Function at 0x10000432c
Capabilities:
Copy file
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0xe0
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0xd0], rax
and qword [rsp + 0x30], 0
and dword [rsp + 0x38], 0
mov rbx, rdx
mov edi, ecx
test ecx, ecx
je 0x1000045db
test rdx, rdx
je 0x1000045db
lea rdx, [rsp + 0x40]
mov ecx, 4
call fcn.100002294
lea r11, [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [0x100001bb8]
mov rdx, rbx
mov ecx, edi
mov qword [rsp + 0x20], r11
call fcn.100004b54
test eax, eax
jne 0x1000043c2
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x60]
call fcn.10000d760
mov edi, 1
jmp 0x100004403
mov edi, 1
cmp dword [rsp + 0x38], edi
jne 0x1000043d9
lea ecx, [rdi + 3]
call fcn.100002d78
xor edi, edi
jmp 0x100004403
lea rcx, [rsp + 0x40]
call fcn.100002f40
test eax, eax
jne 0x100004414
or ecx, 0xffffffff
call fcn.100002fe8
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000d760
lea rcx, [rsp + 0x40]
call fcn.10000230c
mov eax, edi
jmp 0x1000045fa
mov r9d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
bts r9d, 0x11
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1000045ae
mov rcx, qword [rsp + 0x80]
lea r8d, [rax + 2]
lea rdx, [0x100001bc8]
call fcn.100004f70
mov ebx, eax
test eax, eax
jne 0x100004598
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 4]
mov rdx, rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov ebx, eax
cmp eax, 0x57
jne 0x1000044ad
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov ebx, eax
mov r15d, 0xce
cmp ebx, 0xb7
jne 0x100004591
lea edx, [rbx + 0x18]
xor r8d, r8d
xor ecx, ecx
call fcn.10000d950
mov r8d, edi
mov edx, r15d
xor ecx, ecx
mov rbx, rax
call fcn.10000d950
mov rsi, rax
mov r9d, dword [rsp + 0x58]
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.10000239c
cmp eax, 2
jg 0x1000044df
cmp eax, edi
je 0x100004505
mov ebx, 0x4c7
jmp 0x100004598
mov rcx, rbp
mov qword [rsp + 0xa0], rbp
call fcn.1000033a8
mov rsi, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x10000452f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100004591
mov rcx, qword [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyExW]
mov ebx, eax
cmp eax, 0x57
jne 0x100004569
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov ebx, eax
test ebx, ebx
jne 0x100004588
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100004588
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, 0x57
cmove ebx, r15d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1000045ae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x30], 0
mov ecx, ebx
call fcn.100002fe8
test ebx, ebx
je 0x1000045c5
cmp ebx, 0x4c7
jne 0x1000043ef
xor edi, edi
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20000
lea rcx, [rax + 0x30]
jmp 0x1000043fe
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x60]
call fcn.10000d71c
mov eax, 1
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.100010090
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret