Function at 0x1002595
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Get disk information
Get file attributes
Manipulate boot configuration
Move file
Persist via windows service
Read .ini file
Set file attributes
Set registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9a0
push esi
push edi
mov esi, 0x10016f4
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10016e4
lea edi, [ebp - 0x84]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10016d4
lea edi, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10016c4
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x10016b8
lea edi, [ebp - 0x44]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x10016a8
lea edi, [ebp - 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x100169c
lea edi, [ebp + 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001690
lea edi, [ebp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x1001680
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001670
lea edi, [ebp - 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001660
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001650
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001640
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x1001630
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [0x100af50], 2
mov dword [ebp + 0x68], 0x5c3a3f
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x20], esi
je 0x1002dcd
xor edi, edi
push ebx
inc edi
push edi
call fcn.01004f9d
push 0x10015fc
call fcn.010057b6
mov ebx, eax
cmp ebx, esi
je 0x10026a1
push 2
push 0x10015f8
push edi
push esi
push 0x10015ec
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.0100594e
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002dcc
mov ebx, dword [sym.imp.msvcrt.dll__mbscpy]
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x5c4]
push eax
call ebx
pop ecx
pop ecx
push 0x10015e4
lea eax, [ebp - 0x1a8]
push eax
call fcn.01005a78
push eax
call ebx
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp + 0xc], eax
call fcn.0100254c
test eax, eax
je 0x1002715
mov al, byte [ebp - 0x4c0]
mov byte [ebp + 0x5c], al
jmp 0x1002719
mov byte [ebp + 0x5c], 0x43
mov al, byte [ebp + 0x5c]
cmp byte [ebp - 0x5c4], al
je 0x1002727
mov dword [ebp + 0x20], edi
push 0x10015d8
lea eax, [ebp - 0x1a8]
push eax
push esi
call fcn.01005ebe
mov dword [ebp + 0x38], eax
push 0x10015cc
lea eax, [ebp - 0x1a8]
push eax
push esi
call fcn.01005ebe
mov dword [ebp + 0x30], eax
push 0x10015bc
lea eax, [ebp - 0x1a8]
push eax
push esi
call fcn.01005ebe
mov dword [ebp + 0x34], eax
push 0x10015ac
lea eax, [ebp - 0x1a8]
push eax
push esi
call fcn.01005ebe
mov dword [ebp + 0x60], eax
push 0x100159c
lea eax, [ebp - 0x1a8]
push eax
push esi
call fcn.01005ebe
mov dword [ebp + 0x3c], eax
mov bl, 0x41
mov eax, dword [ebp + 0xc]
test eax, edi
je 0x10027e8
lea eax, [ebp + 0x68]
push eax
mov byte [ebp + 0x68], bl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x10027af
cmp eax, esi
jne 0x10027e8
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 0x64], bl
mov byte [ebp - 0x84], bl
call fcn.0100462a
lea eax, [ebp - 0x84]
push eax
call fcn.0100462a
call fcn.0100254c
test eax, eax
je 0x10027e8
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 0xa4], bl
call fcn.0100462a
shl edi, 1
inc bl
cmp edi, esi
jne 0x1002792
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0x70], 1
mov byte [ebp + 0x77], 0x41
mov edi, 0x80
mov eax, dword [ebp + 0xc]
test dword [ebp + 0x70], eax
je 0x1002c67
call fcn.0100254c
test eax, eax
je 0x1002830
mov al, byte [ebp + 0x77]
cmp al, byte [ebp - 0x4c0]
jne 0x1002c67
mov al, byte [ebp + 0x77]
mov byte [ebp + 0x68], al
lea eax, [ebp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x100284d
test eax, eax
jne 0x1002c67
mov al, byte [ebp + 0x77]
mov byte [ebp - 0x64], al
mov byte [ebp - 0x84], al
mov byte [ebp + 0x50], al
mov byte [ebp - 0x74], al
mov byte [ebp - 0x44], al
mov byte [ebp + 0x40], al
mov byte [ebp + 0x10], al
mov byte [ebp - 4], al
mov byte [ebp - 0x94], al
mov byte [ebp - 0x54], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x24], al
mov byte [ebp - 0x34], al
push edi
lea eax, [ebp - 0x74]
push eax
call esi
lea eax, [ebp - 0x74]
push eax
call ebx
push edi
lea eax, [ebp - 0x44]
push eax
call esi
lea eax, [ebp - 0x44]
push eax
call ebx
push edi
lea eax, [ebp - 0x94]
push eax
call esi
lea eax, [ebp - 0x94]
push eax
call ebx
cmp dword [ebp + 0x20], 0
jne 0x1002c67
mov al, byte [ebp + 0x5c]
cmp byte [ebp + 0x77], al
jne 0x1002c67
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002b1a
push dword [ebp + 0x60]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002b1a
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 0x4c], eax
jne 0x10028fd
mov dword [ebp + 0x4c], 7
push dword [ebp + 0x5c]
push dword [ebp + 0x60]
call fcn.01001de8
test eax, eax
je 0x1002b04
push edi
lea eax, [ebp + 0x50]
push eax
call esi
push 0
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push dword [ebp + 0x4c]
lea eax, [ebp + 0x50]
push eax
call esi
push 0
push dword [ebp + 0x30]
call fcn.01003da8
test eax, eax
je 0x1002bb3
push 0
push dword [ebp + 0x34]
call fcn.01003da8
test eax, eax
je 0x1002bb3
push 0
lea eax, [ebp + 0x40]
push eax
call fcn.01003da8
test eax, eax
je 0x1002983
push edi
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
and dword [ebp + 0x24], 0
jmp 0x100298a
mov dword [ebp + 0x24], 1
push 0
lea eax, [ebp + 0x10]
push eax
call fcn.01003da8
test eax, eax
je 0x10029ba
push edi
lea eax, [ebp - 0x24]
push eax
call esi
lea eax, [ebp - 0x24]
push eax
call ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
and dword [ebp + 0x2c], 0
jmp 0x10029c1
mov dword [ebp + 0x2c], 1
push 0
lea eax, [ebp - 4]
push eax
call fcn.01003da8
test eax, eax
je 0x10029f1
push edi
lea eax, [ebp - 0x34]
push eax
call esi
lea eax, [ebp - 0x34]
push eax
call ebx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
and dword [ebp + 0x64], 0
jmp 0x10029f8
mov dword [ebp + 0x64], 1
push 0
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1002a73
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov dword [ebp + 0x28], eax
je 0x1002a73
push 0
push dword [ebp + 0x3c]
call fcn.01003da8
test eax, eax
je 0x1002a41
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp + 0x28], eax
cmp dword [ebp + 0x28], 0
je 0x1002a73
push edi
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
call ebx
push edi
lea eax, [ebp - 0x24]
push eax
call esi
lea eax, [ebp - 0x24]
push eax
call ebx
push edi
lea eax, [ebp - 0x34]
push eax
call esi
lea eax, [ebp - 0x34]
push eax
call ebx
jmp 0x1002bb3
push edi
lea eax, [ebp + 0x40]
push eax
call esi
lea eax, [ebp + 0x40]
push eax
call ebx
push edi
lea eax, [ebp + 0x10]
push eax
call esi
lea eax, [ebp + 0x10]
push eax
call ebx
push edi
lea eax, [ebp - 4]
push eax
call esi
lea eax, [ebp - 4]
push eax
call ebx
cmp dword [ebp + 0x24], 0
jne 0x1002ab9
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1002ab9
mov dword [ebp + 0x6c], 1
cmp dword [ebp + 0x2c], 0
jne 0x1002ad8
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1002ad8
mov dword [ebp + 0x6c], 1
cmp dword [ebp + 0x64], 0
jne 0x1002bb3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1002bb3
mov dword [ebp + 0x6c], 1
jmp 0x1002bb3
push 0x1001578
push 0x1001570
call fcn.01004f81
pop ecx
pop ecx
jmp 0x1002bb3
push edi
lea eax, [ebp + 0x10]
push eax
call esi
lea eax, [ebp + 0x10]
push eax
call ebx
lea eax, [ebp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov dword [ebp + 0x4c], eax
je 0x1002bb3
push edi
lea eax, [ebp + 0x50]
push eax
call esi
push dword [ebp + 0x60]
mov dword [ebp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov eax, dword [ebp + 0x60]
jne 0x1002b5b
lea eax, [ebp - 0x54]
push dword [ebp + 0x5c]
push eax
call fcn.01001de8
test eax, eax
je 0x1002bab
lea eax, [ebp + 0x50]
push eax
call ebx
push edi
lea eax, [ebp + 0x40]
push eax
call esi
lea eax, [ebp + 0x40]
push eax
call ebx
push edi
lea eax, [ebp - 0x54]
push eax
call esi
lea eax, [ebp - 0x54]
push eax
call ebx
push edi
lea eax, [ebp + 0x10]
push eax
call esi
lea eax, [ebp + 0x10]
push eax
call ebx
push edi
lea eax, [ebp - 4]
push eax
call esi
lea eax, [ebp - 4]
push eax
call ebx
and dword [ebp + 0x6c], 0
jmp 0x1002c67
push 7
lea eax, [ebp + 0x40]
push eax
call esi
cmp dword [ebp + 0x6c], 0
je 0x1002c67
push 0x1001560
lea eax, [ebp - 0x64]
push eax
push 0
call fcn.01005ebe
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x68]
push eax
push 0x1001558
push 0x100154c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp + 0x50]
push eax
push 0
push dword [ebp + 0x64]
push 0x1001538
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp + 0x50]
push eax
push 0x104
lea eax, [ebp - 0x3bc]
push eax
push 0x100146a
lea eax, [ebp + 0x68]
push eax
push 0x1001538
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x3bc], 0
jne 0x1002c41
lea eax, [ebp + 0x50]
push eax
push 0x1001524
lea eax, [ebp + 0x68]
push eax
push 0x1001538
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp + 0x50]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push dword [ebp + 0x4c]
lea eax, [ebp + 0x50]
push eax
call esi
push dword [ebp + 0x64]
and dword [ebp + 0x6c], 0
push 0
call fcn.01005aa4
shl dword [ebp + 0x70], 1
inc byte [ebp + 0x77]
cmp dword [ebp + 0x70], 0
jne 0x100280c
lea eax, [ebp - 0x1a8]
push eax
call fcn.0100462a
mov esi, dword [sym.imp.msvcrt.dll__mbscpy]
lea eax, [ebp - 0x5c4]
push eax
lea eax, [ebp - 0x3bc]
push eax
call esi
pop ecx
pop ecx
push 0x1001518
lea eax, [ebp - 0x3bc]
push eax
call fcn.01005a78
push eax
call esi
pop ecx
pop ecx
xor edi, edi
push edi
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.01004575
test eax, eax
je 0x1002d9f
push edi
push 0x8000080
push 4
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x3bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0x70], eax
je 0x1002d9f
lea eax, [ebp - 0x2b8]
push 0x100150c
push eax
call esi
pop ecx
pop ecx
push edi
mov edi, dword [sym.imp.msvcrt.dll__mbslen]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b8]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
pop ecx
push eax
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp + 0x70]
call ebx
test eax, eax
je 0x1002d94
lea eax, [ebp - 0x2b8]
push 0x1001504
push eax
call esi
lea eax, [ebp - 0x2b8]
push 0
push eax
call dword [sym.imp.msvcrt.dll_strchr]
add esp, 0x10
mov dword [ebp + 0x64], eax
push dword [ebp - 0x924]
push dword [ebp + 0x64]
call esi
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2b8]
push eax
call edi
pop ecx
push eax
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp + 0x70]
call ebx
test eax, eax
je 0x1002d94
lea eax, [ebp - 0x928]
push eax
call fcn.01004495
test eax, eax
jne 0x1002d56
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push dword [ebp + 0x38]
push edi
call fcn.01005aa4
push dword [ebp + 0x30]
push edi
call fcn.01005aa4
push dword [ebp + 0x34]
push edi
call fcn.01005aa4
push dword [ebp + 0x60]
push edi
call fcn.01005aa4
push dword [ebp + 0x3c]
push edi
call fcn.01005aa4
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret