 0x9b4], ecx
mov dword [ebp - 0x9ac], str.SystemRoot_system32clients_tsclientwin32disksdisk2
mov dword [ebp - 0x9a8], esi
mov dword [ebp - 0x9a4], esi
mov dword [ebp - 0x99c], str.SystemRoot_system32clients_tsclient_netwin16
mov dword [ebp - 0x998], esi
mov dword [ebp - 0x994], esi
mov dword [ebp - 0x98c], str.SystemRoot_system32clients_tsclientwin16disksdisk1
mov dword [ebp - 0x988], esi
mov dword [ebp - 0x984], esi
mov dword [ebp - 0x980], str.ArchiveHighEncryptTSDLLCacheFiles
mov dword [ebp - 0x97c], str.SystemRoot_system32dllcache
mov dword [ebp - 0x978], esi
mov dword [ebp - 0x974], esi
mov dword [ebp - 0x958], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x61c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
cmp eax, esi
jmp 0x105064a
mov edi, dword [ebp - 0x92c]
inc edi
mov esi, 0x1018ffc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x61c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1050668
mov eax, dword [ebp - 0x92c]
mov byte [eax], 0
lea eax, [ebp - 0x61c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_strrchr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x92c], eax
jne 0x105060f
push 0x1018fc8
call fcn.01071aad
push 0xf02c
jmp 0x1051176
xor eax, eax
mov cl, byte [ebp + eax - 0x61c]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x105066a
mov eax, dword [ebp - 0x92c]
push ebx
mov byte [eax + 1], cl
lea eax, [ebp - 0x20c]
push eax
push 0x1018ffc
push 0x10c64c0
call fcn.01070fc9
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, 0x80
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x10506d6
push 0x1018f90
call fcn.01071aad
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x1018f88
push 0x10c64c0
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018f7c
lea eax, [ebp - 0x61c]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018f6c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0103a535
test eax, eax
jne 0x105074a
push 0x1018f38
call fcn.01071aad
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018f28
lea eax, [ebp - 0x61c]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018f28
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov dword [ebp - 0x934], eax
jne 0x10507ba
push 0x1018ef0
call fcn.01071aad
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp dword [ebp - 0x934], 0
jne 0x105080a
push 0x1018eb8
call fcn.01071aad
push 0xf02d
call fcn.01037f35
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018ffc
push 0x10c64c0
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x105117b
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018ea8
lea eax, [ebp - 0x61c]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018ea8
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x934], eax
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp dword [ebp - 0x934], 0
jne 0x105087f
push 0xf02e
call fcn.01037f35
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018e9c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018e8c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
mov esi, dword [sym.imp.msvcrt.dll_rename]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
pop ecx
pop ecx
mov dword [ebp - 0x944], eax
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018e80
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018e70
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
pop ecx
pop ecx
mov dword [ebp - 0x944], eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x948]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push 0x1009220
push eax
push 0x1018e38
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1050957
push eax
push 0x1018dfc
call fcn.01071ac0
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x93c]
push eax
push 3
push 0
push 0x1018df4
push dword [ebp - 0x948]
mov byte [ebp - 0x93c], 0xfe
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x105098d
push eax
push 0x1018db8
call fcn.01071ac0
pop ecx
pop ecx
push 4
lea eax, [ebp - 0x93c]
push eax
push 3
push 0
push 0x1018dac
push dword [ebp - 0x948]
mov dword [ebp - 0x93c], 0xef
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10509c6
push eax
push 0x1018db8
call fcn.01071ac0
pop ecx
pop ecx
push dword [ebp - 0x948]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x928]
push eax
push 0x1018d9c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x944]
push eax
push 1
lea eax, [ebp - 0x928]
push eax
call fcn.01070db7
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018e8c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018e9c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018e70
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1018e80
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call esi
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018f28
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x108]
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018ea8
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018d94
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018f6c
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call esi
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x1018ffc
push 0x10c64c0
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call esi
cmp dword [ebp - 0x944], 0
jne 0x1050b53
push 0x1018d60
call fcn.01071aad
push 0xf02f
jmp 0x1051176
and dword [ebp - 0x930], 0
lea eax, [ebp - 0xa00]
push eax
mov eax, dword [ebp - 0x930]
push 0
push dword [ebp + eax - 0x9f0]
push dword [ebp - 0x960]
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
jmp 0x105109f
test eax, eax
je 0x105111d
jmp dword [0x10991cc]
add dword [ebp - 0x930], 0x10
cmp dword [ebp - 0x930], edi
jb 0x1050b5a
mov edi, dword [ebp - 0x94c]
jmp 0x1051165
push ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.01070fc9
lea eax, [ebp - 0x108]
push eax
call esi
mov eax, edi
mov edi, dword [edi]
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test edi, edi
jne 0x1051138
cmp dword [ebp - 0x958], edi
jne 0x105117f
push 0xf030
call fcn.01037f35
xor eax, eax
jmp 0x1051182
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x10