Function at 0x14001c760
Capabilities:
Copy file
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov r12, qword [rbp + 0x400]
xor ebx, ebx
mov esi, r9d
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14001c7b1
mov eax, 0x80004003
jmp 0x14001cf32
test r14, r14
jne 0x14001c7c7
test r12, r12
jne 0x14001c7c7
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.140019eb0
test eax, eax
jne 0x14001c7e5
sub rbx, r14
neg rbx
sbb eax, eax
and eax, 0x80070002
jmp 0x14001cf32
mov r13d, 0x208
test r14, r14
je 0x14001c8fd
test esi, esi
je 0x14001c80c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
call fcn.14001d750
mov rcx, r13
call fcn.14000130c
mov r15, rax
test rax, rax
jne 0x14001c826
mov eax, 0x8007000e
jmp 0x14001cf32
mov esi, 0x104
mov rdx, r15
mov r8d, esi
mov rcx, r14
call fcn.14001d2d0
mov rcx, r15
call fcn.14001937c
test r12, r12
je 0x14001c865
mov r9, r15
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov edx, esi
lea rcx, [rbp + 0x180]
call fcn.1400104f4
jmp 0x14001c89e
mov eax, dword [0x140053824]
lea r8, str._ssetb_lu.tmp
mov r9, r15
mov dword [rsp + 0x20], eax
mov rdx, rsi
lea rcx, [rbp + 0x180]
call fcn.1400104f4
inc dword [0x140053824]
lea rcx, [rbp + 0x180]
call fcn.140019eb0
test eax, eax
jne 0x14001c865
mov rcx, r15
call fcn.1400012c0
mov r8d, 1
lea rdx, [rbp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14001c913
call fcn.140015998
test eax, eax
jle 0x14001c8d7
movzx eax, ax
or eax, 0x80070000
lea r9, [rbp + 0x180]
mov dword [rsp + 0x20], eax
mov r8, rdi
lea rdx, str.ERROR:_ReplaceFileOnReboot:_Could_not_move_file__S_to__S.__Error_0x_x._r_n
xor ecx, ecx
call fcn.140018ed8
mov eax, 0x80004005
jmp 0x14001cf32
mov esi, 0x104
lea rcx, [rbp + 0x180]
mov edx, esi
mov r8, rdi
call fcn.1400104bc
mov rcx, r13
call fcn.14000130c
mov qword [rsp + 0x60], rax
mov r15, rax
mov r13d, 0x80004005
test rax, rax
je 0x14001ce6d
mov rdx, rax
mov dword [rsp + 0x58], ebx
mov ecx, esi
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_GetTempPath2W]
nop dword [rax + rax]
test eax, eax
je 0x14001ce5b
mov rcx, r15
call fcn.1400196fc
mov rcx, r15
call fcn.14001937c
mov dword [0x140053824], ebx
mov eax, ebx
test r12, r12
je 0x14001cb1f
mov r9, r15
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1400104f4
lea rdx, [rsp + 0x70]
test r14, r14
je 0x14001cbc2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14001ce5b
mov rcx, r14
call fcn.140019eb0
test eax, eax
je 0x14001c9d4
mov r8, r14
lea rdx, str.ERROR:_Replace_file_in_place_failed_for__S.__File_still_exists._r_n
mov ecx, 1
call fcn.140018ed8
mov rdx, r14
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
mov ecx, 0x28
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], eax
call fcn.14000130c
mov r12, rax
test rax, rax
je 0x14001cc14
lea rax, [rsp + 0x50]
mov r13, 0xffffffff80000001
mov rcx, r13
mov qword [rsp + 0x20], rax
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
test eax, eax
jne 0x14001cacd
mov ecx, 0x208
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x14001cabc
mov edx, esi
mov rcx, rax
call fcn.14001b968
test eax, eax
je 0x14001cab4
lea r8, str.__Fixups
mov rdx, rsi
mov rcx, rdi
call fcn.140010470
mov rax, r15
inc rax
cmp word [rdi + rax*2], bx
jne 0x14001ca7a
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.1400012c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001ce06
mov r9d, dword [0x140053820]
lea edi, [rax + 0x14]
jmp 0x14001cb74
mov r9, r15
mov dword [rsp + 0x20], eax
lea r8, str._ssetb_lu.tmp
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.1400104f4
inc dword [0x140053824]
lea rcx, [rsp + 0x70]
call fcn.140019eb0
test eax, eax
je 0x14001c98f
mov eax, dword [0x140053824]
jmp 0x14001cb1f
mov r9d, dword [0x140053820]
cmp r9d, 0x3e8
jge 0x14001cbae
inc r9d
mov dword [0x140053820], r9d
lea r8, [0x140043750]
mov rdx, rdi
mov rcx, r12
call fcn.1400104f4
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov rdx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14001cb5a
lea rax, [rsp + 0x70]
inc r15
cmp word [rax + r15*2], bx
jne 0x14001cbb3
jmp 0x14001cd97
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax + rax]
test eax, eax
je 0x14001ce5b
lea r8, [rbp + 0x180]
mov ecx, 4
lea rdx, str.__Moved_file__S_to_temp_location_for_clean_up_upon_reboot._r_n
call fcn.140018ed8
mov ecx, 0x28
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x50], rbx
call fcn.14000130c
mov r12, rax
test rax, rax
jne 0x14001cc1e
mov edi, 0x8007000e
jmp 0x14001ce5b
lea rax, [rsp + 0x50]
mov r13, 0xffffffff80000001
mov rcx, r13
mov qword [rsp + 0x20], rax
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
or r15, 0xffffffffffffffff
test eax, eax
jne 0x14001cce2
mov ecx, 0x208
call fcn.14000130c
mov rdi, rax
test rax, rax
je 0x14001ccd1
mov edx, esi
mov rcx, rax
call fcn.14001b968
test eax, eax
je 0x14001ccc9
lea r8, str.__Fixups
mov rdx, rsi
mov rcx, rdi
call fcn.140010470
mov rax, r15
inc rax
cmp word [rdi + rax*2], bx
jne 0x14001cc8f
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.MPlayer2_FixUp
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
call fcn.1400012c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetupFileMoveCacheSource
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 3
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001ce06
mov r9d, dword [0x140053820]
lea edi, [rax + 0x14]
jmp 0x14001cd4e
mov r9d, dword [0x140053820]
cmp r9d, 0x3e8
jge 0x14001cd88
inc r9d
mov dword [0x140053820], r9d
lea r8, [0x140043750]
mov rdx, rdi
mov rcx, r12
call fcn.1400104f4
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov rdx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14001cd34
lea rax, [rsp + 0x70]
inc r15
cmp word [rax + r15*2], bx
jne 0x14001cd8d
mov rcx, qword [rsp + 0x50]
lea eax, [r15*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 2
lea rax, [rsp + 0x70]
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x14001cdd6
inc dword [0x140053820]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jne 0x14001ce08
lea r8, [rsp + 0x70]
lea rdx, str.File_replacement_for__S_queued_in_non_admin_file_cache._r_n
lea ecx, [rdi + 4]
call fcn.140018ed8
mov edi, 0xd2af9
jmp 0x14001ce2c
test edi, edi
jle 0x14001ce13
movzx edi, di
or edi, 0x80070000
mov r9d, edi
lea r8, [rsp + 0x70]
lea rdx, str.ERROR:_Could_not_store_delayed_file_move_for__S:_0x_x._r_n
mov ecx, 2
call fcn.140018ed8
mov rcx, r12
call fcn.1400012c0
cmp edi, 0xd2af9
jne 0x14001ce50
lea r8, [rsp + 0x70]
mov edx, 2
mov edi, 0xd2af8
call fcn.14001d60c
mov r15, qword [rsp + 0x60]
mov r13d, 0x80004005
mov rcx, r15
call fcn.1400012c0
cmp dword [rsp + 0x58], ebx
jne 0x14001cf30
mov r8d, 5
lea rcx, [rbp + 0x180]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
je 0x14001cefb
test r14, r14
je 0x14001ceb2
mov rcx, r14
call fcn.140019ee4
test eax, eax
je 0x14001ceb2
mov r8, r14
lea rdx, str.ERROR:_Bad_file_destination__S._r_n
mov ecx, 2
call fcn.140018ed8
lea r8, [rbp + 0x180]
mov ecx, 2
lea rdx, str.WARNING:_Reboot_required_due_to_file__S._r_n
call fcn.140018ed8
lea r8, [rbp + 0x180]
cmp dword [rbp + 0x408], ebx
je 0x14001ceea
mov edx, 8
call fcn.14001d60c
mov eax, 0xd2af9
jmp 0x14001cf32
mov edx, 2
call fcn.14001d60c
mov eax, 0xd2af8
jmp 0x14001cf32
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x14001cf0f
movzx edi, ax
or edi, 0x80070000
test edi, edi
lea r8, [rbp + 0x180]
lea rdx, str.ERROR:_MoveFileEx_failed_for_file__S.__Error:_0x_x._r_n
mov ecx, 2
cmovns edi, r13d
mov r9d, edi
call fcn.140018ed8
mov eax, edi
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret