Function at 0x10002140
Capabilities:
Copy file
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa90
mov eax, dword [0x10011184]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44c], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xa78]
push ecx
call fcn.10004a30
add esp, 8
lea edx, [ebp - 0xa78]
push edx
lea eax, [ebp - 0x760]
push eax
call fcn.10004a30
add esp, 8
lea ecx, [ebp - 0xa78]
push ecx
call fcn.1000c13b
add esp, 4
push str..drv
lea edx, [ebp - 0x760]
push edx
call fcn.10001540
add esp, 8
test eax, eax
je 0x100021b4
xor eax, eax
jmp 0x10002475
push str.usb00
lea eax, [ebp - 0x760]
push eax
call fcn.10001540
add esp, 8
test eax, eax
je 0x100021d3
xor eax, eax
jmp 0x10002475
push 0x5c
lea ecx, [ebp - 0xa78]
push ecx
call fcn.10003dc0
add esp, 8
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 0
jne 0x100021fa
xor eax, eax
jmp 0x10002475
mov edx, dword [ebp - 0x764]
add edx, 1
push edx
lea eax, [ebp - 0x318]
push eax
call fcn.10004a30
add esp, 8
push str.Superk5Dev
mov ecx, dword [ebp - 0x764]
add ecx, 1
push ecx
call fcn.1000ba75
add esp, 8
test eax, eax
jne 0x10002239
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
movsx edx, byte [ebp - 0x318]
test edx, edx
je 0x10002473
lea eax, [ebp - 0x318]
push eax
call fcn.100020a0
add esp, 4
test eax, eax
je 0x10002473
push str..mf1
lea ecx, [ebp - 0xa78]
push ecx
call fcn.10001540
add esp, 8
test eax, eax
jne 0x1000228f
push str..mf2
lea edx, [ebp - 0xa78]
push edx
call fcn.10001540
add esp, 8
test eax, eax
je 0x1000229e
lea eax, [ebp - 0x760]
push eax
call fcn.10001ac0
add esp, 4
lea ecx, [ebp - 0x760]
push ecx
call fcn.100017b0
add esp, 4
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 0
jne 0x10002469
push 0
lea edx, [ebp - 0xa78]
push edx
call fcn.10004ed4
add esp, 8
cmp eax, 0xffffffff
jne 0x100022e0
mov dword [ebp - 0x44c], 1
lea eax, [ebp - 0x318]
push eax
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x318]
push ecx
push 0
push 0x1000d540
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x760]
push ecx
call fcn.10001690
add esp, 8
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0x44c], 0
jne 0x100023f8
push 0
lea edx, [ebp - 0x318]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 0xffffffff
jne 0x100023da
mov edx, dword [ebp - 0xa8c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0xa90], eax
push 0x80
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x318]
push edx
call fcn.10001d30
add esp, 4
mov eax, dword [ebp - 0xa90]
or eax, 1
mov dword [ebp - 0xa90], eax
mov ecx, dword [ebp - 0xa90]
push ecx
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x100023f6
mov eax, dword [ebp - 0xa8c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x318]
push ecx
call fcn.10001d30
add esp, 4
jmp 0x10002405
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x318]
push eax
push str.api_encrypt__s
lea ecx, [ebp - 0x448]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xa88], eax
lea edx, [ebp - 0x448]
push edx
call fcn.10004dc0
add esp, 4
add eax, 1
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x448]
mov dword [ebp - 0xa80], eax
lea ecx, [ebp - 0xa88]
push ecx
push 0
push 0x4a
mov edx, dword [0x10014004]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0xa7c]
jmp 0x10002475
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100042b8
mov esp, ebp
pop ebp
ret