Function at 0x1004143f
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x1c]
push esi
push edi
mov ebx, dword [ebp + 0x10]
lea edi, [ebp - 0x838]
mov dword [ebp - 0x858], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x850], ecx
xor ecx, ecx
mov dword [ebp - 0x848], edx
mov esi, ecx
mov dword [ebp - 0x854], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 0x840], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
mov edi, 0x208
push edi
push ecx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push edi
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x208
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0x850], esi
je 0x10041835
cmp dword [ebp - 0x848], esi
je 0x10041835
mov edi, dword [ebp - 0x84c]
test edi, edi
je 0x10041835
test ebx, ebx
je 0x10041835
cmp dword [ebp - 0x844], esi
je 0x10041835
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x10041559
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x10041559
cmp dword [ebp - 0x840], esi
je 0x10041559
push dword [ebp - 0x840]
jmp 0x1004155e
push 0x10008570
mov ebx, 0x104
lea ecx, [ebp - 0x210]
mov edx, ebx
call fcn.10015ac7
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x850]
mov edx, ebx
lea ecx, [ebp - 0x418]
call fcn.10015ac7
push 0x100085c0
mov edx, ebx
lea ecx, [ebp - 0x418]
call fcn.1001a5bc
push edi
mov edx, ebx
lea ecx, [ebp - 0x418]
call fcn.1001a5bc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004180e
push 0x208
lea eax, [ebp - 0x620]
push 0
push eax
call sub.msvcrt.dll_memset
pop ecx
pop ecx
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x418]
call fcn.1003ff12
mov esi, eax
test esi, esi
js 0x100417ce
push dword [ebp - 0x844]
lea eax, [ebp - 0x828]
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov edx, ebx
test esi, esi
je 0x10041795
push 0x100085e4
lea ecx, [ebp - 0x620]
call fcn.10015ac7
lea eax, [ebp - 0x210]
mov edx, ebx
push eax
lea ecx, [ebp - 0x620]
call fcn.1001a5bc
mov ecx, dword [ebp - 0x848]
lea edx, [ebp - 0x620]
call fcn.10080125
mov esi, eax
mov dword [ebp - 0x84c], esi
test esi, esi
je 0x1004178d
xor eax, eax
cmp word [esi], ax
je 0x1004178d
push eax
push eax
push eax
push eax
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x1004176d
push esi
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov esi, eax
test esi, esi
jne 0x1004175a
push dword [ebp - 0x844]
push 0x20019
push eax
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10041748
lea eax, [ebp - 0x620]
mov edx, ebx
push eax
mov ecx, edi
call fcn.10015ac7
mov edi, eax
test edi, edi
js 0x10041714
mov ecx, dword [ebp - 0x854]
lea eax, [ebp - 0x210]
push eax
mov edx, ebx
call fcn.10015ac7
mov edi, eax
test edi, edi
js 0x10041714
mov ecx, dword [ebp - 0x858]
xor eax, eax
inc eax
mov dword [ebp - 0x83c], eax
mov dword [ecx], eax
jmp 0x10041775
test edi, 0x10000000
je 0x10041735
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x10041746
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x10041748
mov eax, edi
movzx esi, di
and eax, 0x1fff0000
cmp eax, 0x70000
je 0x10041748
mov esi, edi
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov ecx, dword [ebp - 0x848]
lea edx, [ebp - 0x620]
call fcn.1004126f
jmp 0x10041775
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x84c]
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100417ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100417eb
lea eax, [ebp - 0x418]
mov ecx, edi
push eax
call fcn.10015ac7
test eax, eax
js 0x100417ed
mov ecx, dword [ebp - 0x854]
lea eax, [ebp - 0x828]
push eax
mov edx, ebx
call fcn.10015ac7
test eax, eax
js 0x100417ed
mov ecx, dword [ebp - 0x858]
xor eax, eax
xor ebx, ebx
inc ebx
mov dword [ecx], eax
jmp 0x10041810
test esi, 0x10000000
je 0x100417f5
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
je 0x100417ed
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov ebx, dword [ebp - 0x83c]
jmp 0x10041810
mov ebx, dword [ebp - 0x83c]
mov eax, esi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x10041810
movzx esi, si
jmp 0x10041810
mov ebx, esi
cmp dword [ebp - 0x840], 0
je 0x10041826
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test esi, esi
je 0x10041831
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x1004183f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0x18