Function at 0x40871f
Capabilities:
Copy file
Create directory
Enumerate network shares
Print debug messages
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
xor ebx, ebx
push esi
push edi
push ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
call fcn.004c8af7
pop ecx
push eax
call fcn.004cb22c
mov dword [esp], 0x20000
call fcn.004c8d06
mov dword [esp + 0x1c], eax
pop ecx
test eax, eax
je 0x408a89
lea edi, [eax + 0x100]
lea ecx, [eax + 0x20000]
mov dword [esp + 0x14], edi
mov eax, 0x104
mov dword [esp + 0x30], ecx
add edi, eax
mov dword [esp + 0x20], edi
add edi, eax
mov dword [esp + 0x2c], edi
add edi, 0x400
mov dword [esp + 0x48], edi
lea esi, [edi + 0x400]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x40], esi
jmp 0x4087d2
cmp eax, 0xea
je 0x408800
cmp eax, 0x842
jne 0x408929
cmp dword [esp + 0x1c], 0x78
jae 0x408929
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x1c]
lea eax, [esp + 0x34]
mov dword [esp + 0x10], ebx
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push eax
push 0x1f6
push ebx
call dword [sym.imp.NETAPI32.dll_NetShareEnum]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x4087a6
cmp byte [0x51e6c9], 0
je 0x408829
push dword [esp + 0x1c]
push str.K7RTScan:_Processing_Shares_Now___u_.._n
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x28], 0
mov eax, ebx
mov dword [esp + 0x24], eax
jbe 0x408906
mov dword [esp + 0x44], ebx
mov edx, dword [esp + 0x10]
mov ecx, dword [ebx + edx + 4]
test ecx, ecx
js 0x4088f2
jne 0x4088f2
mov edx, dword [ebx + edx + 0x24]
call fcn.00408687
test eax, eax
jne 0x4088ee
mov eax, dword [esp + 0x10]
push 0x104
push dword [ebx + eax + 0x18]
push dword [esp + 0x1c]
call fcn.004cb853
add esp, 0xc
cmp eax, 0xffffffff
je 0x4088ee
mov ecx, dword [esp + 0x14]
call fcn.00408249
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
call fcn.00408303
mov ecx, edi
call fcn.004083b9
push eax
mov eax, dword [esp + 0x24]
movsx eax, byte [eax]
dec eax
push eax
push dword [esp + 0x1c]
push str._s_c__K7DCPTFILEPTRN___s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
inc eax
mov ecx, edi
add esi, eax
call fcn.004083b9
push eax
call fcn.004cb20b
and eax, 3
movsx eax, byte [eax + str.xyz]
push eax
push dword [esp + 0x1c]
push str._s_c_s__K7DCPTFILEPTRN__
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
inc eax
add esp, 0x14
add esi, eax
mov eax, dword [esp + 0x24]
inc eax
add ebx, 0x28
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x28]
jb 0x40883e
xor ebx, ebx
cmp dword [esp + 0x10], 0
je 0x40891b
push dword [esp + 0x10]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x3c], 0xea
je 0x4087d2
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
sub eax, esi
mov edi, dword [esp + 0x48]
inc eax
mov byte [esi], bl
mov dword [esp + 0x30], eax
cmp byte [ecx], 0
je 0x408a7f
push eax
call fcn.004c8d06
mov dword [0x52a8e8], eax
pop ecx
test eax, eax
je 0x408a7f
mov ecx, dword [esp + 0x30]
push ecx
push dword [esp + 0x44]
push eax
call fcn.0049f810
mov ecx, dword [0x52a8e8]
add esp, 0xc
mov dword [esp + 0x30], ecx
jmp 0x408a73
push 0x104
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, esi
call fcn.0040847a
mov ecx, dword [esp + 0x18]
call fcn.004083b9
push str.CaptionIcon32x32.ico
push 0x51e708
push 0x50774c
push dword [esp + 0x38]
call dword [sym.imp.USER32.dll_wsprintfW]
push str..ico
push dword [esp + 0x2c]
push esi
push str._S_S_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
push ebx
push edi
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x3c
lea eax, [esp + 0x50]
push ebx
push eax
call fcn.0049ef70
add esp, 0xc
mov dword [esp + 0x4c], 0x3c
mov dword [esp + 0x50], 0x34
mov dword [esp + 0x64], str.This_directory_contains_bait_decoy_files_that_assists_in_early_ransomware_detection
push str..ico
push dword [esp + 0x1c]
push str._S_s
push dword [esp + 0x38]
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esp + 0x3c]
push 0x104
push esi
push edi
mov dword [esp + 0x90], eax
mov dword [esp + 0x9c], eax
call fcn.004c9d56
add esp, 0x1c
lea eax, [esp + 0x4c]
push 2
push edi
push eax
call dword [0x52a8f4]
push dword [esp + 0x30]
call fcn.004c8d20
pop ecx
mov ecx, dword [esp + 0x30]
inc ecx
add ecx, eax
mov dword [esp + 0x30], ecx
lock inc dword [0x52a8f0]
cmp byte [ecx], 0
jne 0x40897c
xor ebx, ebx
inc ebx
push dword [esp + 0x18]
call fcn.004c8ceb
pop ecx
xor eax, eax
xor ecx, ecx
mov edx, 0x52a9fc
inc eax
lock cmpxchg dword [edx], ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4