Function at 0x406a10
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov r11, rsp
sub rsp, 0xcd8
mov rax, qword [0x0042a560]
xor rax, rsp
mov qword [rsp + 0xc90], rax
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov r12, rcx
mov qword [r11 - 0x38], r14
mov rbp, r8
mov r14, rdx
lea rcx, [r11 - 0xa96]
xor edx, edx
mov r8d, 0x206
mov r13d, r9d
mov word [rsp + 0x240], 0
call fcn.0040e3f0
lea rcx, [rsp + 0x452]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x450], 0
call fcn.0040e3f0
lea rcx, [rsp + 0x872]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x870], 0
call fcn.0040e3f0
lea rcx, [rsp + 0x662]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x660], 0
call fcn.0040e3f0
lea rcx, [rsp + 0xa82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0xa80], 0
call fcn.0040e3f0
lea rcx, [rsp + 0x870]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov rsi, 0xffffffffffffffff
lea rdi, [rsp + 0x240]
mov rcx, rsi
lea rdx, [rsp + 0x870]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rdx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x406b20
xor eax, eax
lea rdi, [rsp + 0x240]
mov rcx, rsi
repne scasw ax, word [rdi]
mov eax, dword [0x004219d4]
mov qword [rsp + 0xcd0], rbx
xor ebx, ebx
mov dword [rdi - 2], eax
mov rcx, rbx
nop
nop
movzx eax, word [rsp + rcx + 0x240]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x65e], ax
jne 0x406b60
xor eax, eax
lea rdi, [rsp + 0x240]
mov rcx, rsi
repne scasw ax, word [rdi]
xor ecx, ecx
nop
nop
movzx eax, word [rcx + rbp]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x406b90
xor eax, eax
lea rdi, [rsp + 0x240]
mov rcx, rsi
repne scasw ax, word [rdi]
mov rax, qword [str..ime]
mov rcx, r12
mov qword [rdi - 2], rax
movzx eax, word [0x00421dd8]
mov word [rdi + 6], ax
call fcn.00407060
test eax, eax
je 0x406e98
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.004070d0
lea rdx, [rsp + 0x450]
mov r8d, 0x104
mov rcx, r12
call fcn.004070a0
xor eax, eax
lea rdi, [rsp + 0x450]
mov rcx, rsi
repne scasw ax, word [rdi]
mov eax, dword [0x004219d4]
mov rcx, rsi
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x450]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, word [rcx + rbp]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x406c30
xor eax, eax
lea rdi, [rsp + 0x450]
mov rcx, rsi
repne scasw ax, word [rdi]
test r13d, r13d
mov rax, qword [str..ime]
mov qword [rdi - 2], rax
movzx eax, word [0x00421dd8]
mov word [rdi + 6], ax
je 0x406cda
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.0040e3f0
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x660]
lea rdx, str._sregsvr32.exe__s__u__s
lea rcx, [rsp + 0x30]
call fcn.0040e620
lea rcx, [rsp + 0x30]
call fcn.0040df90
lea r9, [rsp + 0x450]
lea r8, [rsp + 0xa80]
lea rdx, str._sregsvr32.exe__s__u__s
lea rcx, [rsp + 0x30]
call fcn.0040e620
lea rcx, [rsp + 0x30]
call fcn.0040df90
lea rcx, [rsp + 0x450]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406da6
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.0040e3f0
lea rcx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406da6
mov edi, ebx
nop
test edi, edi
jne 0x406d3f
lea r8, [rsp + 0x450]
lea rdx, str._s.del
lea rcx, [rsp + 0x30]
call fcn.0040e620
jmp 0x406d5b
lea r8, [rsp + 0x450]
lea rdx, str._s.del_d
lea rcx, [rsp + 0x30]
mov r9d, edi
call fcn.0040e620
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406d83
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406d83
cmp edi, 0xa
jg 0x406da6
add edi, 1
jmp 0x406d20
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x450]
call fcn.0040fc20
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406e7b
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.0040e3f0
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406e76
mov edi, ebx
nop
nop
test edi, edi
jne 0x406e0f
lea r8, [rsp + 0x240]
lea rdx, str._s.del
lea rcx, [rsp + 0x30]
call fcn.0040e620
jmp 0x406e2b
lea r8, [rsp + 0x240]
lea rdx, str._s.del_d
lea rcx, [rsp + 0x30]
mov r9d, edi
call fcn.0040e620
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406e53
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406e53
cmp edi, 0xa
jg 0x406e76
add edi, 1
jmp 0x406df0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.0040fc20
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, 2
mov rdx, qword [rsp + 0x20]
mov rcx, r12
call fcn.00407100
cmp esi, 0xfffffffe
jne 0x406faa
xor eax, eax
jmp 0x406fdf
test r13d, r13d
je 0x406edf
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.0040e3f0
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x660]
lea rdx, str._sregsvr32.exe__s__u__s
lea rcx, [rsp + 0x30]
call fcn.0040e620
lea rcx, [rsp + 0x30]
call fcn.0040df90
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406faa
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bx
call fcn.0040e3f0
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406faa
mov edi, ebx
test edi, edi
jne 0x406f43
lea r8, [rsp + 0x240]
lea rdx, str._s.del
lea rcx, [rsp + 0x30]
call fcn.0040e620
jmp 0x406f5f
lea r8, [rsp + 0x240]
lea rdx, str._s.del_d
lea rcx, [rsp + 0x30]
mov r9d, edi
call fcn.0040e620
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406f87
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x406f87
cmp edi, 0xa
jg 0x406faa
add edi, 1
jmp 0x406f24
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call fcn.0040fc20
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test r13d, r13d
je 0x406fd1
lea rcx, str.0804:1CB3BC1A_2FD4_4668_B5C5_646329DD489F1E552381_07D8_4DB8_B086_65EF69BC9965
nop
nop
nop
movzx eax, word [rbx + rcx]
add rbx, 2
test ax, ax
jne 0x406fc0
xor eax, eax
jmp 0x406fdf
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.004068c0
mov r14, qword [rsp + 0xca0]
mov r13, qword [rsp + 0xca8]
mov r12, qword [rsp + 0xcb0]
mov rdi, qword [rsp + 0xcb8]
mov rsi, qword [rsp + 0xcc0]
mov rbp, qword [rsp + 0xcc8]
mov rbx, qword [rsp + 0xcd0]
mov rcx, qword [rsp + 0xc90]
xor rcx, rsp
call fcn.0040e5d0
add rsp, 0xcd8
ret