Function at 0x100136d0
Capabilities:
Copy file
Create directory
Delete file
Move file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100918c3
mov eax, dword fs:[0]
push eax
sub esp, 0x760
mov eax, dword [0x100b2370]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x628], ax
push 0x40e
push 0
lea ecx, [ebp - 0x626]
push ecx
call fcn.1004f5f0
add esp, 0xc
push 0x208
lea edx, [ebp - 0x628]
push edx
call fcn.10047640
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1004f5f0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x100a56c4
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.A.dll
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 4
push 0
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x100a56d8
lea ecx, [ebp - 0x6dc]
call fcn.1000dfe0
mov dword [ebp - 0x688], eax
mov edx, dword [ebp - 0x688]
mov dword [ebp - 0x64c], edx
mov dword [ebp - 4], 0
push 0x100a56e0
lea ecx, [ebp - 0x6c4]
call fcn.1000dfe0
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x670], eax
mov byte [ebp - 4], 1
push 0x100a56e8
lea ecx, [ebp - 0x754]
call fcn.1000dfe0
mov dword [ebp - 0x694], eax
mov ecx, dword [ebp - 0x694]
mov dword [ebp - 0x664], ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x6f4]
call fcn.1000dfe0
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x654], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x654]
push ecx
push str.rundll32.exe__
lea edx, [ebp - 0x724]
push edx
call fcn.10014760
add esp, 0xc
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 4
push str.__Install
mov ecx, dword [ebp - 0x65c]
push ecx
lea edx, [ebp - 0x76c]
push edx
call fcn.100145d0
add esp, 0xc
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x684], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x664]
push ecx
mov edx, dword [ebp - 0x684]
push edx
lea eax, [ebp - 0x73c]
push eax
call fcn.10014460
add esp, 0xc
mov dword [ebp - 0x68c], eax
mov ecx, dword [ebp - 0x68c]
mov dword [ebp - 0x690], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x670]
push edx
mov eax, dword [ebp - 0x690]
push eax
lea ecx, [ebp - 0x6ac]
push ecx
call fcn.10014460
add esp, 0xc
mov dword [ebp - 0x678], eax
mov edx, dword [ebp - 0x678]
mov dword [ebp - 0x668], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x64c]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
lea edx, [ebp - 0x640]
push edx
call fcn.10014460
add esp, 0xc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x6ac]
call fcn.1000e020
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x73c]
call fcn.1000e020
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x76c]
call fcn.1000e020
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x724]
call fcn.1000e020
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6f4]
call fcn.1000e020
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x754]
call fcn.1000e020
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6c4]
call fcn.1000e020
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x6dc]
call fcn.1000e020
lea eax, [ebp - 0x640]
push eax
push str.cmd.exe__c
lea ecx, [ebp - 0x70c]
push ecx
call fcn.100147a0
add esp, 0xc
mov dword [ebp - 0x66c], eax
mov edx, dword [ebp - 0x66c]
push edx
lea ecx, [ebp - 0x640]
call fcn.10010350
lea ecx, [ebp - 0x70c]
call fcn.1000e020
mov dword [ebp - 0x644], 0
mov byte [ebp - 0x645], 0
lea eax, [ebp - 0x645]
push eax
lea ecx, [ebp - 0x644]
push ecx
lea edx, [ebp - 0x640]
push edx
call fcn.10013380
add esp, 0xc
mov dword [ebp - 0x650], eax
push 0x2710
mov eax, dword [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x644]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x650]
mov dword [ebp - 0x658], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x640]
call fcn.1000e020
mov eax, dword [ebp - 0x658]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10048fad
mov esp, ebp
pop ebp
ret