Function at 0x14001d558
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r12, qword [rbp + 0x3f0]
xor ebx, ebx
mov edi, r9d
mov r14, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14001d5ab
mov eax, 0x80004003
jmp 0x14001ddfd
test r14, r14
jne 0x14001d5c1
test r12, r12
jne 0x14001d5c1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, rsi
call fcn.14001ab20
test eax, eax
jne 0x14001d5df
sub rbx, r14
neg rbx
sbb eax, eax
and eax, 0x80070002
jmp 0x14001ddfd
test r14, r14
je 0x14001d71d
test edi, edi
je 0x14001d600
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
call fcn.14001e438
mov ecx, 0x208
call fcn.1400014a0
mov rdi, rax
test rax, rax
jne 0x14001d61c
mov eax, 0x8007000e
jmp 0x14001ddfd
mov r15d, 0x104
mov rdx, rdi
mov r8d, r15d
mov rcx, r14
call fcn.14001e1b0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
test r12, r12
je 0x14001d664
mov r9, rdi
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov edx, r15d
lea rcx, [rbp + 0x180]
call fcn.140010e44
jmp 0x14001d6a9
mov eax, dword [0x14005a75c]
lea r8, str._ssetb_lu.tmp
mov r9, rdi
mov dword [rsp + 0x20], eax
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140010e44
inc dword [0x14005a75c]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001d6a9
test al, 0x10
je 0x14001d664
mov rcx, rdi
call fcn.140001454
mov r8d, 1
lea rdx, [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14001d767
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001d6ec
lea edi, [rax + 0x57]
jmp 0x14001d6ee
jle 0x14001d6f7
movzx edi, di
or edi, 0x80070000
lea r9, [rbp + 0x180]
mov dword [rsp + 0x20], edi
mov r8, rsi
lea rdx, str.ERROR:_ReplaceFileOnReboot:_Could_not_move_file__S_to__S.__Error_0x_x._r_n
xor ecx, ecx
call fcn.140019b1c
mov eax, 0x80004005
jmp 0x14001ddfd
mov r15d, 0x104
lea rax, [rbp + 0x180]
mov edx, r15d
lea rcx, [rbp + 0x180]
sub rsi, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001d759
movzx eax, word [rsi + rcx]
test ax, ax
je 0x14001d759
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001d737
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
mov ecx, 0x208
call fcn.1400014a0
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], rax
mov esi, 0x80004005
test rax, rax
je 0x14001d88d
mov rdx, rax
mov dword [rsp + 0x58], ebx
mov ecx, r15d
mov edi, esi
call qword [sym.imp.KERNEL32.dll_GetTempPath2W]
nop dword [rax + rax]
test eax, eax
je 0x14001d875
mov rsi, qword [rsp + 0x60]
mov rcx, rsi
call fcn.14001a31c
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
mov dword [0x14005a75c], ebx
mov eax, ebx
test r12, r12
je 0x14001d92f
mov r9, rsi
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140010e44
lea rdx, [rsp + 0x70]
test r14, r14
je 0x14001dbc3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14001dd98
mov rcx, r14
call fcn.14001ab20
test eax, eax
je 0x14001d836
mov r8, r14
lea rdx, str.ERROR:_Replace_file_in_place_failed_for__S.__File_still_exists._r_n
mov ecx, 1
call fcn.140019b1c
mov rdx, r14
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
mov ecx, 0x28
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], eax
call fcn.1400014a0
mov rsi, rax
test rax, rax
jne 0x14001d97a
mov edi, 0x8007000e
mov esi, 0x80004005
mov rcx, qword [rsp + 0x60]
call fcn.140001454
cmp dword [rsp + 0x58], ebx
jne 0x14001ddfb
or rdi, 0xffffffffffffffff
mov r8d, 5
lea rcx, [rbp + 0x180]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
je 0x14001ddb9
test r14, r14
je 0x14001d8e2
inc rdi
cmp word [r14 + rdi*2], bx
jne 0x14001d8b6
test rdi, rdi
je 0x14001d8e2
cmp word [r14 + rdi*2 - 2], 0x5c
jne 0x14001d8e2
mov r8, r14
lea rdx, str.ERROR:_Bad_file_destination__S._r_n
mov ecx, 2
call fcn.140019b1c
lea r8, [rbp + 0x180]
mov ecx, 2
lea rdx, str.WARNING:_Reboot_required_due_to_file__S._r_n
call fcn.140019b1c
lea r8, [rbp + 0x180]
mov ecx, 2
cmp dword [rbp + 0x3f8], ebx
je 0x14001dd9f
or dword [0x140059568], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
call fcn.140019b1c
mov eax, 0xd2af9
jmp 0x14001ddfd
mov r9, rsi
mov dword [rsp + 0x20], eax
lea r8, str._ssetb_lu.tmp
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140010e44
inc dword [0x14005a75c]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001d7f1
test al, 0x10
jne 0x14001d7f1
mov eax, dword [0x14005a75c]
jmp 0x14001d92f
lea rax, [rsp + 0x50]
mov r12, 0xffffffff80000001
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001da3c
mov ecx, 0x208
call fcn.1400014a0
mov rdi, rax
test rax, rax
je 0x14001da2b
mov edx, r15d
mov rcx, rax
call fcn.14001c7ec
test eax, eax
je 0x14001da23
lea r8, str.__Fixups
mov rdx, r15
mov rcx, rdi
call fcn.140010d0c
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bx
jne 0x14001d9e9
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.140001454
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001db62
mov r9d, dword [0x14005a758]
lea edi, [rax + 0x14]
jmp 0x14001daa8
mov r9d, dword [0x14005a758]
cmp r9d, 0x3e8
jge 0x14001dae2
inc r9d
mov dword [0x14005a758], r9d
lea r8, [0x14004b360]
mov rdx, rdi
mov rcx, rsi
call fcn.140010e44
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14001da8e
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14001daeb
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 2
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001db32
inc dword [0x14005a758]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x14001db64
lea r8, [rsp + 0x70]
lea rdx, str.File_replacement_for__S_queued_in_non_admin_file_cache._r_n
lea ecx, [rdi + 4]
call fcn.140019b1c
mov edi, 0xd2af9
jmp 0x14001db88
test edi, edi
jle 0x14001db6f
movzx edi, di
or edi, 0x80070000
mov r9d, edi
lea r8, [rsp + 0x70]
lea rdx, str.ERROR:_Could_not_store_delayed_file_move_for__S:_0x_x._r_n
mov ecx, 2
call fcn.140019b1c
mov rcx, rsi
call fcn.140001454
cmp edi, 0xd2af9
jne 0x14001d870
or dword [0x140059568], 2
lea r8, [rsp + 0x70]
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
mov ecx, 2
mov edi, 0xd2af8
call fcn.140019b1c
jmp 0x14001d870
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14001dd98
lea r8, [rbp + 0x180]
mov ecx, 4
lea rdx, str.__Moved_file__S_to_temp_location_for_clean_up_upon_reboot._r_n
call fcn.140019b1c
mov ecx, 0x28
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x50], rbx
call fcn.1400014a0
mov rsi, rax
test rax, rax
je 0x14001d86b
lea rax, [rsp + 0x50]
mov r12, 0xffffffff80000001
mov rcx, r12
mov qword [rsp + 0x20], rax
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001dcdb
mov ecx, 0x208
call fcn.1400014a0
mov rdi, rax
test rax, rax
je 0x14001dcca
mov edx, r15d
mov rcx, rax
call fcn.14001c7ec
test eax, eax
je 0x14001dcc2
lea r8, str.__Fixups
mov rdx, r15
mov rcx, rdi
call fcn.140010d0c
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], bx
jne 0x14001dc88
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.140001454
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001db62
mov r9d, dword [0x14005a758]
lea edi, [rax + 0x14]
jmp 0x14001dd47
mov r9d, dword [0x14005a758]
cmp r9d, 0x3e8
jge 0x14001dd81
inc r9d
mov dword [0x14005a758], r9d
lea r8, [0x14004b360]
mov rdx, rdi
mov rcx, rsi
call fcn.140010e44
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14001dd2d
lea rcx, [rsp + 0x70]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14001dd8a
jmp 0x14001daf4
mov esi, edi
jmp 0x14001d875
or dword [0x140059568], 2
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
call fcn.140019b1c
mov eax, 0xd2af8
jmp 0x14001ddfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001ddd0
lea edi, [rax + 0x57]
jmp 0x14001ddd2
jle 0x14001dddb
movzx edi, di
or edi, 0x80070000
test edi, edi
lea r8, [rbp + 0x180]
lea rdx, str.ERROR:_MoveFileEx_failed_for_file__S.__Error:_0x_x._r_n
mov ecx, 2
cmovns edi, esi
mov r9d, edi
call fcn.140019b1c
mov eax, edi
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret