Function at 0x140018810
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get file attributes
Move file
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor edi, edi
mov r12, r9
mov esi, r8d
mov rbx, rdx
mov r14, rcx
test rdx, rdx
jne 0x14001885e
test r9, r9
jne 0x14001885e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r14
call fcn.140017448
test eax, eax
jne 0x14001887c
sub rdi, rbx
neg rdi
sbb eax, eax
and eax, 0x80070002
jmp 0x140018c9f
mov r13d, 2
lea r15d, [r13 + 2]
test rbx, rbx
je 0x140018a1a
test esi, esi
je 0x140018921
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], rdi
mov r9d, r13d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlSession_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14001890f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], r15d
lea rdx, str.AllowProtectedRenames
mov r9d, r15d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x38]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x140018921
mov r8d, esi
lea rdx, str.ERROR:_Could_not_set_AllowProtectedRename_flag_for_SFP.__Error:_0x_x_r_n
mov ecx, r13d
call fcn.140016868
mov ecx, 0x208
call fcn.14003c310
mov rsi, rax
test rax, rax
jne 0x14001893d
mov eax, 0x8007000e
jmp 0x140018c9f
mov r15d, 0x104
mov rdx, rsi
mov r8d, r15d
mov rcx, rbx
call fcn.140016ab0
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test r12, r12
je 0x14001897d
mov r9, rsi
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.140001734
jmp 0x1400189b8
mov eax, dword [0x1400516ec]
lea r8, str._ssetb_lu.tmp
mov r9, rsi
mov dword [rsp + 0x20], eax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140001734
inc dword [0x1400516ec]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400189b8
test al, 0x10
je 0x14001897d
mov rcx, rsi
call fcn.14003c2b8
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140018a30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r9, [rsp + 0x40]
test eax, eax
lea rdx, str.ERROR:_ReplaceFileOnReboot:_Could_not_move_file__S_to__S.__Error_0x_x._r_n
mov r8, r14
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x20], ecx
xor ecx, ecx
call fcn.140016868
mov eax, 0x80004005
jmp 0x140018c9f
mov r15d, 0x104
lea rcx, [rsp + 0x40]
mov edx, r15d
mov r8, r14
call fcn.140001470
mov ecx, 0x208
call fcn.14003c310
mov r14, rax
mov esi, 0x80004005
test rax, rax
je 0x140018bbe
mov rdx, rax
mov ecx, r15d
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140018b9f
mov rcx, r14
call fcn.140017474
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, edi
mov dword [0x1400516ec], eax
test r12, r12
je 0x140018af2
mov r9, r14
mov qword [rsp + 0x20], r12
lea r8, str._s_s
mov rdx, r15
lea rcx, [rbp + 0x150]
call fcn.140001734
lea rdx, [rbp + 0x150]
test rbx, rbx
je 0x140018b3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140018b9f
mov rcx, rbx
call fcn.140017448
test eax, eax
je 0x140018adf
mov r8, rbx
lea rdx, str.ERROR:_Replace_file_in_place_failed_for__S.__File_still_exists._r_n
mov ecx, 1
call fcn.140016868
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r13d, eax
jmp 0x140018b66
mov r9, r14
mov dword [rsp + 0x20], eax
lea r8, str._ssetb_lu.tmp
mov rdx, r15
lea rcx, [rbp + 0x150]
call fcn.140001734
inc dword [0x1400516ec]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140018a9e
test al, 0x10
jne 0x140018a9e
mov eax, dword [0x1400516ec]
jmp 0x140018af2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140018b9f
lea r8, [rsp + 0x40]
mov ecx, 4
lea rdx, str.__Moved_file__S_to_temp_location_for_clean_up_upon_reboot._r_n
call fcn.140016868
mov r13d, 1
lea rcx, [rbp + 0x150]
call fcn.140019404
mov esi, eax
cmp eax, 0xd2af9
jne 0x140018b9f
or dword [0x140050558], 2
lea r8, [rbp + 0x150]
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
mov ecx, 2
mov esi, 0xd2af8
call fcn.140016868
mov rcx, r14
call fcn.14003c2b8
test r13d, r13d
je 0x140018bb3
mov eax, esi
jmp 0x140018c9f
mov esi, 0x80004005
mov r13d, 2
mov r8d, 5
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140018c63
test rbx, rbx
je 0x140018c0b
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x140018be3
test rax, rax
je 0x140018c0b
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x140018c0b
mov r8, rbx
lea rdx, str.ERROR:_Bad_file_destination__S._r_n
mov ecx, r13d
call fcn.140016868
lea r8, [rsp + 0x40]
mov ecx, r13d
lea rdx, str.WARNING:_Reboot_required_due_to_file__S._r_n
call fcn.140016868
lea r8, [rsp + 0x40]
mov ecx, r13d
cmp dword [rbp + 0x3d0], edi
je 0x140018c49
or dword [0x140050558], 8
lea rdx, str.__Reboot_requested_due_to__S_file_copy._r_n
call fcn.140016868
mov eax, 0xd2af9
jmp 0x140018c9f
or dword [0x140050558], r13d
lea rdx, str.__Reboot_requested_due_to__S_file_clean_up._r_n
call fcn.140016868
mov eax, 0xd2af8
jmp 0x140018c9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
lea r8, [rsp + 0x40]
test eax, eax
lea rdx, str.ERROR:_MoveFileEx_failed_for_file__S.__Error:_0x_x._r_n
cmove eax, ecx
mov ecx, r13d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov r9d, ebx
call fcn.140016868
mov eax, ebx
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret