Function at 0x100010a1
Capabilities:
Copy file
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b58
call fcn.1000d330
and byte [ebp - 0x240], 0
push esi
push edi
push 0x41
pop ecx
xor eax, eax
and byte [ebp - 0x348], al
lea edi, [ebp - 0x23f]
rep stosd dword es:[edi], eax
push 0x41
lea edi, [ebp - 0x347]
pop ecx
mov byte [ebp - 0x138], 0x99
rep stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x135]
pop ecx
mov byte [ebp - 0x137], 0x3a
mov byte [ebp - 0x136], 0x5c
and byte [ebp - 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and byte [ebp - 0x30], 0
and byte [ebp - 0x10], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x2f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and byte [ebp - 0x10b58], 0
mov ecx, 0x4203
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x10b57]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
stosw word es:[edi], ax
test esi, esi
stosb byte es:[edi], al
jne 0x1000114c
or eax, 0xffffffff
jmp 0x100012ec
lea eax, [ebp - 0x240]
push 0x105
push eax
push 0x10010020
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10001172
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100012ec
push ebx
lea eax, [esi + 0x160]
push 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [esi + 0x170]
push 0x10
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memcpy
add esi, 0x150
push 0x10
lea eax, [ebp - 0x30]
push esi
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x240]
push str._system32
push eax
call sub.MSVCRT.dll_strcat
mov esi, 0x104
lea eax, [ebp - 0x240]
push esi
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x40
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x348]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
mov al, byte [ebp + 0xc]
add esp, 0x10
dec edi
mov byte [ebp - 0x138], al
lea ebx, [ebp - 0x10a54]
mov dword [ebp + 0xc], 7
lea eax, [ebp - 0x240]
push esi
push eax
lea eax, [ebx - 0x104]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x136]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x138]
push esi
push eax
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0x24
inc byte [ebp - 0xd]
inc byte [edi]
add ebx, 0x208
dec dword [ebp + 0xc]
jne 0x10001224
lea eax, [ebp - 0x348]
push esi
push eax
lea eax, [ebp - 0xfd20]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x30]
push esi
push eax
lea eax, [ebp - 0x136]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x138]
push esi
push eax
lea eax, [ebp - 0xfc1c]
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x24
lea esi, [ebp - 0x10a54]
push 8
pop ebx
cmp byte [ebp + 0x10], 3
push 0
jne 0x100012c7
lea eax, [esi - 0x104]
push esi
push eax
jmp 0x100012cf
lea eax, [esi - 0x104]
push eax
push esi
call edi
add esi, 0x208
dec ebx
jne 0x100012b5
lea eax, [ebp - 0x138]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret