Function at 0x401000
Capabilities:
Check mutex on windows
Copy file
Create directory
Delete file
Get common file path
Get program files directory
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84c
push ebx
push esi
push edi
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x42]
push edx
mov word [esp + 0x44], cx
call fcn.0040b3f0
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x401093
lea ecx, [esp + 0x28]
push ecx
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x401087
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x38]
push eax
call edi
test eax, eax
jne 0x4010c2
push 0x10
push str.ERROR
push 0x417c78
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x452]
push edx
mov word [esp + 0x454], cx
call fcn.0040b3f0
add esp, 0xc
push 0x104
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x448]
push edx
lea eax, [esp + 0x3c]
push eax
call esi
lea ecx, [esp + 0x38]
push ecx
call edi
cmp word [esp + eax*2 + 0x36], 0x5c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x401130
push 0x417c8c
lea edx, [esp + 0x3c]
push edx
call ebx
push 0x417c90
lea eax, [esp + 0x3c]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00401cb0
lea edx, [esp + 0x10]
push edx
call fcn.00401540
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x3c]
push ecx
call esi
push 0
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4011c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x4011c6
cmp eax, 0xb7
je 0x4011c6
push 0x10
push str.ERROR
push 0x417cbc
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40152e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edi, [esp + 0x18]
call fcn.00402020
mov esi, dword [esp + 0x18]
mov ecx, 0x417cd0
test esi, esi
jne 0x4011e1
mov ecx, str.DszFileSafe.exe
lea edx, [esp + 0x14]
push edx
call fcn.00401cb0
mov edx, dword [0x41b0a4]
xor eax, eax
test esi, esi
setne al
mov ecx, 0x41b0a4
add eax, 0x81
mov esi, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x3c]
push edx
add eax, 0x10
push 0x417d18
lea edi, [esp + 0x28]
mov dword [esp + 0x28], eax
call fcn.00401750
add esp, 0xc
push 0x104
lea eax, [esp + 0x244]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x240]
push 0x5c
push ecx
call fcn.0040a24f
add esp, 8
xor edx, edx
mov word [eax], dx
push 0x417d24
lea eax, [esp + 0x244]
push eax
call ebx
push str.Rhelp.exe
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x658]
push 0x417d18
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
lea eax, [esp + 0x650]
push eax
call ebx
push 0
lea ecx, [esp + 0x654]
push ecx
lea edx, [esp + 0x248]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push str.AUTO_USB_MON_MAIN_WIN_INSTANCE_MUTEXT
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40133d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40133d
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4012ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40130e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40152e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.AUTO_USB_MON_WIN_INSTANCE_MUTEXT
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x4013bf
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401373
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401393
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4013b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [0x41b0a4]
mov eax, dword [edx + 0xc]
mov ecx, 0x41b0a4
call eax
push str.UsbManager.7z
lea ecx, [esp + 0x3c]
push ecx
add eax, 0x10
push 0x417d18
lea edi, [esp + 0x24]
mov dword [esp + 0x24], eax
call fcn.00401750
mov edx, dword [0x41b0a4]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x41b0a4
call eax
push str.UsbTmp
lea ecx, [esp + 0x3c]
push ecx
add eax, 0x10
push 0x417d18
lea edi, [esp + 0x2c]
mov dword [esp + 0x2c], eax
call fcn.00401750
mov edx, dword [0x41b0a4]
mov eax, dword [edx + 0xc]
add esp, 0xc
mov ecx, 0x41b0a4
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push ecx
push edx
add eax, 0x10
push str._s_s
lea edi, [esp + 0x30]
mov dword [esp + 0x30], eax
call fcn.00401750
mov edx, dword [esp + 0x2c]
mov ecx, dword [ebp + 8]
movzx eax, si
mov esi, dword [esp + 0x24]
add esp, 0xc
push eax
call fcn.00402090
add esp, 4
test eax, eax
jne 0x4014c3
push 0x10
push str.ERROR
push str._e_N_vz
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.004017f0
lea ecx, [esp + 0x20]
call fcn.004017f0
lea ecx, [esp + 0x18]
call fcn.004017f0
lea ecx, [esp + 0x1c]
call fcn.004017f0
lea ecx, [esp + 0x14]
call fcn.004017f0
lea ecx, [esp + 0x10]
call fcn.004017f0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [esp + 0x1c]
push esi
call ebx
mov ecx, dword [esp + 0x24]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x4014ef
push 0x10
push str.ERROR
push 0x417e38
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4014f8
push esi
call fcn.00401ed0
add esp, 4
lea ecx, [esp + 0x24]
call fcn.004017f0
lea ecx, [esp + 0x20]
call fcn.004017f0
lea ecx, [esp + 0x18]
call fcn.004017f0
lea ecx, [esp + 0x1c]
call fcn.004017f0
lea ecx, [esp + 0x14]
call fcn.004017f0
lea ecx, [esp + 0x10]
call fcn.004017f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10