Function at 0x403460
Capabilities:
Check if file exists
Create directory
Create process on windows
Get common file path
Get file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2358
call fcn.005357a0
mov eax, dword [0x5b4e20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ecx, edx
push esi
mov dword [ebp - 0x2354], 0x3039
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403488
sub ecx, esi
cmp ecx, 1
jb 0x4034b1
test edx, edx
je 0x4034b1
push edx
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.0053170f
add esp, 0xc
jmp 0x4034b8
mov byte [ebp - 0x20c], 0
lea eax, [ebp - 0x414]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.HiddenFileFinder_Temp
lea eax, [ebp - 0x414]
push eax
push str._s_s
lea eax, [ebp - 0x824]
push 0x208
push eax
call fcn.00530e69
add esp, 0x14
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403505
test al, 0x10
jne 0x403514
push 0
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x2354]
push eax
call fcn.00531771
mov ecx, dword [ebp - 0x2354]
add esp, 4
test ecx, ecx
jns 0x403535
neg ecx
mov dword [ebp - 0x2354], ecx
mov eax, 0x431bde83
imul ecx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.HiddenFileFinder_Temp
lea eax, [ebp - 0x414]
push eax
push str._s_sVirusTotalCheck__d.html
lea eax, [ebp - 0x61c]
push 0x208
push eax
call fcn.00530e69
add esp, 0x18
lea eax, [ebp - 0x61c]
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4035a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005308a3
mov esp, ebp
pop ebp
ret
push edi
mov ecx, 0xe8
mov esi, str._t_html__head__script_typetext_javascript__twindow.onload__OnPageLoad_function_OnPageLoad__document.consulta.submit____t__script____head___body__t_center__h1___font_colorblue__VirusTotal_Threat_Report___font____h1___center__br__t_center__div_stylebackground_color:c4cbf2_width:450_margin_left:0px_border:1px_solid_black____t_br__form_nameconsulta_actionhttp:__www.virustotal.com_vt_en_consultamd5_methodpost__t_p_stylemargin_left:60px_text_align:left__MD5_Hash_of_File:__span_stylecolor:red__s__span___br__t_t_input_typetext_namehash_size50_value_s__t_input_typehidden_namex_value138__input_typehidden_namey_value24__t_br__br__input_typesubmit_valueSUBMIT_styleheight:40px__width:_150px_font_weight:bold__margin_left:100px___form__t_p_nbsp___p___div____center__t_h4___Note:_Click_on_SUBMIT_button_if_you_are_not_redirected_to_VirusTotal.com_automatically___h4__t__body___html_
lea edi, [ebp - 0xbc8]
rep movsd dword es:[edi], dword [esi]
push 0x5d79f0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x2350]
push 0x1388
push eax
movsb byte es:[edi], byte [esi]
call fcn.00530e69
add esp, 0x14
lea ecx, [ebp - 0x2350]
mov dword [ebp - 0x2358], 0
lea edx, [ecx + 1]
pop edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4035f6
push 0
lea eax, [ebp - 0x2358]
push eax
sub ecx, edx
push ecx
lea eax, [ebp - 0x2350]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x61c]
push eax
push str.file:____s
lea eax, [ebp - 0xfc8]
push 0x400
push eax
call fcn.00530e69
add esp, 0x10
lea eax, [ebp - 0xfc8]
push 3
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
cmp eax, 0x20
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005308a3
mov esp, ebp
pop ebp
ret