Function at 0x405310
Capabilities:
Get common file path
Get file size
Move file
Set file attributes

Disassembly:
sub rsp, 0x6a8
mov qword [rsp + 0x6a0], rbx
mov qword [rsp + 0x698], rbp
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x688], rdi
mov rdi, rdx
mov rsi, r8
mov rbp, rcx
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov r8d, 0x4000
mov qword [rsp + 0x680], r12
mov byte [rsp + 0x50], 0x88
mov qword [rsp + 0x678], r13
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x40537b
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40538d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x405394
test rsi, rsi
je 0x405394
xor al, al
jmp 0x4055e0
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8d, 4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, 1
sete bl
test bl, bl
jne 0x4055ce
lea rdx, [rsp + 0x160]
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x4053f3
lea rdx, str.Calling_GetShortPathNameLong_in_NvReplaceFileOnReboot
mov rcx, rbp
call fcn.00401440
xor al, al
jmp 0x4055d0
lea rax, [0x0040d51c]
test rsi, rsi
lea r9, [rsp + 0x160]
cmove rsi, rax
lea rdx, str._hs_hs_r_n
lea rcx, [rsp + 0x270]
mov r8, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [str._Rename__r_n]
mov edx, 0x104
mov r13d, eax
lea rax, [rsp + 0x40]
mov qword [rax], rcx
movzx ecx, word [0x0040d508]
mov word [rax + 8], cx
movzx ecx, byte [0x0040d50a]
mov byte [rax + 0xa], cl
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
xor esi, esi
xor r9d, r9d
repne scasb al, byte [rdi]
mov rax, qword [str.WININIT.INI]
mov qword [rsp + 0x30], rsi
mov qword [rdi - 1], rax
mov eax, dword [0x0040d4f8]
lea rcx, [rsp + 0x50]
mov dword [rdi + 7], eax
movzx eax, byte [0x0040d4fc]
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x8000080
mov byte [rdi + 0xb], al
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x4053ec
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
lea ecx, [rax + r13 + 0xa]
mov r8d, 4
xor edx, edx
mov dword [rsp + 0x20], ecx
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
mov r12, rax
je 0x4055a3
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rsi, rax
je 0x40559a
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x40554c
mov ecx, edi
lea r8, [rsp + 0x40]
lea rdx, [0x0040c6bc]
add rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
add edi, eax
mov ebx, edi
jmp 0x405577
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.msvcrt.dll_strchr]
mov r8d, edi
movsxd rcx, r13d
lea rbx, [rax + 1]
sub r8, rbx
add rcx, rbx
mov rdx, rbx
add r8, rsi
call sub.msvcrt.dll_memmove
sub ebx, esi
mov ecx, ebx
lea rdx, [rsp + 0x270]
movsxd r8, r13d
add rcx, rsi
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, r13d
mov bl, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x680]
mov al, bl
mov r13, qword [rsp + 0x678]
mov rbx, qword [rsp + 0x6a0]
mov rdi, qword [rsp + 0x688]
mov rsi, qword [rsp + 0x690]
mov rbp, qword [rsp + 0x698]
add rsp, 0x6a8
ret