Function at 0x100417e6
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Move file
Print debug messages

Disassembly:
push 0x64c
mov eax, 0x1007a929
call fcn.1004e336
mov esi, dword [0x100a3378]
mov edi, dword [0x100a3374]
test esi, esi
jne 0x10041813
test edi, edi
jne 0x10041813
mov eax, 0x3f0
jmp 0x10041ab8
or ebx, 0xffffffff
call fcn.1003069c
test eax, eax
je 0x10041826
call fcn.10030aa4
mov ebx, eax
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10050900
add esp, 0xc
lea ecx, [ebp - 0x640]
call fcn.1004170d
and dword [ebp - 4], 0
cmp dword [ebp - 0x630], 0
jne 0x1004185e
mov esi, 0x3e9
jmp 0x10041a97
cmp dword [ebp - 0x62c], 8
lea edx, [ebp - 0x640]
push ecx
cmovae edx, dword [ebp - 0x640]
lea eax, [ebp - 0x420]
push eax
xor ecx, ecx
call fcn.10030529
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004189c
mov esi, 0x3ea
jmp 0x10041a97
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10050900
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers_netfilter2.sys
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004190e
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100419fa
mov esi, 0x3eb
jmp 0x10041a97
lea edx, [ebp - 0x420]
lea ecx, [ebp - 0x218]
call fcn.100302b1
test eax, eax
jne 0x100419fa
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100419fa
call fcn.10030905
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x658]
push str._s._08x
push eax
call fcn.100324b2
add esp, 0x10
lea eax, [ebp - 0x658]
cmp dword [ebp - 0x644], 8
cmovae eax, dword [ebp - 0x658]
push 1
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100419e0
push 0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100419bf
push eax
push 1
lea ecx, [ebp - 0x658]
mov esi, 0x3ec
call fcn.100065b4
jmp 0x10041a97
cmp dword [ebp - 0x644], 8
lea eax, [ebp - 0x658]
push 4
cmovae eax, dword [ebp - 0x658]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x100419eb
push str.copy_netfiler_driver_module_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 1
lea ecx, [ebp - 0x658]
call fcn.100065b4
test edi, edi
je 0x10041a63
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.10050900
pop ecx
pop ecx
lea eax, [ebp - 0x628]
mov edx, str.cache
push eax
xor ecx, ecx
call fcn.10030529
lea ecx, [ebp - 0x628]
call fcn.1002fedc
test eax, eax
jne 0x10041a3c
mov esi, 0x3ed
jmp 0x10041a97
lea eax, [ebp - 0x628]
push eax
push edi
call dword [sym.imp.protocolfilters.dll_int___cdecl_ProtocolFilters::pf_init_class_ProtocolFilters::PFEvents___wchar_t_const__]
pop ecx
pop ecx
test eax, eax
jne 0x10041a57
mov esi, 0x3ee
jmp 0x10041a97
push str.GlobalSign_Organization_Validation_CA___SHA256
call dword [sym.imp.protocolfilters.dll_void___cdecl_ProtocolFilters::pf_setRootSSLCertSubject_char_const__]
pop ecx
test esi, esi
jne 0x10041a6f
call dword [sym.imp.protocolfilters.dll_class_nfapi::NF_EventHandler____cdecl_ProtocolFilters::pf_getNFEventHandler_void_]
mov esi, eax
push esi
push str.netfilter2
call dword [sym.imp.nfapi.dll_enum__NF_STATUS___cdecl_nfapi::nf_init_char_const___class_nfapi::NF_EventHandler__]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10041a91
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x3ef
jmp 0x10041a97
call dword [sym.imp.nfapi.dll_void___cdecl_nfapi::nf_adjustProcessPriviledges_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x640]
push 0
push 1
call fcn.100065b4
cmp ebx, 0xffffffff
je 0x10041ab6
mov ecx, ebx
call fcn.10030ae6
mov eax, esi
call fcn.1004e2e0
ret