Function at 0x10002463
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Read file via mapping
Set environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3fc
pushal
mov dword [ebp - 0xc04], 0
mov byte [0x1000e52e], 0
push 0x400
lea eax, [ebp - 0xc00]
push eax
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x400
push 0x1000d911
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov esi, 0x1000d911
jmp 0x100024cb
lodsb al, byte [esi]
cmp al, 0x25
jne 0x100024cb
push 0x1000d911
call fcn.10006ea0
push eax
push 0x1000d911
call sub.kernel32.dll_lstrcpyA
jmp 0x100024d0
cmp byte [esi], 0
jne 0x100024af
mov edi, 0x1000d911
cmp byte [edi + 1], 0x3a
je 0x10002546
cmp byte [0x1000e95f], 0
jne 0x10002505
push 0x400
lea eax, [ebp - 0xc00]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0xc00]
push eax
call fcn.1000226a
jmp 0x10002516
push 0x1000e95f
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcpyA
cmp byte [edi], 0x5c
je 0x1000252c
push 0x1000d11a
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcatA
push edi
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0xc00]
push eax
push edi
call sub.kernel32.dll_lstrcpyA
push 0x400
push 0x1001323d
push 0x13
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001323d
call sym.dup2patcher.dll_AddMsg
push 0x1000d911
call sym.dup2patcher.dll_AddMsg
push 0x1000d911
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x1000e511], eax
cmp eax, 0xffffffff
je 0x100025b9
test dword [ebp + 0x10], 0x80000000
je 0x10002590
jmp 0x100025b9
test eax, 1
je 0x100025af
xor eax, 1
push eax
push 0x1000d911
call sub.kernel32.dll_SetFileAttributesA
push 0x1000d11c
call sym.dup2patcher.dll_AddMsg
push 0x1000d911
call fcn.10002313
test dword [ebp + 0x10], 0x80000000
je 0x100025e0
push 0
push 0x82
push 3
push 0
push 1
push 0x80000000
push 0x1000d911
call sub.kernel32.dll_CreateFileA
jmp 0x100025fc
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x1000d911
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x1000277c
push 0x1000d911
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x100026ef
cmp byte [0x1000e95c], 0
jne 0x10002777
push 0x1000d911
call fcn.10006ea0
cmp word [eax], 0x2e2a
je 0x1000266f
cmp word [eax], 0
je 0x1000266f
push 0x400
push 0x1001363d
push 0x10
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x34
push 0x1000d911
push 0x1001363d
push dword [0x1000d8a6]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x100026ea
lea esi, [ebp - 0x400]
mov edi, 0x1000d911
cmp byte [edi + 1], 0x3a
jne 0x10002688
push edi
call fcn.10006ea0
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call fcn.10006c90
cmp eax, 0
jbe 0x1000269b
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
lea ebx, [ebp - 0x800]
push 0x1000d911
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call fcn.1000226a
push dword [0x1000d8a6]
push ebx
push esi
push 0x1000d911
call fcn.10006e30
cmp eax, 1
jne 0x100026ea
jmp 0x10002546
jmp 0x10002777
test dword [ebp + 0x10], 2
je 0x1000273f
cmp byte [0x1000e52e], 0
jne 0x10002777
push 0x1000d911
call fcn.10002411
cmp eax, 1
jne 0x1000273d
mov byte [0x1000e52e], 1
push 0x400
push 0x10013a3d
push 0x11
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10013a3d
call sym.dup2patcher.dll_AddMsg
jmp 0x10002546
jmp 0x10002777
push 0x400
push 0x10013e3d
push 0x12
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x34
push 0x1000d911
push 0x10013e3d
push dword [0x1000d8a6]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x10002777
jmp 0x10002546
jmp 0x100028ba
mov dword [0x1000e515], eax
push 0x1000f191
push 0x1000f189
push 0x1000f181
push dword [0x1000e515]
call sub.kernel32.dll_GetFileTime
push 0x1000e51d
push dword [0x1000e515]
call sub.kernel32.dll_GetFileSize
mov dword [0x1000e519], eax
cmp dword [ebp + 0xc], 0
jne 0x100027b9
mov dword [ebp + 0xc], eax
test dword [ebp + 0x10], 4
je 0x100027db
add eax, 0x278
add eax, dword [0x1000d880]
push 0x100
push eax
call fcn.10006ee0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x1000e529]
test dword [ebp + 0x10], 0x80000000
je 0x10002804
push 0
push 0
push 0
push 2
push 0
push dword [0x1000e515]
call sub.kernel32.dll_CreateFileMappingA
jmp 0x10002819
push 0
push 0
push 0
push 4
push 0
push dword [0x1000e515]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x10002840
push 0x400
push 0x1001423d
push 0x14
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001423d
call sym.dup2patcher.dll_AddMsg
jmp 0x100028ba
mov dword [0x1000e525], eax
test dword [ebp + 0x10], 0x80000000
je 0x1000285e
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
jmp 0x1000286c
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x10002872
jmp 0x1000281d
mov dword [0x1000e521], eax
mov dword [ebp - 0xc04], eax
push 0x1000d911
push 0x1000d16c
call sub.kernel32.dll_SetEnvironmentVariableA
push 0x1000d911
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0xc00]
push eax
call fcn.1000226a
lea eax, [ebp - 0xc00]
push eax
push 0x1000d17b
call sub.kernel32.dll_SetEnvironmentVariableA
cmp dword [ebp - 0xc04], 0
jne 0x100028cd
push 0x1000d18a
call sym.dup2patcher.dll_AddMsg
popal
mov eax, dword [ebp - 0xc04]
leave
ret 0xc